Data Processing Agreement

This Data Processing Agreement ("DPA") governs the processing of personal and enterprise business data between:

• Data Controller: The enterprise tenant entity (your company) who determines the purposes of data processing.
• Data Processor: UMMIGO ERP Private Limited, who processes data on behalf of the Controller under written instruction.
• Sub-Processors: Approved third parties (AWS, SendGrid, Twilio) engaged by UMMIGO ERP to deliver infrastructure services.

This DPA applies to all personal data processed through the UMMIGO ERP SaaS platform on behalf of the enterprise client.

UMMIGO ERP as Data Processor commits to the following obligations:

• Process personal data only on documented written instructions from the enterprise Controller.
• Ensure all authorized staff processing personal data are bound by confidentiality obligations.
• Implement and maintain technical safeguards as described in the Security Addendum (AES-256, TLS 1.3, RBAC).
• Assist the Controller in responding to data subject access requests within legally mandated timeframes.
• Notify the Controller of any personal data breach within 72 hours of confirmed discovery.
• Delete or return all personal data to the Controller upon termination of services.

As the Data Controller, the enterprise tenant accepts responsibility for:

• Ensuring lawful basis for processing employee personal data (CNIC, biometrics, salary information).
• Providing required disclosures and consents to employees whose data is processed through the platform.
• Configuring role-based access controls appropriately to limit data access to authorized personnel.
• Complying with applicable national laws (PECA 2016, PDPB) governing data collected through the platform.

UMMIGO ERP implements the following verified technical safeguards:

• Encryption: AES-256 at rest; TLS 1.3 in transit across all network layers.
• Access Control: Multi-factor authentication, IP whitelisting, role-based permission matrices (RBAC).
• Data Isolation: Logical multi-tenant database schema isolation per enterprise account.
• Logging: Immutable audit trails for all data modification events (GL vouchers, HR records, API calls).
• Backup: Daily automated encrypted snapshots with 90-day point-in-time recovery.
• Incident Response: Documented P1 breach escalation protocol with 72-hour Controller notification SLA.

UMMIGO ERP currently engages the following approved sub-processors under binding data processing agreements:

Sub-processor updates are communicated via email notice 14 days in advance. Controllers may object to new sub-processors in writing within this window.