Perchpush

Draft — last updated 20 October 2026

Data Processing Agreement

This agreement (“DPA”) is part of the Terms of service between Neptechpal Pvt. Ltd., Nepal (“Processor”, “we”) and the customer using Perchpush (“Controller”, “you”). It applies whenever we process personal data for you, and meets Article 28 of the EU and UK GDPR. It takes effect when you accept the Terms; no signature is needed. For a countersigned copy, email info@neptechpal.com.np.

1. Scope of processing

2. Your instructions

We process personal data only on your documented instructions — these terms, your settings in the dashboard and your API calls — unless the law requires otherwise, in which case we tell you first where we lawfully can. We tell you if we think an instruction breaks data-protection law. You are responsible for having a lawful basis and the consents needed to message your users.

3. Confidentiality

Everyone at Neptechpal with access to your data is bound by confidentiality and has access only as far as their work needs.

4. Security

We apply the technical and organisational measures in the annex below and keep them up to date. We may change them as long as protection is not reduced.

5. Sub-processors

You give general authorisation for the sub-processors on our sub-processors page. We bind each to data-protection terms at least as protective as this DPA and remain responsible for them. We notify app owners by email at least 30 days before adding or replacing one. You may object on reasonable grounds within that period; if we cannot resolve it, you may end the affected service and we refund unused prepaid fees.

6. International transfers

Your data is hosted in Germany (EU). Where personal data is transferred outside the EEA, UK or Switzerland — including access from Nepal for support and operations, and transfers to sub-processors in other countries — the European Commission’s Standard Contractual Clauses (Decision 2021/914), with the UK Addendum where relevant, apply and are incorporated by reference, together with any additional safeguards needed.

7. Helping you

Taking into account what we can see and do, we help you answer data-subject requests (the dashboard lets you find, export and delete any end user’s data), carry out data-protection impact assessments, and consult supervisory authorities. If a data subject contacts us directly, we pass the request to you and do not answer it ourselves unless you ask us to.

8. Personal-data breaches

We notify you without undue delay, and within 72 hours, after becoming aware of a breach affecting your data. We tell you what happened, the data and people likely affected, likely consequences and what we are doing about it, and update you as we learn more.

9. Deletion and return

You can export your data at any time from the dashboard. When you delete an app or end your account, we delete the personal data we hold for you from the live system at once and from backups within 30 days, unless the law requires us to keep it. Logs and events are also deleted continuously after each app’s retention window.

10. Audits

We make available the information needed to show we meet this DPA. Once a year, or after a breach, you may audit us, or have an independent auditor bound by confidentiality do so, with 30 days’ notice, during business hours, at your cost, and in a way that does not expose other customers’ data. We may first answer by written questionnaire and documentation.

11. Liability and order of precedence

Liability under this DPA follows the limits in the Terms, except where data-protection law does not allow it. If this DPA conflicts with the Terms, this DPA wins for personal data; the Standard Contractual Clauses win over both.

Annex: security measures