Data processing agreement

Last updated: 31 October 2026

This data processing agreement (“DPA”) forms part of every services agreement, proposal or statement of work (the “Agreement”) between Takshvi Agency (“Takshvi”, the “processor”) and the client named in it (the “client”, the “controller”) whenever Takshvi processes personal data on the client’s behalf. It is designed to meet Article 28 of the EU GDPR and the UK GDPR. A countersigned copy is available on request from hello@takshvi.agency.

1. Scope and roles

The client is the controller and Takshvi is the processor of the personal data described in the Agreement. Where the client is itself a processor, Takshvi acts as its sub-processor and the client confirms it has authority to appoint us.

2. Details of the processing

  • Subject matter and purpose: delivering the services in the Agreement, such as website and CRM development, data migration, data processing and support.
  • Duration: the term of the Agreement and any agreed period afterwards for returning or deleting data.
  • Categories of data subjects: typically the client’s customers, prospects, website visitors and staff, as specified in the Agreement.
  • Categories of personal data: typically contact details, account and transaction data, communications and usage data. Special category data is processed only if the Agreement expressly says so.

3. Our obligations

Takshvi will:

  1. process personal data only on the client’s documented instructions, including the Agreement, and tell the client if we believe an instruction breaks data protection law;
  2. ensure everyone who processes the data is bound by confidentiality;
  3. apply the technical and organisational measures in section 6;
  4. engage sub-processors only as set out in section 4;
  5. help the client respond to requests from data subjects exercising their rights;
  6. help the client with security, breach notification, data protection impact assessments and consultations with authorities, taking into account the information available to us;
  7. notify the client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting client data;
  8. at the end of the services, delete or return all client personal data at the client’s choice, unless law requires us to keep it;
  9. make available the information needed to demonstrate compliance with this DPA, and allow reasonable audits with at least 30 days’ notice.

4. Sub-processors

The client authorises Takshvi to use the sub-processors below, and any others named in the Agreement. We will give at least 14 days’ notice of a new sub-processor so the client can object on reasonable data protection grounds. Each sub-processor is bound by data protection terms no less protective than this DPA.

  • Google LLC — email, document storage and video calls.
  • HubSpot, Inc. — CRM and project communications, where the client’s data is held in our portal.
  • Cloud hosting providers agreed per project, such as Amazon Web Services, Google Cloud or DigitalOcean.

Where possible we work directly inside the client’s own systems, so the data stays in the client’s accounts.

5. International transfers

Takshvi is located in India. For personal data transferred from the EU or EEA, the parties incorporate the European Commission’s Standard Contractual Clauses (Module 2, or Module 3 where the client is a processor). For personal data from the UK, the parties incorporate the UK International Data Transfer Addendum. The Agreement and this DPA provide the information required by the annexes of those clauses.

6. Security measures

  • Encryption of data in transit (TLS) and at rest on our devices and storage.
  • Multi-factor authentication on every business account.
  • Access limited to named team members who need it, removed when they no longer do.
  • Confidentiality agreements with all staff and contractors.
  • Use of test or anonymised data in development wherever possible.
  • Secure deletion of client data at the end of the engagement.

7. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Agreement, except where the law does not allow it to be limited. If this DPA conflicts with the Agreement on the protection of personal data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the clauses prevail.

8. Contact

Privacy questions or a request for a signed copy: hello@takshvi.agency.