Data Processing Agreement (DPA)

In compliance with the Digital Personal Data Protection (DPDP) Act 2023 & GDPR standards.

1. Purpose & Scope

This DPA governs the automated processing of operational telemetry and financial metadata between HYPOTHETICA LLP ("Data Processor") and the client organization ("Data Fiduciary").

2. Local Anonymization & PII Scrubbing

Local Hash Anonymization: Personal Identifiable Information (PII) is scrubbed locally via SHA-256 salted hashes before transmission.
Encryption: Encryption in transit (TLS 1.3) and at rest (AES-256).

3. DPDP Act 2023 Compliance

HYPOTHETICA LLP acts strictly as a Data Processor under Section 8 of India's DPDP Act 2023. Clients retain 100% data ownership and deletion rights.

4. Data Erasure & Retention

Telemetry records are retained strictly during active subscriptions. Deletion is executed within 30 days of contract termination.