Data Processing Agreement

This page sets out the terms under which Garvse India Pvt Ltd ("Code5X", "we") processes personal data on behalf of a client ("you", the "controller") in the course of a project engagement. It's published here as our standard DPA — for a project that needs a signed copy, we execute it as an addendum to the services agreement, not as a standalone contract you accept by using this website.

For client data processed while building or supporting your product, you are the controller and Code5X is the processor, acting only on your documented instructions as agreed during scoping.

Processing is limited to what's necessary to design, build, test, deploy, and support the specific product or feature scoped in your engagement — not for any other purpose, and not retained longer than the engagement plus any agreed support period.

Our own tooling runs on Vercel (hosting), Supabase (database), Resend (transactional email), Cloudflare (DNS/CDN), GitHub (source code), Google Workspace (business email), Cal.com (scheduling), and Google Analytics (site analytics). Any subprocessor used specifically for your project — a payment gateway, a cloud provider, an email service — is agreed with you during scoping before it's used, and named in your project's own documentation rather than assumed from this list.

Access to client code and data is limited to the engineers actually working on your project, with no shared logins and access removed when a project ends. We don't reuse or reference one client's data while working on another's. Full detail is on our Trust & Security page.

Our team operates from India, with a US-based point of contact in Atlanta. Data processed through the subprocessors above may be hosted outside India depending on that provider's own infrastructure — we don't control or guarantee specific data center locations beyond what each subprocessor publishes.

If you receive a request from one of your users to access, correct, or delete their data, we'll support you in fulfilling it for anything we hold on your behalf. If we become aware of a breach affecting your data, we'll notify you without undue delay once we've confirmed it.

When an engagement ends, we delete or return client data we hold that isn't needed for an agreed support period, on your written request.

This DPA is governed by the laws of India, consistent with the services agreement it's attached to.

To execute a signed DPA for your engagement — with your organization's name, effective date, and any project-specific subprocessors filled in — email kapilan@code5x.com and we'll send one as part of scoping.