Data Processing Agreement

Last updated12 November 2026

We sign a Data Processing Agreement (DPA) with every ElevatorPlus customer, together with a non-disclosure agreement. The DPA is written to meet Article 28 of the GDPR and the UK GDPR, and India's Digital Personal Data Protection Act, 2023, and it covers:

  • Roles: you are the controller (Data Fiduciary) of the data you put into ElevatorPlus, and we are your processor (Data Processor). We process it only on your documented instructions.
  • Scope: the types of personal data, the people it relates to, the purposes and the duration of processing, set out in an annex.
  • Our staff: access limited to what support and operations need, under confidentiality obligations; support access to your account is removed after onboarding and re-enabled only at your request.
  • Separation: your data is kept in its own database, separate from every other customer.
  • Security: the technical and organisational measures we apply, set out in an annex and matching our Data Security page.
  • Sub-processors: the list at Sub-processors page, written contracts with each of them, and notice to you before changes, with the right to object.
  • Assistance: helping you respond to requests from individuals, to carry out impact assessments and to deal with authorities.
  • Incidents: telling you without undue delay about a personal data breach, with the information you need to meet your own reporting duties.
  • International transfers: the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where they apply, and in-country hosting where data residency rules require it.
  • Audit: information and audit rights, with reasonable notice.
  • End of contract: export of your data for 30 days after the contract ends, then deletion within 90 days, with written confirmation on request.

Security incidents are handled under the direction of our founder, Mr. Sumeet Katariya, who is also our Grievance Officer. Existing customers who have not yet signed the DPA are being asked to sign it. To request a copy or a signed counterpart, email hello@elevatorplus.app.