Data Processing Addendum (DPA)

1. Scope, Applicability & Entity Roles

This Data Processing Addendum ("DPA") supplements the Terms of Service between CodeYB Studio (trading as codeYB — Code Your Business, accessible at www.codeyb.com) and the entity commissioning software engineering services ("Client").

2. Processor Obligations & Processing Restrictions

codeYB covenants that it shall:

• Process Client Personal Data strictly for the performance of software engineering, cloud architecture, and technical support specified in the active Statement of Work (SOW).
• Never sell, rent, monetize, or disclose Client Personal Data or software repositories to third-party advertisers or brokers.
• Ensure all personnel authorized to access customer data or staging environments have executed binding confidentiality and Non-Disclosure Agreements (NDAs).
• Assist the Client in fulfilling data subject access, rectification, and erasure requests under applicable statutory privacy regimes.

3. Technical & Organizational Measures (TOMs)

🔒 SOC-2 & ISO 27001 Aligned Security Framework:

4. Subprocessor Governance & Approved Infrastructure

codeYB engages vetted cloud infrastructure subprocessors operating under strict data processing agreements matching the security obligations of this DPA:

5. Security Incident Management & 48-Hour Notification SLA

⚡ Guaranteed Incident Escalation Protocol:

In the confirmed event of a security incident affecting Client Personal Data within systems managed by codeYB, codeYB will:

• Notify the Client's designated technical contact in writing within forty-eight (48) hours of confirmed breach verification.
• Provide remediation logs, root cause analysis (RCA), and details of compromised records.
• Take immediate mitigation measures to isolate affected microservices and neutralize the threat vector at no extra cost to Client.

6. Data Return, Repository Handover & Secure Sanitization

Upon completion of an engineering contract or formal written request by Client:

1. codeYB transfers all production Git branches, Docker images, and database schemas directly to the Client's cloud infrastructure accounts.
2. Within thirty (30) calendar days of formal project signoff, codeYB permanently sanitizes and removes all staging database snapshots and client test data from internal developer machines in accordance with NIST SP 800-88 standards.

7. Governing Law, Exclusive Jurisdiction & Legal Desk

This DPA is governed by and construed in accordance with the laws of the Republic of India. The parties irrevocably submit to the exclusive jurisdiction of the competent courts in Hyderabad, Telangana, India.