Data Processing Agreement (DPA)

Businesses that use IvaFlow to manage their own customer data act as the controller of that data, and Designiva acts as a processor for it. Where applicable privacy law requires a processing agreement between controller and processor, the DPA provides that framework. It applies per organisation: the agreement is between Designiva and the legal entity that holds the IvaFlow account.

The DPA documents, among other things:

• The subject matter, duration and purpose of processing on your instructions.
• Confidentiality commitments for personnel permitted to process your data.
• The security measures applied to protect your data.
• Our obligations to assist you with data subject requests and with the security of processing.
• Return or deletion of your data when the agreement ends, consistent with the Privacy Policy and the data-deletion controls available in the platform.
• How changes to the Service, applicable law and required disclosures are managed over time.

To operate, secure, maintain and deliver the Service, IvaFlow relies on third-party service providers and infrastructure providers under their own confidentiality and data-handling commitments. Where a customer contract, a DPA or applicable privacy law requires a specific provider to be identified for your organisation, that identification is made in the executed DPA document itself rather than on this page, so the disclosure you receive is accurate and specific to your agreement.

The standard path is digital self-service signing. As the organisation owner, open Settings → Legal & Agreements, find the DPA row and choose Review & sign. You confirm that you have read the agreement and that you are authorised to bind your organisation, then type your full name as your electronic signature. The DPA is executed immediately — no paperwork, no document uploads, no waiting for email exchanges.

Signing creates a permanent, audit-backed record: the platform captures the exact execution time (UTC), the signing account, the source IP address and the browser as evidence. The record is append-only — it cannot be edited or deleted by anyone in your organisation. The DPA row then shows Digitally executed with a reference, and the owner can download an execution certificate (a generated PDF with the full signing evidence) at any time.

Offline signing (paper or email) remains available as an exception — for example when your legal team requires a countersigned document. Contact ivaflow@designiva.in and, once both parties have signed offline, the execution is recorded for your organisation with the countersigned copy held privately on file. Those organisations see Executed with the same reference, date and a Signed copy download when a stored document exists.

Your acceptance of the Terms of Service and acknowledgement of the Privacy Policy are recorded as read-only audit evidence (document versions, timestamp and acceptance context) and shown to your organisation owner in Settings → Legal & Agreements. These records are maintained by the platform, cannot be edited by users, and are preserved so that your organisation always has proof of which document versions applied to it at any point in time.

When an updated DPA template or an updated legal document version is published, affected organisation owners are asked to review and accept it explicitly before continuing to use the Service — existing agreements and acceptance records are never silently modified. The version and effective date at the top of this page identify the current template.