Legal

Data Processing Addendum

Bridge CRM — a product of Talent Bridge Services (OPC) Private Limited · Last updated 14 September 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Talent Bridge Services (OPC) Private Limited ("Processor", "we") and the Customer ("Fiduciary", "you"). It applies to personal data in Customer Data that we process for you. If this DPA and the Terms conflict on data protection, this DPA prevails. Terms defined in the Digital Personal Data Protection Act, 2023 ("DPDP Act") have the same meaning here.

1. Roles and scope

You are the Data Fiduciary and we are your Data Processor for personal data in Customer Data: people in your leads, customers and contacts, your users, and calls, messages and attendance records. The processing consists of storing, organising, retrieving, transmitting, analysing and deleting that data to provide Bridge CRM, for as long as you use it and as section 9 describes.

2. Your instructions

We process personal data only on your documented instructions. These Terms, this DPA, your plan and the settings and actions you and your users take in Bridge CRM are your instructions. We will tell you if we believe an instruction breaks the law, and we may decline to follow it.

You confirm you have a lawful basis for the data you give us and for your instructions, that you have given the notices the DPDP Act requires, and that you have verifiable parental or guardian consent for any person under 18 whose data you load.

3. Our people

Only personnel who need access to provide or support the service can access personal data. They are bound by confidentiality obligations. We access a workspace's content only to provide support you ask for, to keep the service secure, or when the law requires.

4. Security

We maintain reasonable security safeguards, as section 8(5) of the DPDP Act requires, including:

• a separate database for each workspace;
• encryption at rest for names, phone numbers, email addresses, transcripts and integration secrets, and TLS for all connections;
• role-based access you control, two-factor authentication and passkeys, and session controls;
• audit logs of sensitive actions, kept 365 days by default and configurable from 30 to 3,650 days;
• encrypted backups and tested restore procedures;
• system logs kept in India for at least 180 days and incident reporting to CERT-In as its Directions require;
• prompt fixes for security vulnerabilities and least-privilege administrative access.

5. Sub-processors

You authorise us to use the sub-processors listed on our sub-processors page. We bind each sub-processor to data protection obligations at least as protective as this DPA and remain responsible for its performance. We will give workspace owners at least 30 days' notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot address the objection, you may cancel the affected service and receive a refund of prepaid fees for the unused period.

6. Requests from individuals

Bridge CRM lets you access, export, correct, mark do-not-contact and delete records, so you can answer requests under the DPDP Act. If we receive a request about your data, we will pass it to you without undue delay and will not answer it ourselves except to confirm we forwarded it. If you do not act on an erasure request within 15 days of our forwarding it, you authorise us to delete the record, unless you tell us of a legal obligation to keep it.

7. Personal data breaches

We will notify you without undue delay, and within 24 hours after confirming a personal data breach affecting your data. We will describe what happened, the data and people likely affected, the steps we have taken and a contact for more information, and we will update you as we learn more. We will help you meet your duties to inform the Data Protection Board of India and affected people, and we will report to CERT-In where its Directions require.

8. Transfers outside India

Customer Data is hosted in India. Some sub-processors process data in other countries, as the sub-processors page shows. We will not transfer personal data to a country the Government of India has restricted under section 16 of the DPDP Act.

9. Retention and deletion

We keep personal data for as long as you keep it in Bridge CRM. Deleted records stay in Trash for 30 days unless you delete them permanently sooner. When your subscription ends, you can export your data for 30 days; we then delete it from live systems within a further 30 days. Daily backups roll off within 30 days and encrypted disaster-recovery copies within 90 days. We keep only what the law requires us to keep, such as billing records.

10. Bridgy learning

• Keeping the workspace learning record and producing "what's working" analysis and next-move suggestions is processing on your behalf, as part of the service.
• Shared learning. If your workspace owner switches it on, you instruct us to create a de-identified copy of eligible lead outcomes as our Privacy Policy describes, and you confirm your notices to individuals allow this. The copy excludes Meta, Google, LinkedIn, other ad-platform and marketplace data, and leads marked do-not-contact or under 18. We will not attempt to re-identify anyone from it. Once de-identified it is no longer personal data and our Terms (section 11) govern its use. Switching it off stops future copies.

11. Information and audits

We will answer reasonable written security and privacy questionnaires once a year, and provide information needed to show we comply with this DPA. If a regulator requires an audit, or after a personal data breach affecting your data, we will allow an audit by you or an independent auditor bound by confidentiality, on 30 days' notice, during business hours and at your cost.

12. Liability and term

The limitations of liability in the Terms apply to this DPA. This DPA lasts as long as we process personal data for you.

13. Contact

Data protection questions: hello@talentbridgeservices.tech · Grievance Officer: see our Privacy Policy.