Data Processing Addendum

1.1 This Data Processing Addendum (“DPA”) establishes the contractual framework governing the processing of personal data by BANI GLOBAL INDUSTRIES LLP, operating the StampMitra Developer Platform (“StampMitra”), on behalf of a Developer where StampMitra acts as a Data Processor or equivalent service provider.

1.2 This DPA forms part of the contractual framework governing the Developer's use of the StampMitra Developer Platform and APIs.

1.3 This DPA is intended to supplement, and where applicable operate together with:

• the StampMitra Developer Terms of Service;
• the StampMitra Developer Privacy Policy;
• API-specific terms;
• Service-Specific Terms;
• applicable commercial agreements; and
• other contractual documents expressly incorporated into the Developer relationship.

1.4 This DPA does not mean that StampMitra acts as a Data Processor for every item of personal data processed through the Developer Platform.

1.5 The legal role of each party shall be determined according to:

• the actual processing activity;
• the purpose of processing;
• the means of processing;
• applicable law;
• the parties' contractual arrangement; and
• the factual circumstances of the relevant transaction.

2.1 This DPA is intended to support compliance with applicable Indian data-protection law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), to the extent applicable to the relevant processing activity.

2.2 The DPDP Act recognizes the distinction between Data Fiduciaries and Data Processors.

2.3 The DPDP Act permits different provisions to commence on different dates. The official commencement framework notified in November 2025 provides phased implementation.

2.4 Accordingly, references in this DPA to provisions that have not yet become operative shall be interpreted as contractual commitments or implementation arrangements to the extent legally permissible, and shall not be interpreted as an assertion that a provision is already enforceable before its statutory commencement.

2.5 Where another applicable privacy or data-protection law imposes additional mandatory requirements, the parties shall comply with that law to the extent applicable.

For this DPA:

3.1 “Applicable Data Protection Law”

Means all applicable laws, rules, regulations, notifications, directions and legally binding requirements relating to privacy, personal data, cybersecurity, data protection or electronic records applicable to the relevant processing activity.

3.2 “Data Fiduciary”

Has the meaning assigned under applicable law and, under the DPDP Act, means a person who alone or together with others determines the purpose and means of processing personal data.

3.3 “Data Processor”

Means a person who processes personal data on behalf of a Data Fiduciary.

3.4 “Data Principal”

Means the individual to whom personal data relates, as defined under applicable law.

3.5 “Developer Data”

Means personal data submitted, transmitted or otherwise made available by or through the Developer to StampMitra for processing under an API or Service where StampMitra acts as a Data Processor or equivalent service provider.

3.6 “Personal Data”

Has the meaning assigned under applicable law.

3.7 “Processing”

Includes collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, transmission, dissemination, restriction, erasure or destruction, to the extent included within applicable law.

3.8 “Security Incident”

Means an event affecting the confidentiality, integrity or availability of Developer Data.

3.9 “Personal Data Breach”

Means a breach as defined under applicable law, including unauthorized processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access where applicable.

3.10 “Subprocessor”

Means a third party engaged by StampMitra to process Developer Data on StampMitra's behalf in connection with the Services.

3.11 “Services”

Means the APIs, technology services, verification services, document services, e-Stamp services, e-Sign services, infrastructure and related functionality provided by StampMitra.

3.12 “Underlying Service Provider”

Means a third-party service provider, authorized data source, technology provider, infrastructure provider, service network, regulated entity, government-connected service, or other external provider used in connection with a Service.

4.1 This DPA applies where:

• 1. the Developer uses a StampMitra Service;
• 2. the Developer submits personal data to StampMitra;
• 3. StampMitra processes that personal data on behalf of the Developer; and
• 4. the relevant processing is within the scope of a Data Processor or equivalent contractual relationship.

4.2 This DPA does not automatically apply to:

• Developer Account registration data;
• StampMitra billing records;
• StampMitra security logs;
• StampMitra's own fraud-prevention processing;
• legal and regulatory records;
• independently determined processing;
• data processed where StampMitra is acting as an independent Data Fiduciary; or
• other processing activities for which the parties have separate legal responsibilities.

4.3 Such processing may instead be governed by the StampMitra Developer Privacy Policy.

5.1 The Developer is generally responsible for determining:

• why Developer Data is collected;
• why Developer Data is submitted to StampMitra;
• the intended business purpose;
• the relevant End User relationship;
• required notices;
• required permissions or consent;
• lawful submission of the information.

5.2 StampMitra shall process Developer Data within the scope of the Services and applicable contractual instructions where it acts as a Data Processor.

5.3 Neither party shall intentionally mischaracterize its legal role solely for contractual convenience.

6.1 StampMitra shall process Developer Data:

• to provide the Services;
• according to documented instructions reasonably communicated by the Developer;
• according to the applicable API specification;
• according to applicable Service-specific requirements;
• to maintain security;
• to prevent fraud and abuse;
• to comply with applicable law.

6.2 Instructions may be expressed through:

• API requests;
• API configuration;
• Project configuration;
• documented integration requirements;
• written support instructions;
• contractual terms;
• Service-specific documentation.

6.3 StampMitra shall not be required to follow an instruction that:

• violates applicable law;
• compromises Platform security;
• conflicts with a mandatory technical requirement;
• requires unlawful processing;
• materially compromises other customers or systems.

The Developer shall:

• 1. lawfully collect Developer Data;
• 2. provide required privacy notices;
• 3. obtain consent where legally required;
• 4. maintain appropriate authorization;
• 5. ensure data submitted is relevant and necessary;
• 6. avoid unlawful or excessive collection;
• 7. maintain appropriate security;
• 8. protect API credentials;
• 9. maintain lawful instructions;
• 10. comply with applicable Data Principal rights;
• 11. respond appropriately to End User requests;
• 12. promptly notify StampMitra of relevant security incidents.

Developer Data may include, depending on the relevant API:

• name;
• mobile number;
• email address;
• address;
• identity information;
• identification-document information;
• business information;
• organization information;
• application information;
• transaction information;
• document information;
• e-Stamp-related information;
• e-Sign-related information;
• verification information;
• metadata;
• other information expressly required by a Service.

The precise categories depend upon the API and the Developer's implementation.

Developer Data may concern:

• Developer customers;
• End Users;
• applicants;
• business owners;
• employees;
• authorized representatives;
• document parties;
• signatories;
• customers of Developer applications;
• other individuals whose information is submitted through an authorized integration.

10.1 Developers shall not submit sensitive or high-risk information unless required or expressly permitted by the relevant Service.

10.2 Where an API requires such information, the Developer shall ensure that the submission is lawful.

10.3 StampMitra may restrict or reject unnecessary sensitive information.

11.1 Developers shall not submit children's personal data unless the relevant Service permits such processing and applicable legal requirements have been satisfied.

11.2 Where enhanced requirements apply, the Developer remains responsible for satisfying requirements concerning:

• parental consent;
• lawful authorization;
• age verification;
• applicable restrictions;
• appropriate notices.

11.3 StampMitra may suspend processing where required safeguards are absent.

12.1 The Developer shall submit only information reasonably required for the requested Service.

12.2 StampMitra may implement technical controls intended to reduce unnecessary collection or storage.

12.3 Developers must not use an API as a general-purpose personal-data storage system unless expressly authorized.

13.1 The Developer is responsible for the accuracy of data supplied to StampMitra.

13.2 StampMitra may rely on data supplied by the Developer unless it has reason to believe that the information is materially inaccurate or unlawful.

13.3 Where an external source supplies information, the source's data-quality characteristics may apply.

14.1 Developer Data shall be processed only for purposes connected with:

• the Developer's instructions;
• the requested Service;
• security;
• fraud prevention;
• compliance;
• legal obligations;
• other purposes expressly authorized under the applicable contractual framework.

14.2 StampMitra shall not intentionally repurpose Developer Data for unrelated commercial purposes merely because such data is technically available.

The Developer shall not instruct StampMitra to:

• unlawfully profile individuals;
• conduct unauthorized surveillance;
• create fraudulent identity records;
• process stolen personal data;
• bypass consent requirements;
• misuse government or verification information;
• facilitate identity theft;
• process information for unlawful discrimination;
• circumvent applicable legal restrictions.

16.1 The Developer may specify retention requirements where technically supported and legally permissible.

16.2 Where no specific retention requirement is supplied, StampMitra may retain Developer Data for the period reasonably necessary to:

• provide the Service;
• maintain transaction integrity;
• resolve disputes;
• meet legal requirements;
• maintain security;
• satisfy audit requirements.

17.1 Retention may differ between:

• API request data;
• API response data;
• transaction records;
• documents;
• verification records;
• audit logs;
• security logs;
• billing records;
• support records;
• backup copies.

17.2 A single universal retention period shall not be assumed.

18.1 Upon expiry or termination of the relevant Service, StampMitra shall, subject to applicable law and contractual requirements, delete or return Developer Data where reasonably practicable.

18.2 Deletion may be delayed where retention is required for:

• law;
• accounting;
• tax;
• dispute resolution;
• fraud investigation;
• cybersecurity;
• regulatory compliance;
• legal claims.

19.1 Developer Data may remain temporarily in encrypted or otherwise protected backup systems.

19.2 Such data shall be subject to the applicable backup lifecycle.

19.3 Backup copies shall not ordinarily be restored for active processing merely because they continue to exist, except where required for operational recovery or other legitimate purposes.

Where technically supported and legally required, StampMitra may provide Developer Data in a reasonable machine-readable format.

The precise format and scope may depend upon:

• API architecture;
• storage model;
• applicable Service;
• contractual arrangement.

StampMitra shall maintain reasonable technical and organizational safeguards appropriate to the risks associated with processing Developer Data.

Security measures may include:

• encryption;
• access control;
• authentication;
• role-based access;
• logging;
• monitoring;
• backup;
• vulnerability management;
• incident response;
• secure development;
• credential management.

The DPDP Rules' explanatory material specifically describes reasonable safeguards such as encryption, access control, monitoring, backups, breach detection and logs.

22.1 StampMitra shall ensure that personnel authorized to access Developer Data are subject to appropriate confidentiality obligations.

22.2 Confidentiality obligations shall survive the end of the individual's or contractor's active involvement with the relevant processing, subject to applicable law.

StampMitra may implement:

• least-privilege access;
• role-based permissions;
• privileged-access controls;
• authentication requirements;
• credential rotation;
• access logging;
• periodic access review.

Where technically appropriate, StampMitra may employ encryption:

• during transmission;
• at rest;
• for backups;
• for credential protection;
• for selected sensitive operational records.

Specific encryption mechanisms may change as technology and security standards evolve.

StampMitra may implement:

• firewalls;
• network segmentation;
• access restrictions;
• rate limiting;
• traffic monitoring;
• intrusion detection;
• denial-of-service mitigation;
• other appropriate network controls.

StampMitra may maintain security practices including:

• secure coding;
• dependency management;
• vulnerability assessment;
• authentication controls;
• input validation;
• authorization checks;
• security logging;
• controlled deployment.

StampMitra shall maintain mechanisms designed to protect:

• API credentials;
• access tokens;
• webhook secrets;
• authentication information;
• internal service credentials.

Developers remain responsible for credentials under their control.

The Developer shall:

• protect API Keys;
• use secure transport;
• restrict access;
• maintain appropriate authentication;
• secure webhook endpoints;
• prevent unauthorized access;
• avoid exposing personal data in public logs;
• implement reasonable application security.

29.1 StampMitra may engage Subprocessors where necessary to provide the Services.

29.2 Subprocessors may provide:

• hosting;
• infrastructure;
• database services;
• storage;
• monitoring;
• communications;
• cybersecurity;
• document processing;
• payment functionality;
• verification technology;
• other operational services.

29.3 StampMitra shall impose appropriate contractual or technical obligations on relevant Subprocessors where required.

30.1 Certain Services may require StampMitra to transmit or otherwise process Developer Data through Underlying Service Providers.

30.2 Such providers may include external:

• technology providers;
• authorized data sources;
• verification networks;
• document services;
• e-Sign infrastructure;
• e-Stamp infrastructure;
• government-connected systems;
• regulated or authorized service providers.

30.3 The Developer authorizes StampMitra to use such providers where reasonably necessary to perform the requested Service.

31.1 StampMitra may maintain confidential commercial arrangements with Underlying Service Providers.

31.2 The Developer is not automatically entitled to receive:

• provider names;
• provider contracts;
• wholesale pricing;
• upstream credentials;
• internal routing logic;
• provider-specific technical architecture.

31.3 Where disclosure is legally required, StampMitra shall comply with the applicable requirement.

32.1 Not every Underlying Service Provider is necessarily a Subprocessor.

32.2 The classification depends on the actual processing arrangement and applicable law.

32.3 StampMitra may therefore maintain separate internal classifications for:

• infrastructure Subprocessors;
• operational vendors;
• independent service providers;
• Underlying Service Providers;
• Data Fiduciaries;
• authorized data sources.

33.1 Developer Data may be processed outside India where legally permissible.

33.2 StampMitra shall consider applicable legal requirements governing international processing and transfers.

33.3 Additional safeguards may include:

• contractual safeguards;
• encryption;
• access controls;
• technical restrictions;
• approved service-provider arrangements.

The DPDP Act includes a statutory framework concerning processing outside India and permits the Central Government to restrict such processing in specified circumstances.

34.1 The Developer remains primarily responsible for responding to Data Principal requests concerning Developer-controlled data.

34.2 StampMitra shall provide reasonable assistance where required by law or the applicable contractual arrangement.

34.3 Requests may concern:

• access;
• correction;
• erasure;
• grievance;
• withdrawal of consent;
• other applicable rights.

Where StampMitra receives a Data Principal request relating to Developer Data, StampMitra may:

• 1. forward the request to the Developer;
• 2. request confirmation of the Developer's authority;
• 3. assist technically where required;
• 4. take action where legally required;
• 5. apply reasonable identity verification.

StampMitra may directly respond to a Data Principal where:

• required by law;
• StampMitra is independently responsible for the processing;
• the request concerns StampMitra's own processing;
• the Developer has authorized StampMitra to respond;
• immediate action is necessary to protect rights or security.

37.1 StampMitra shall maintain procedures for identifying and responding to Personal Data Breaches.

37.2 Where a Personal Data Breach involving Developer Data occurs, StampMitra shall take reasonable steps to:

• contain the incident;
• investigate;
• assess impact;
• mitigate harm;
• restore affected systems;
• preserve relevant evidence.

38.1 Where legally and contractually required, StampMitra shall notify the Developer after becoming aware of a confirmed or reasonably suspected Personal Data Breach involving Developer Data.

38.2 The notification may include, where reasonably available:

• nature of incident;
• affected systems;
• categories of data;
• approximate impact;
• known timeline;
• mitigation steps;
• recommended Developer actions;
• contact information for coordination.

Where StampMitra is legally responsible for regulatory notification, StampMitra shall comply with applicable reporting requirements.

Where the Developer is the responsible Data Fiduciary, StampMitra shall provide reasonable information necessary for the Developer to satisfy its legal obligations, subject to confidentiality, security and applicable law.

The 2025 Rules contain specific breach-intimation requirements for Data Fiduciaries, including notification to the Data Protection Board and affected Data Principals in circumstances covered by the Rules.

The Developer shall notify StampMitra without undue delay where it becomes aware of:

• compromised API credentials;
• unauthorized access;
• unlawful API use;
• personal-data exposure;
• compromised webhook infrastructure;
• malicious activity affecting StampMitra;
• any event that may materially affect Developer Data processed by StampMitra.

The parties shall reasonably cooperate during material security incidents.

Cooperation may include:

• technical information;
• relevant logs;
• timestamps;
• request IDs;
• affected API Projects;
• affected data categories;
• containment measures;
• remediation steps.

Neither party is required to disclose information where doing so would:

• violate law;
• compromise security;
• expose another customer's confidential information;
• prejudice an investigation.

The Developer shall not conduct penetration testing or other intrusive security testing against StampMitra systems without prior written authorization.

43.1 Where required by applicable law, StampMitra may provide reasonable information demonstrating relevant security and processing controls.

43.2 Audits shall be conducted in a manner that:

• protects confidentiality;
• avoids disruption;
• does not expose other customer data;
• does not compromise security;
• does not require disclosure of trade secrets beyond what is reasonably necessary.

StampMitra may provide appropriate security or privacy information through:

• security questionnaires;
• documentation;
• compliance statements;
• summaries of controls;
• relevant certifications where available.

StampMitra is not required to disclose confidential security architecture or information that would materially increase security risk.

A Developer requesting an audit shall provide:

• reasonable notice;
• scope;
• purpose;
• relevant legal or contractual basis;
• requested timeframe.

StampMitra may satisfy an audit requirement through existing independent audit reports or equivalent documentation where legally and contractually sufficient.

StampMitra may use infrastructure located in India or other jurisdictions where legally permissible.

Specific data-location requirements may be agreed separately for enterprise arrangements.

StampMitra may disclose Developer Data where required by:

• court order;
• statutory authority;
• regulatory direction;
• lawful government request;
• law-enforcement process.

Where legally permitted, StampMitra may provide notice to the Developer.

StampMitra may preserve Developer Data where necessary to:

• comply with law;
• respond to legal proceedings;
• preserve evidence;
• investigate fraud;
• defend legal claims.

Where legally permissible, StampMitra may seek to limit disclosures to information reasonably necessary to satisfy the applicable request.

StampMitra shall not intentionally disclose Developer Data to unauthorized persons except as permitted by:

• the Developer's instructions;
• this DPA;
• applicable Services;
• applicable law;
• security requirements.

Where a competent authority lawfully requires information concerning processing, StampMitra may provide the relevant information.

StampMitra may notify the Developer where legally permitted and reasonably appropriate.

StampMitra may maintain internal documentation relating to:

• security controls;
• access controls;
• incident management;
• data flows;
• retention;
• vendor management;
• risk assessments.

Such documentation may be confidential.

Where required or appropriate, StampMitra may conduct privacy or data-protection impact assessments concerning relevant processing activities.

StampMitra may maintain internal records necessary to demonstrate:

• service operation;
• security;
• compliance;
• billing;
• auditability;
• contractual performance.

StampMitra may log:

• API requests;
• responses;
• authentication events;
• security events;
• error conditions;
• credential activity;
• administrative actions.

Logs shall be managed according to applicable security and retention requirements.

The Developer must not intentionally submit real personal data into Sandbox where the Sandbox is not intended for Production data.

StampMitra may restrict or delete such information where appropriate.

Developers should use:

• synthetic data;
• anonymized data;
• test identities;
• non-production records

for Sandbox testing wherever possible.

Documentation may specify:

• mandatory fields;
• prohibited fields;
• retention characteristics;
• security requirements;
• authentication requirements;
• data-processing limitations.

Developers must follow applicable Documentation.

Where an export function is available, Developers must protect exported data and ensure that it is not exposed publicly.

Where applicable and technically feasible, StampMitra may provide reasonable assistance in exporting Developer Data.

Technical limitations may apply to:

• third-party data;
• government records;
• external-source information;
• derived information;
• security logs;
• proprietary system metadata.

A Developer may request deletion of Developer Data subject to:

• applicable law;
• contractual obligations;
• legal retention;
• security requirements;
• transaction integrity.

Where the Developer controls the relevant personal-data relationship, the Developer shall ordinarily receive and process Data Principal deletion requests.

StampMitra shall provide reasonable assistance where required under this DPA.

The Developer is responsible for correcting information supplied by it where appropriate.

Where an external authoritative source is responsible for the information, StampMitra may be unable to directly modify the underlying record.

StampMitra does not guarantee that information obtained from an external source can be:

• corrected immediately;
• deleted immediately;
• modified by StampMitra;
• permanently changed;
• synchronized instantly.

The source's own legal and technical framework may govern such records.

Where an API supports a regulated or legally sensitive service, additional processing restrictions may apply.

Examples include:

• identity verification;
• e-Stamp;
• e-Sign;
• government-related workflows;
• regulated financial services.

For e-Stamp workflows, processing may include information required to:

• determine applicable transaction parameters;
• generate or process a request;
• communicate with authorized service infrastructure;
• produce transaction records;
• support auditability.

For e-Sign workflows, processing may include:

• signer identity;
• signing metadata;
• authentication information;
• transaction identifiers;
• signature records;
• document references.

Verification APIs may process information necessary to:

• submit a verification request;
• retrieve a verification result;
• match supplied information;
• return status;
• maintain transaction integrity.

StampMitra may determine dynamically which authorized external service or infrastructure should process a particular request.

Routing decisions may depend upon:

• API;
• jurisdiction;
• service availability;
• transaction type;
• capacity;
• technical requirements;
• commercial configuration;
• risk controls.

The Developer shall not receive direct credentials to confidential upstream systems merely because StampMitra uses those systems to provide a Service.

The Developer shall not attempt to bypass:

• API authentication;
• authorization;
• routing;
• rate limits;
• access controls;
• provider restrictions;
• security controls.

StampMitra may generate aggregated or anonymized information for:

• system performance;
• capacity planning;
• security;
• fraud prevention;
• service analytics.

Such information shall be handled in accordance with applicable law.

StampMitra may maintain backups, redundancy and recovery mechanisms to protect availability and integrity of Services.

Business-continuity copies may contain Developer Data.

StampMitra may maintain disaster-recovery systems designed to restore Services following:

• infrastructure failure;
• cyber incidents;
• natural disasters;
• service interruptions;
• other operational failures.

StampMitra may maintain procedures for:

• 1. detection;
• 2. triage;
• 3. containment;
• 4. eradication;
• 5. recovery;
• 6. notification;
• 7. post-incident review.

Personnel access to Developer Data shall be limited according to operational requirements and appropriate access controls.

Contractors with access to Developer Data shall be subject to appropriate contractual obligations where applicable.

StampMitra may conduct reasonable due diligence concerning relevant Subprocessors, including consideration of:

• security;
• confidentiality;
• technical capability;
• data-protection requirements;
• contractual controls.

StampMitra may add, replace or remove Subprocessors where necessary to operate or improve the Services.

Where legally or contractually required, appropriate notification mechanisms may be used.

Where a contractual arrangement provides an objection mechanism for Subprocessors, the Developer may exercise that mechanism according to the applicable procedure.

Any objection must identify a genuine privacy, security or legal concern and must not be used merely to obstruct ordinary service operations.

Where a legitimate objection is raised, StampMitra may:

• provide additional information;
• implement reasonable safeguards;
• replace the relevant provider where feasible;
• offer a commercially reasonable alternative where available.

StampMitra is not required to accept an objection that makes the Service technically or commercially impossible where no reasonable alternative exists.

StampMitra may provide privacy and security training to relevant personnel according to their roles.

Confidentiality obligations concerning Developer Data continue after termination for as long as required by:

• applicable law;
• contractual obligation;
• the confidential nature of the information.

Upon termination of the relevant Service, StampMitra shall cease active processing of Developer Data except where processing remains necessary for:

• legal compliance;
• security;
• dispute resolution;
• fraud prevention;
• backup recovery;
• other legally permitted purposes.

Subject to applicable law and technical feasibility, StampMitra may:

• return Developer Data;
• provide export functionality;
• delete active copies;
• allow backup expiration according to normal lifecycle.

The Developer represents that:

• 1. it has authority to provide Developer Data to StampMitra;
• 2. its instructions are lawful;
• 3. it has provided required notices;
• 4. required consent or authorization has been obtained;
• 5. its use of the Services does not knowingly violate applicable law;
• 6. it will not knowingly submit unlawfully obtained data.

StampMitra represents that, where it acts as a Data Processor under this DPA, it shall:

• process Developer Data within the agreed Service scope;
• maintain reasonable safeguards;
• maintain appropriate confidentiality;
• use authorized service providers;
• cooperate with applicable legal obligations.

The parties acknowledge that no technical environment can guarantee absolute protection against every conceivable cybersecurity threat.

The security obligations in this DPA therefore require reasonable and appropriate measures rather than an absolute guarantee of breach-free operation.

Any indemnification obligations relating to data protection shall be governed by the Developer Terms of Service and any specific commercial agreement.

Nothing in this DPA creates unlimited liability unless expressly agreed in writing.

The liability framework applicable to processing under this DPA shall be governed by the Developer Terms of Service and any applicable commercial agreement, subject to mandatory law.

No audit or security assessment shall require StampMitra to:

• disclose another customer's data;
• disclose secret credentials;
• expose critical security vulnerabilities;
• disclose confidential upstream provider agreements;
• compromise system security;
• provide proprietary source code unless legally required.

If StampMitra receives a legally binding request relating to Developer Data, StampMitra may:

• assess the legal validity;
• respond as legally required;
• notify the Developer where permitted;
• limit disclosure where legally possible.

Where this DPA conflicts with mandatory law, mandatory law shall prevail.

The parties shall interpret the remaining provisions to preserve their maximum lawful effect.

In relation specifically to personal-data processing under a Data Processor arrangement: this DPA shall prevail over the general Developer Terms to the extent of a direct conflict.

For all other matters, the Developer Terms remain applicable.

Where Service-Specific Terms contain additional data-processing requirements, those requirements shall apply to the relevant Service to the extent of the specific conflict.

A party's contractual designation as “Processor” or “Fiduciary” shall not override mandatory law where the actual processing circumstances legally determine a different role.

A Developer operating outside India shall ensure that its own collection and submission of personal data complies with laws applicable to it.

Additional contractual arrangements may be required for international deployments.

StampMitra may maintain records necessary to demonstrate:

• API transactions;
• processing instructions;
• security events;
• deletion events;
• access;
• incidents;
• contractual compliance.

The parties shall reasonably cooperate with lawful regulatory or governmental investigations concerning the processing covered by this DPA.

StampMitra may update this DPA where reasonably required due to:

• changes in law;
• regulatory requirements;
• security developments;
• changes in Services;
• changes in infrastructure;
• changes in processing practices.

Material contractual changes shall be communicated through an appropriate mechanism where required.

The following provisions survive termination:

• confidentiality;
• security;
• data retention;
• deletion;
• legal compliance;
• audit records;
• indemnification;
• liability;
• dispute resolution;
• provisions that by their nature should survive.

If any provision becomes invalid or unenforceable, the remaining provisions shall continue to the maximum extent permitted by law.

Except where required by applicable law, this DPA does not create contractual rights for third parties.

This DPA shall be governed by the laws of India, subject to mandatory applicable law.

Disputes relating to this DPA shall be handled under the dispute-resolution mechanism contained in the StampMitra Developer Terms of Service or the applicable commercial agreement.

The Developer may accept this DPA electronically through:

• checkbox acceptance;
• account acceptance;
• API activation;
• Production approval;
• electronic signature;
• other legally recognized electronic mechanisms.

Electronic records may be retained as evidence of acceptance.

This DPA becomes effective for the relevant Developer on the earliest of:

• 1. electronic acceptance;
• 2. execution of a written agreement incorporating this DPA;
• 3. activation of a Service expressly subject to this DPA; or
• 4. another effective date stated in the applicable commercial agreement.

Schedule A — Processing Details

Subject Matter

Processing of personal data required to provide StampMitra APIs and related Services.

Duration

The duration of the applicable Developer relationship, subject to post-termination retention permitted or required by law.

Nature of Processing

Processing may include:

• collection;
• transmission;
• validation;
• verification;
• retrieval;
• matching;
• storage;
• document processing;
• transaction processing;
• response generation;
• logging;
• security monitoring;
• deletion.

Purpose

To provide the Services requested by the Developer and perform related security, compliance and operational functions.

Depending upon the Service:

• Developer End Users;
• applicants;
• customers;
• business owners;
• authorized representatives;
• signatories;
• document parties;
• employees;
• other persons whose information is lawfully submitted.

Depending upon the Service:

• identity information;
• contact information;
• address;
• business information;
• document information;
• verification information;
• transaction information;
• signing information;
• application information;
• technical metadata.

Sensitive information shall not be processed unless:

• necessary for the relevant Service;
• permitted by applicable law;
• appropriately authorized;
• subject to applicable safeguards.

Processing may occur:

• on demand;
• synchronously;
• asynchronously;
• periodically;
• through webhooks;
• through status checks;
• through automated system operations.

Processing may occur within StampMitra infrastructure and through authorized service providers in jurisdictions permitted by applicable law.

StampMitra may maintain controls including:

Administrative

• access governance;
• security policies;
• confidentiality obligations;
• incident-response procedures;
• vendor management.

Technical

• encryption;
• authentication;
• authorization;
• API security;
• logging;
• monitoring;
• vulnerability management;
• backups.

Organizational

• least-privilege access;
• role separation;
• security awareness;
• controlled deployment;
• incident escalation.

Where a request concerns Developer Data:

• 1. the request may be received by StampMitra or the Developer;
• 2. the receiving party shall determine the applicable legal role;
• 3. where the Developer is responsible, StampMitra may assist;
• 4. identity/authority may be verified;
• 5. the request shall be processed according to applicable law;
• 6. action may be recorded for audit purposes.

Following a material incident, StampMitra may:

• 1. detect;
• 2. classify;
• 3. contain;
• 4. investigate;
• 5. preserve evidence;
• 6. remediate;
• 7. restore;
• 8. notify relevant parties where required;
• 9. conduct post-incident review.

StampMitra may use Subprocessors for:

• cloud infrastructure;
• storage;
• databases;
• security;
• communications;
• monitoring;
• document processing;
• other necessary operations.

The specific provider list may be maintained separately where commercially and technically appropriate.

Information concerning:

• provider architecture;
• commercial terms;
• credentials;
• internal routing;
• proprietary configurations

may be confidential.

Nothing in this DPA requires disclosure of confidential information beyond what applicable law or a specific contractual commitment requires.

Upon termination or expiry:

• active processing shall cease where appropriate;
• active data may be deleted or returned;
• legal records may be retained;
• security records may be retained;
• backups may expire according to their lifecycle.

This matrix is illustrative and does not override the legal characterization required by applicable law.

The Developer authorizes StampMitra to:

• receive Developer Data;
• transmit Developer Data;
• process Developer Data;
• validate Developer Data;
• use Developer Data to provide requested Services;
• communicate Developer Data to authorized service providers where necessary;
• generate API responses;
• maintain transaction records;
• maintain security records;
• retain information where legally required;
• delete information according to applicable retention requirements.

The Developer warrants that:

• it has authority to submit the data;
• the processing purpose is lawful;
• required notices have been provided;
• required consent has been obtained where applicable;
• data has not knowingly been unlawfully obtained;
• the Developer will comply with applicable law.

Where acting as a Data Processor, StampMitra shall:

• follow lawful processing instructions;
• maintain reasonable safeguards;
• maintain confidentiality;
• use authorized Subprocessors;
• provide reasonable assistance;
• maintain appropriate processing records;
• support applicable incident-response obligations.

This DPA constitutes the FINAL Data Processing Addendum for the StampMitra Developer Platform, Version 1.0, effective 05 October 2026, subject to applicable law and any specific written commercial agreement executed between StampMitra and a Developer.

Nothing in this DPA:

• requires unlawful processing;
• overrides mandatory statutory requirements;
• requires disclosure of confidential upstream providers;
• transfers ownership of personal data;
• makes StampMitra a Data Processor for processing it independently determines;
• makes a Developer a Data Fiduciary for processing that Developer does not control.

• BANI GLOBAL INDUSTRIES LLP
• LLPIN: ACI6373
• Registered Office: 2-A/3, Kundan Mansion, Asaf Ali Road, Turkman Gate, Central Delhi, NCT of Delhi, India – 110002
• Developer Platform: developer.stampmitra.in
• Legal Contact: [email protected]
• Prepared by: Legal Team, BANI GLOBAL INDUSTRIES LLP ([email protected])
• Document: StampMitra Data Processing Addendum
• Version: 1.0
• Status: FINAL — PUBLISHED CONTRACTUAL POLICY
• Effective Date: 05 October 2026
• Last Updated: 05 October 2026

© 2026 BANI GLOBAL INDUSTRIES LLP. All rights reserved.