Version 12 October 2026 · NexReach AI

Data Processing Agreement — Draft

NexReach is a product of TwinStance Solutions LLP.

Draft for business-customer review — not executed merely by publication. No customer DPA or transfer agreement has yet been confirmed. Contact the Grievance Officer to agree the parties, authorised instructions and any required country-specific safeguards before relying on this draft.

Roles, instructions and scope

The customer controls the purposes and permissions for its CRM contact information and communications. TwinStance acts as processor for the instructed service, and separately as controller for its own account, payment, support and security administration. An executed agreement should identify the customer and service duration; processing operations; contact/lead, message, campaign, voice/AI and account data involved; data-subject categories; and any prohibited/sensitive data. Use only documented lawful instructions, including for international transfers, and raise an instruction believed to infringe applicable law.

Confidentiality and security

An executed agreement should require authorised personnel confidentiality, role-based/workspace access, secure credentials and transport, appropriate backup and incident controls, and processing limited to the agreed service. The public security summary is factual, not a certification or a substitute for agreed technical measures.

Providers, assistance and incidents

List the actual providers using the disclosure; agree authorisation/change notice, relevant data categories and equivalent processor obligations. Some providers have independent-controller roles. Agree assistance with rights requests, security incidents, risk assessments and regulator/customer information. Where GDPR applies, processor breach notice must be without undue delay; the controller assesses its own regulator/individual notification duties. Applicable Indian deadlines are separate.

Return, deletion and audit cooperation

Agree secure export/return, deletion instructions, applicable legally required or suppression retention, processor follow-up, backup handling and confirmation. Current account deletion is not proof of downstream deletion. Do not invent a backup expiration or deletion SLA. Agree proportionate evidence/audit cooperation without exposing another tenant’s data, system secrets or credentials.

Transfers and execution

Country-specific processing locations, vendor contracts and transfer safeguards require account-level verification. This draft does not incorporate signed SCCs, an adequacy decision, a representative appointment or an Indian/EU residency guarantee. Those must be documented when required. An Indian lawyer should review and approve the final agreement, liability and governing-law provisions before execution.

Operator: TwinStance Solutions LLP. Principal address supplied by the operator: Tulasipur, Cuttack, Odisha, India. Grievance Officer: Sk Siraz, Director & Grievance Officer; [email protected]; +91 7008712605. Support: [email protected]; security/privacy reports: [email protected]. Do not include passwords, payment-card details or unnecessary sensitive data.