Data Processing Agreement
DPA
This is ikan Talent Mobility Pvt. Ltd.’s standard Data Processing Agreement form. It becomes binding when incorporated into an executed Master Services Agreement or otherwise signed by ikan and the corporate Client.
Last updated: 22 July 2026
1. Definitions
Terms used in this DPA have the meanings given to them under the EU General Data Protection Regulation (GDPR) and the Indian Digital Personal Data Protection Act, 2023 (DPDP Act), as applicable. ‘Personal data’, ‘processing’, ‘controller’, and ‘processor’ are interpreted accordingly.
2. Subject matter and duration
ikan acts as Processor and processes personal data on behalf of the Client (Controller) solely to deliver the corporate-housing services described in the underlying agreement. Processing continues for the term of the agreement and the legally required retention period thereafter.
3. Categories of data subjects and personal data
- Data subjects: the Client’s relocating employees, accompanying family members, and procurement contacts.
- Personal data: name, email, phone, employer, assignment city, check-in/out dates, government ID where required for hotel registration, dietary or accessibility requests where given voluntarily.
4. Controller obligations
The Client warrants it has a lawful basis to share personal data with ikan and that it has provided the data subjects with all required notices.
5. Processor obligations
- Process personal data only on documented instructions from the Controller.
- Ensure all personnel authorized to process the data are bound by written confidentiality.
- Implement appropriate technical and organisational security measures, including HTTPS in transit, provider-managed encryption at rest, role-based access, private sensitive-file storage, and audit logs for consequential actions.
- Assist the Controller, taking into account the nature of processing, with data-subject rights requests, breach notifications, and DPIAs.
- Make available all information necessary to demonstrate compliance and submit to audits as required.
6. Sub-processors
The current, more complete vendor inventory is maintained on the security page, including core and feature-dependent services. For customers whose executed DPA includes advance notice and objection rights, those negotiated terms control.
- Vercel Inc. — application hosting (US/EU).
- Supabase Inc. — managed Postgres database (AP-South, Mumbai).
- Resend — transactional email delivery.
- Sentry — optional error monitoring with application-level data scrubbing.
- LiveKit — real-time voice transport over a global edge network when Aira voice is enabled.
- Render — Aira voice-worker compute in Singapore when Aira voice is enabled.
- Groq — speech-to-text, language-model, vision, and fallback text-to-speech inference when configured.
- Other configured providers — the security-page inventory covers optional AI, geocoding, communications, payments, analytics, and operations-alert providers used for the customer’s enabled features.
- Property suppliers — only the data needed to confirm a single booking (name, dates, ID for hotel registration).
7. International transfers
Primary structured booking data is stored in the configured Mumbai database project. Enabled feature providers may process data in other jurisdictions under their contracted service terms. Where required, the parties execute the applicable Standard Contractual Clauses and supplementary measures. Transfers of DPDP-regulated personal data remain subject to the DPDP Act, customer instructions, and notified government restrictions.
8. Breach notification
ikan will notify the Controller without undue delay (and in any case within 48 hours) after becoming aware of a personal-data breach affecting Controller data, including the nature of the breach, likely consequences, and remediation steps taken.
9. Return or deletion
On termination, ikan returns or securely deletes all personal data within 90 days, except where retention is required by law (e.g. GST records, hotel registers).
10. Liability and governing law
Liability for breaches of this DPA is governed by the limitation of liability clause in the underlying Master Services Agreement. Disputes are subject to Indian law and the exclusive jurisdiction of the courts of Mumbai.
11. Contact
Privacy and grievance contact — privacy@ikan-residences.com.
Formal notices may also be sent to the registered address stated in the applicable services agreement or invoice.