Data Processing Addendum 

1. Purpose of this DPA

The purpose of this DPA is to define the data protection responsibilities of Treewalker Digital Private Limited and the Customer when Personal Data is processed through Galla.app. 

This DPA covers: 

1. Roles and responsibilities of the parties. 
2. Customer instructions. 
3. Categories of Personal Data processed. 
4. Categories of individuals whose data may be processed. 
5. Product-specific processing for Retail, POS Billing, Warehouse Management, WhatsApp Marketing, Ecommerce Development, and Integrations. 
6. Security measures. 
7. Subprocessors. 
8. Third-party platforms and integrations. 
9. Data principal or data subject requests. 
10. Data breach and security incident handling. 
11. Data retention, export, return, and deletion. 
12. International data transfers. 
13. Audit and compliance support. 
14. Customer obligations for lawful data collection, consent, and marketing communication. 

2. Scope of this DPA

This DPA applies when Treewalker Digital Private Limited processes Personal Data on behalf of the Customer through any of the following: 

1. Galla.app SaaS platform. 
2. Retail Management module. 
3. POS Billing module. 
4. Warehouse Management System module. 
5. Inventory Management module. 
6. WhatsApp Marketing and Customer Communication module. 
7. Ecommerce Development and Managed Ecommerce Services. 
8. Third-Party Integrations. 
9. APIs, webhooks, dashboards, reports, and automations. 
10. Implementation, onboarding, configuration, migration, customisation, training, and support services. 
11. Remote support, troubleshooting, monitoring, maintenance, and issue resolution. 
12. Any other product, feature, service, or module offered by Galla.app where Customer Personal Data is processed. 

This DPA does not apply where Treewalker Digital Private Limited processes Personal Data for its own independent business purposes, such as sales, marketing, billing, vendor management, recruitment, website analytics, legal compliance, corporate administration, or business development. Such processing is covered by the Galla.app Privacy Policy. 

3. Definitions 

For the purpose of this DPA: 

“Agreement” means the Terms of Service, SaaS Agreement, Order Form, Proposal, Quotation, Statement of Work, Subscription Agreement, Master Services Agreement, Invoice, or any other written or electronic agreement between the Customer and Treewalker Digital Private Limited. 

“Applicable Data Protection Laws” means all privacy, data protection, cybersecurity, electronic communication, and data processing laws applicable to the processing of Personal Data under this DPA, including where applicable the Digital Personal Data Protection Act, 2023 of India, rules issued under it, Information Technology Act, 2000 and related rules, GDPR, UK GDPR, and other applicable laws. 

“Customer Data” means all data, records, files, content, product data, inventory data, billing data, customer data, vendor data, employee data, warehouse data, order data, ecommerce data, communication data, reports, attachments, logs, and other materials submitted, uploaded, imported, transmitted, generated, stored, or processed by or on behalf of the Customer through Galla.app. 

“Personal Data” means any information relating to an identified or identifiable individual, including any data that is treated as personal data, personal information, personally identifiable information, or similar under Applicable Data Protection Laws. 

“Processing” means any operation performed on Personal Data, including collection, recording, storage, hosting, organisation, structuring, retrieval, access, use, transmission, disclosure, synchronisation, reporting, restriction, deletion, or destruction. 

“Data Fiduciary” means the person or entity that determines the purpose and means of processing Personal Data under applicable Indian data protection law. 

“Data Processor” means the person or entity that processes Personal Data on behalf of a Data Fiduciary. 

“Controller” means the entity that determines the purposes and means of processing Personal Data under GDPR-style laws. 

“Processor” means the entity that processes Personal Data on behalf of the Controller. 

“Data Principal” or “Data Subject” means the individual to whom Personal Data relates. 

“Subprocessor” means any third party engaged by Treewalker Digital Private Limited to process Personal Data on behalf of the Customer for the purpose of providing Galla.app. 

“Third-Party Services” means services, applications, APIs, platforms, tools, providers, or systems not owned or controlled by Treewalker Digital Private Limited, including WhatsApp/Meta, payment gateways, ecommerce platforms, marketplaces, ERP systems, accounting tools, logistics providers, cloud providers, SMS/email providers, analytics tools, customer support tools, and other integrations. 

“Security Incident” means a confirmed breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data processed by Treewalker Digital Private Limited. 

4. Role of the Parties

For Customer Personal Data processed through Galla.app: 

1. The Customer is the Data Fiduciary, Controller, business owner, or equivalent responsible party. 
2. Treewalker Digital Private Limited is the Data Processor, Processor, Service Provider, or equivalent processing party. 
3. The Customer determines why Personal Data is collected and how it is used. 
4. Treewalker Digital Private Limited processes Personal Data only on behalf of the Customer and in accordance with the Agreement, this DPA, product configuration, support requests, customer instructions, and applicable law. 
5. The Customer remains responsible for the legality, accuracy, consent, notices, and business use of Personal Data submitted to Galla.app. 

Where Treewalker Digital Private Limited processes Personal Data for its own independent purposes, it will act as an independent Data Fiduciary or Controller for that specific processing. 

5. Customer Instructions 

Treewalker Digital Private Limited will process Customer Personal Data only on documented instructions from the Customer. 

Documented instructions include: 

1. The Agreement. 
2. This DPA. 
3. Galla.app Terms of Service. 
4. Product settings configured by the Customer. 
5. User actions inside Galla.app. 
6. API or integration instructions. 
7. WhatsApp campaign configuration. 
8. Ecommerce workflow configuration. 
9. Warehouse and POS workflow configuration. 
10. Support tickets and written support requests. 
11. Email instructions from authorised Customer representatives. 
12. Written statements of work or implementation documents. 

Treewalker Digital Private Limited may process Customer Personal Data for the following purposes: 

1. Providing Galla.app SaaS services. 
2. Operating Retail Management, POS Billing, Warehouse Management, Inventory, WhatsApp Marketing, Ecommerce, and Integration modules. 
3. Creating and managing Customer accounts. 
4. Hosting, storing, securing, backing up, and transmitting Customer Data. 
5. Providing dashboards, reports, alerts, analytics, and workflow automation. 
6. Enabling customer-authorised third-party integrations. 
7. Providing implementation, configuration, migration, onboarding, training, support, and troubleshooting. 
8. Maintaining service reliability, performance, and security. 
9. Detecting and preventing fraud, abuse, spam, unauthorised access, or security threats. 
10. Complying with applicable legal, regulatory, tax, audit, or government requirements. 
11. Performing any other processing specifically instructed by the Customer. 

If Treewalker Digital Private Limited believes that a Customer instruction violates applicable law, creates security risk, or may cause unlawful processing, it may notify the Customer and may suspend, reject, or delay the instruction until the issue is resolved. 

6. Customer Responsibilities

The Customer is responsible for all Personal Data it submits, uploads, imports, syncs, configures, or processes through Galla.app. 

The Customer must: 

1. Collect Personal Data lawfully. 
2. Provide required privacy notices to its customers, employees, vendors, suppliers, delivery recipients, ecommerce buyers, WhatsApp recipients, and other individuals. 
3. Obtain consent where required. 
4. Maintain a lawful basis for processing Personal Data. 
5. Ensure that Personal Data is accurate, complete, relevant, updated, and not excessive. 
6. Ensure that Personal Data uploaded to Galla.app is required for lawful business purposes. 
7. Ensure that WhatsApp, SMS, email, or other marketing communication is consent-based and legally permitted. 
8. Maintain opt-out, unsubscribe, withdrawal of consent, correction, deletion, and grievance workflows. 
9. Use Galla.app only for lawful business activities. 
10. Configure access roles, user permissions, admin privileges, branches, warehouses, integrations, APIs, and communication workflows responsibly. 
11. Protect login credentials, API keys, access tokens, devices, scanners, printers, browsers, networks, and local infrastructure. 
12. Remove access for employees, contractors, consultants, or users who leave the organisation or no longer require access. 
13. Review reports, invoices, tax data, warehouse data, billing data, integration data, and campaign data before legal, tax, financial, statutory, or operational reliance. 
14. Maintain its own records required for tax, accounting, audit, statutory, business, and compliance purposes. 
15. Ensure compliance with third-party platform terms, including WhatsApp, payment gateway, ecommerce platform, ERP, marketplace, logistics, SMS, email, and cloud provider terms. 
16. Avoid uploading prohibited, unlawful, sensitive, unnecessary, or excessive Personal Data. 

Treewalker Digital Private Limited is not responsible for the Customer’s unlawful collection, use, upload, disclosure, marketing, transfer, or processing of Personal Data.

9. Sensitive Personal Data and Prohibited Data

Unless expressly agreed in writing, the Customer must not upload or process the following through Galla.app: 

1. Health records. 
2. Biometric data. 
3. Full card numbers or sensitive payment authentication data. 
4. Bank passwords or financial account passwords. 
5. Government identity documents not required for the service. 
6. Criminal record data. 
7. Children’s data without lawful basis and required consent. 
8. Data revealing race, religion, caste, political opinion, trade union membership, sexual orientation, or similar sensitive characteristics unless strictly required and lawful. 
9. Unlawfully collected data. 
10. Purchased, scraped, or unauthorised marketing lists. 
11. Malware, harmful code, illegal content, or prohibited content. 
12. Personal Data not necessary for use of Galla.app. 

If such data is uploaded, the Customer is fully responsible for lawful processing, consent, security, and compliance. 

Treewalker Digital Private Limited may restrict, suspend, delete, or refuse processing of prohibited data if it creates legal, security, operational, or compliance risk.

10. Security Measures

Treewalker Digital Private Limited will implement reasonable technical and organisational measures designed to protect Customer Personal Data from unauthorised access, accidental loss, misuse, alteration, disclosure, or destruction. 

Security measures may include, as applicable: 

1. Encryption in transit. 
2. Role-based access controls. 
3. User authentication. 
4. Admin access restriction. 
5. Least-privilege access. 
6. Access logging. 
7. Activity logging. 
8. Application monitoring. 
9. Error monitoring. 
10. Backup processes. 
11. Secure development practices. 
12. Vulnerability management. 
13. Security testing. 
14. Change management. 
15. Secure API handling. 
16. Logical separation of customer accounts. 
17. Subprocessor due diligence. 
18. Internal confidentiality obligations. 
19. Incident response procedures. 
20. Employee security awareness. 
21. Infrastructure security controls. 
22. Data retention and deletion procedures. 

No SaaS platform, cloud system, or internet-based service can be guaranteed to be completely secure. 

The Customer remains responsible for securing its own: 

1. Users. 
2. Passwords. 
3. Devices. 
4. Browsers. 
5. POS hardware. 
6. Printers. 
7. Barcode scanners. 
8. RFID devices. 
9. Warehouse handheld devices. 
10. Local networks. 
11. API keys. 
12. Integration credentials. 
13. Third-party accounts. 

11. Access Control and User Management

The Customer controls user access within its Galla.app account. 

The Customer is responsible for: 

1. Creating authorised users. 
2. Assigning correct roles. 
3. Restricting admin permissions. 
4. Reviewing active users. 
5. Removing inactive users. 
6. Removing employees who have left. 
7. Preventing credential sharing. 
8. Enabling multi-factor authentication where available. 
9. Protecting passwords. 
10. Monitoring suspicious activity. 
11. Controlling store, warehouse, branch, company, and module-level access. 

Treewalker Digital Private Limited is not responsible for unauthorised access caused by Customer-side weak passwords, credential sharing, compromised devices, inactive users, exposed API keys, or internal misuse. 

12. Confidentiality

Treewalker Digital Private Limited will ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations. 

Customer Personal Data will be accessed only by personnel who require access for legitimate business purposes, such as: 

1. Service delivery. 
2. Support. 
3. Troubleshooting. 
4. Implementation. 
5. Migration. 
6. Training. 
7. Security. 
8. Billing. 
9. Compliance. 
10. Maintenance. 

Treewalker Digital Private Limited will take reasonable steps to ensure that authorised personnel understand confidentiality and data protection responsibilities. 

13. Subprocessors

The Customer authorises Treewalker Digital Private Limited to engage Subprocessors to provide Galla.app and related services. 

Subprocessors may be used for: 

1. Cloud hosting. 
2. Data storage. 
3. Backup. 
4. Security monitoring. 
5. Error monitoring. 
6. Email delivery. 
7. SMS delivery. 
8. WhatsApp Business messaging. 
9. Payment processing. 
10. Customer support. 
11. Analytics. 
12. Logging. 
13. Infrastructure management. 
14. Implementation support. 
15. Development support. 
16. Professional services. 
17. Other operational services required to provide Galla.app. 

Treewalker Digital Private Limited will take reasonable steps to ensure that Subprocessors are subject to contractual obligations designed to protect Personal Data. 

Treewalker Digital Private Limited remains responsible for Subprocessors’ processing of Customer Personal Data to the extent required by applicable law and the Agreement. 

14. Subprocessor List and Change Notice 

Treewalker Digital Private Limited may maintain a Subprocessor List on its website or make it available upon request. 

The Subprocessor List may include: 

1. Subprocessor name. 
2. Service category. 
3. Purpose of processing. 
4. Type of data processed. 
5. Location or region, where available. 
6. Privacy or security policy link, where available. 

Treewalker Digital Private Limited may update the Subprocessor List from time to time. 

If the Customer has a reasonable privacy or security objection to a new Subprocessor, the Customer may notify Treewalker Digital Private Limited in writing within [Insert Number] days of receiving notice or publication of the updated Subprocessor List. 

The parties will work in good faith to resolve the objection. If the objection cannot be reasonably resolved, the Customer may stop using the affected feature or terminate the affected portion of the service as per the Agreement. 

15. Data Principal / Data Subject Requests

The Customer is responsible for responding to requests from Data Principals or Data Subjects whose Personal Data is processed through the Customer’s Galla.app account. 

Such requests may include: 

1. Access. 
2. Correction. 
3. Update. 
4. Deletion. 
5. Withdrawal of consent. 
6. Grievance. 
7. Nomination, where applicable. 
8. Portability, where applicable. 
9. Restriction, where applicable. 
10. Objection, where applicable. 
11. Any other right under Applicable Data Protection Laws. 

Treewalker Digital Private Limited will provide reasonable assistance to the Customer, where technically feasible and commercially reasonable, to help the Customer respond to such requests. 

If Treewalker Digital Private Limited directly receives a request relating to Customer-controlled Personal Data, it may: 

1. Redirect the requester to the Customer. 
2. Notify the Customer. 
3. Decline to act unless instructed by the Customer. 
4. Act only where required by applicable law. 

The Customer remains responsible for final response to the Data Principal or Data Subject. 

16. Security Incident and Breach Notification

If Treewalker Digital Private Limited becomes aware of a confirmed Security Incident affecting Customer Personal Data, it will take reasonable steps to: 

1. Investigate the incident. 
2. Contain and mitigate the incident. 
3. Assess the nature and scope of affected data. 
4. Notify the Customer without undue delay, subject to verification, security, law enforcement, and legal restrictions. 
5. Provide available information reasonably required by the Customer to meet its legal obligations. 
6. Take reasonable remediation steps. 

The notification may include, where available: 

1. Nature of the incident. 
2. Categories of Personal Data affected. 
3. Approximate number of affected records or users, if known. 
4. Likely consequences, if known. 
5. Measures taken or proposed to address the incident. 
6. Recommended steps for the Customer. 
7. Contact point for follow-up. 

The Customer is responsible for notifying Data Principals, customers, employees, vendors, regulators, or authorities where the Customer is legally required to do so. 

Treewalker Digital Private Limited’s notification or response to a Security Incident will not be treated as an admission of fault or liability. 

17. Customer Security Obligations

The Customer must maintain reasonable security controls for its own environment. 

The Customer should: 

1. Use strong passwords. 
2. Enable multi-factor authentication where available. 
3. Conduct periodic user access reviews. 
4. Remove inactive or former users. 
5. Secure computers, tablets, mobile devices, POS systems, scanners, printers, and warehouse devices. 
6. Keep browsers, operating systems, and local systems updated. 
7. Protect local networks and Wi-Fi. 
8. Restrict admin access. 
9. Protect API keys and integration credentials. 
10. Train staff on secure usage. 
11. Prevent unauthorised exports. 
12. Monitor suspicious activity. 
13. Maintain internal approval workflows. 
14. Avoid sharing credentials over email, chat, or WhatsApp. 
15. Maintain local backups or exports where required for business continuity. 

Treewalker Digital Private Limited is not liable for incidents caused by Customer-side security failures. 

18. Data Retention

Treewalker Digital Private Limited will retain Customer Personal Data for as long as necessary to provide Galla.app and related services, unless a longer period is required or permitted by law, contract, tax, accounting, audit, security, backup, dispute resolution, or legitimate business needs. 

Retention periods may depend on: 

1. Active subscription status. 
2. Agreement terms. 
3. Product module used. 
4. Customer configuration. 
5. Legal requirements. 
6. Tax and accounting requirements. 
7. Backup cycles. 
8. Support and troubleshooting requirements. 
9. Security monitoring requirements. 
10. Pending disputes or claims. 
11. Customer deletion requests. 

The Customer is responsible for exporting and retaining records required for its business, tax, accounting, legal, audit, or statutory purposes. 

19. Data Export, Return, and Deletion

Upon termination, expiry, cancellation, closure, or non-renewal of the Customer account, Treewalker Digital Private Limited will handle Customer Personal Data as per the Agreement, this DPA, and the Data Retention and Deletion Policy. 

Subject to applicable law and technical feasibility, Treewalker Digital Private Limited may: 

1. Allow the Customer to export Customer Data for a limited period. 
2. Provide data export tools where supported by the plan or module. 
3. Delete Customer Personal Data after the applicable retention period. 
4. Retain limited records required for legal, tax, audit, billing, security, fraud prevention, or dispute purposes. 
5. Retain backup copies until overwritten or deleted under backup cycles. 
6. Provide deletion confirmation where commercially and technically feasible. 

Treewalker Digital Private Limited is not responsible for loss of Customer Data where the Customer fails to export data before the available export or retention period ends. 

20. Backup Data

Backup copies may contain Customer Personal Data. 

Backup data may be retained for limited periods depending on system architecture and backup cycles. 

Backups are generally maintained for service continuity, disaster recovery, security, and restoration purposes. 

Customer Personal Data in backups may not be immediately deleted from every backup copy after account deletion but will be deleted or overwritten according to backup schedules, unless retention is required by law, dispute, audit, or security needs. 

21. International Data Transfers

Customer Personal Data may be processed, hosted, stored, accessed, or transferred in India or other countries depending on: 

1. Cloud provider location. 
2. Infrastructure configuration. 
3. Subprocessor location. 
4. Third-party integration location. 
5. Support location. 
6. WhatsApp/Meta processing. 
7. Payment gateway processing. 
8. Ecommerce platform processing. 
9. Customer-selected services. 

Where international transfers occur, Treewalker Digital Private Limited will use reasonable safeguards required by Applicable Data Protection Laws, which may include: 

1. Contractual protections. 
2. Data processing agreements. 
3. Subprocessor due diligence. 
4. Security controls. 
5. Customer instructions. 
6. Standard contractual clauses, where applicable. 
7. Transfer impact assessments, where required. 
8. Other lawful transfer mechanisms permitted by applicable law. 

The Customer is responsible for ensuring that its own use of Galla.app complies with data transfer restrictions applicable to the Customer and its Data Principals or Data Subjects. 

22. GDPR and International Customer Terms

Where GDPR, UK GDPR, or similar international data protection laws apply: 

1. The Customer acts as Controller. 
2. Treewalker Digital Private Limited acts as Processor. 
3. Treewalker Digital Private Limited will process Personal Data only on documented instructions from the Customer. 
4. Treewalker Digital Private Limited will ensure confidentiality of authorised personnel. 
5. Treewalker Digital Private Limited will implement appropriate technical and organisational measures. 
6. Treewalker Digital Private Limited will assist the Customer with Data Subject requests where technically feasible. 
7. Treewalker Digital Private Limited will assist with security incident obligations where required. 
8. Treewalker Digital Private Limited will impose appropriate obligations on Subprocessors. 
9. Treewalker Digital Private Limited will delete or return Personal Data at the end of services, subject to legal and technical limitations. 
10. Treewalker Digital Private Limited will make available relevant information necessary to demonstrate compliance, subject to confidentiality, security, and commercial limitations. 

If required for a specific international customer, the parties may execute additional standard contractual clauses, UK addendum, or country-specific data transfer documents. 

23. Audit and Compliance Support 

Upon reasonable written request, Treewalker Digital Private Limited may provide information to help the Customer assess compliance with this DPA. 

This may include, if available: 

1. Security overview. 
2. Privacy overview. 
3. Subprocessor List. 
4. Data retention summary. 
5. Security policy summary. 
6. VAPT summary or certificate. 
7. ISO/SOC reports or certifications, if available. 
8. Standard security questionnaire responses. 
9. Technical and organisational measures summary. 
10. Relevant compliance documentation. 

Any audit or review must: 

1. Be limited to the Customer’s use of Galla.app. 
2. Be subject to confidentiality obligations. 
3. Not compromise security of Galla.app or other customers. 
4. Not require access to source code, infrastructure secrets, internal systems, unrelated customer data, or commercially sensitive information. 
5. Be conducted no more than once per year unless required by law or after a confirmed material breach. 
6. Be scheduled with reasonable advance notice. 
7. Be conducted during normal business hours. 
8. Not unreasonably disrupt Treewalker Digital Private Limited’s operations. 

Treewalker Digital Private Limited may charge reasonable fees for extensive audits, custom questionnaires, onsite audits, third-party assessment support, or special compliance documentation unless otherwise agreed in writing. 

24. Privacy by Design and Default 

Treewalker Digital Private Limited will use reasonable efforts to design and operate Galla.app with privacy and security considerations, including: 

1. Role-based access. 
2. Admin controls. 
3. User permission settings. 
4. Activity logs. 
5. Data export options. 
6. Data deletion workflows. 
7. Secure integrations. 
8. API controls. 
9. Support access controls. 
10. Security monitoring. 
11. Data minimisation options where feasible. 
12. Product documentation. 

The Customer remains responsible for configuring Galla.app in a privacy-compliant manner.

25. Aggregated and Anonymised Data 

Treewalker Digital Private Limited may create and use aggregated, anonymised, or de-identified data that does not identify the Customer, Data Principals, Data Subjects, or individual users. 

Such data may be used for: 

1. Product improvement. 
2. Security improvement. 
3. Usage analytics. 
4. Performance benchmarking. 
5. Feature development. 
6. Market insights. 
7. Internal reporting. 
8. Reliability improvements. 

Treewalker Digital Private Limited will not intentionally use anonymised or aggregated data to re-identify individuals. 

26. AI, Automation, Reports, and Analytics

Galla.app may include automation, analytics, dashboards, alerts, recommendations, reports, or AI-enabled features. 

Where such features process Customer Personal Data: 

1. Processing will be for service delivery, support, automation, analytics, reporting, or product improvement. 
2. The Customer remains responsible for deciding whether and how to rely on automated outputs. 
3. Business-critical, legal, tax, financial, warehouse, inventory, billing, and compliance outputs should be independently verified by the Customer. 
4. Treewalker Digital Private Limited will not use Customer Personal Data to train public AI models unless expressly agreed in writing. 
5. Any third-party AI tool used as a Subprocessor should be disclosed in the Subprocessor List where applicable.

27. Government, Court, and Legal Requests

If Treewalker Digital Private Limited receives a lawful request for Customer Personal Data from a government, court, regulator, law enforcement agency, or other authority, it may disclose Personal Data where legally required. 

Where legally permitted, Treewalker Digital Private Limited may notify the Customer before disclosure. 

Treewalker Digital Private Limited may decline, challenge, narrow, or delay requests where legally permissible and commercially reasonable. 

28. Data Accuracy

The Customer is responsible for ensuring that Personal Data submitted to Galla.app is accurate, updated, complete, and lawful. 

Treewalker Digital Private Limited is not responsible for errors in reports, invoices, tax records, warehouse records, inventory records, WhatsApp campaigns, order records, ecommerce data, or integrations caused by inaccurate, incomplete, duplicate, outdated, or unlawful Customer Data. 

29. Payment Data 

Payments may be processed through third-party payment gateways, banks, UPI providers, or financial service providers. 

Treewalker Digital Private Limited may process billing information, invoice records, payment status, transaction reference numbers, GST details, and commercial records. 

Treewalker Digital Private Limited does not intentionally store full card numbers or sensitive payment authentication data unless specifically required, lawfully permitted, and contractually agreed. 

Payment providers process payment information under their own terms, privacy policies, and security standards. 

30. Data Location

Customer Personal Data may be stored in cloud infrastructure located in India or other regions depending on hosting configuration, infrastructure setup, customer agreement, cloud provider, integration provider, and service architecture. 

Enterprise customers with specific data residency requirements should contact Treewalker Digital Private Limited before subscribing, integrating, or deploying Galla.app. 

31. Limitation of Liability

Each party’s liability under this DPA will be subject to the limitation of liability stated in the Agreement, unless prohibited by applicable law. 

Nothing in this DPA limits liability that cannot be limited under applicable law. 

The Customer is responsible for claims, penalties, complaints, and losses arising from:

1. Unlawful collection of Personal Data. 
2. Lack of valid consent. 
3. Unlawful marketing communication. 
4. Unauthorised WhatsApp, SMS, or email campaigns. 
5. Incorrect or excessive Personal Data uploaded by the Customer. 
6. Misconfigured integrations. 
7. Customer-side security failures. 
8. Violation of third-party terms. 
9. Misuse by Customer users. 
10. Failure to respond to Data Principal or Data Subject requests. 

32. Indemnity

The Customer agrees to defend, indemnify, and hold harmless Treewalker Digital Private Limited, its directors, officers, employees, contractors, affiliates, suppliers, and partners from claims, complaints, damages, liabilities, penalties, regulatory actions, costs, and expenses arising from: 

1. Customer’s breach of this DPA. 
2. Customer’s violation of Applicable Data Protection Laws. 
3. Customer’s unlawful collection, upload, use, sharing, or processing of Personal Data. 
4. Customer’s failure to obtain consent. 
5. Customer’s unlawful WhatsApp, SMS, email, or marketing communication. 
6. Customer’s use of purchased, scraped, unauthorised, or unlawful contact lists. 
7. Customer’s violation of WhatsApp, payment gateway, ecommerce, marketplace, logistics, ERP, SMS, email, or other third-party terms. 
8. Customer’s inaccurate data, tax data, billing data, inventory data, warehouse data, or ecommerce data. 
9. Customer-side data breach, credential compromise, device compromise, API key exposure, or internal misuse. 
10. Claims from Customer’s end customers, employees, vendors, suppliers, buyers, recipients, or business partners. 

33. Conflict with Other Agreements 

If there is a conflict between this DPA and the Agreement: 

1. This DPA will prevail only for matters relating to Personal Data processing. 
2. The Agreement will prevail for commercial terms, payment terms, service scope, warranties, support, limitations of liability, and general legal terms unless this DPA expressly states otherwise. 
3. A signed enterprise DPA or negotiated data processing agreement will prevail over this website DPA only to the extent of the conflict. 

34. Term and Termination

This DPA will remain in effect for as long as Treewalker Digital Private Limited processes Customer Personal Data on behalf of the Customer. 

Upon termination of the Agreement, this DPA will continue only for so long as Treewalker Digital Private Limited retains or processes Customer Personal Data. 

Clauses relating to confidentiality, security, deletion, liability, audit, legal compliance, and data retention will survive termination as necessary. 

35. Updates to this DPA

Treewalker Digital Private Limited may update this DPA from time to time to reflect: 

1. Changes in law. 
2. Changes in Galla.app products or services. 
3. Changes in security practices. 
4. Changes in subprocessors. 
5. Changes in integrations. 
6. Changes in business operations. 
7. Changes required by regulators or third-party providers. 

If changes are material, Treewalker Digital Private Limited may notify Customers by email, dashboard notice, website notice, or other reasonable means. 

Continued use of Galla.app after the effective date of the updated DPA will constitute acceptance of the updated DPA. 

36. Governing Law and Jurisdiction 

This DPA is governed by the laws of India, unless a signed written agreement states otherwise. 

Subject to any arbitration or dispute resolution clause in the Agreement, courts located in Bengaluru, Karnataka, India will have jurisdiction over disputes arising from or relating to this DPA. 

36. Contact Information

For privacy, data processing, or DPA-related queries, contact: 

Treewalker Digital Private Limited
Product: Galla.app
Registered Office: Vikas Plaza.38/ 1A (4), Kanappana Agrahara, Hosur Rd, Phase II, Electronic City, Bengaluru, Karnataka 560100
Legal Email: legal@treewalkerlabs.com
Support Email: support@treewalkerlabs.com
Phone: +91-6366-740-274
CIN: U72900KA2021PTC153840
GSTIN: 29AAICT9733E1ZX