Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between Linear Ventures ("Processor") and the Subscriber identified in the associated subscription or onboarding agreement ("Controller"), and forms part of the Terms of Service between the parties.

This DPA governs the processing of personal data by Linear Ventures on behalf of the Subscriber in connection with the Linear Ventures Business Operating Suite (the "Platform").

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person processed through the Platform, including customer names, contact details, employee records, and transaction parties.
• "Processing" means any operation performed on Personal Data, including storage, retrieval, use, disclosure, or deletion.
• "Sub-processor" means any third party engaged by Linear Ventures to process Personal Data on behalf of the Controller.
• "Applicable Data Protection Law" means India's Digital Personal Data Protection Act 2023 (DPDP Act) and, for UAE-based Controllers, applicable UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection.

2. Roles and Scope

• The Controller determines the purposes and means of processing Personal Data entered into the Platform (customer records, supplier details, employee data, transaction parties).
• Linear Ventures acts as the Processor and processes Personal Data solely on the documented instructions of the Controller — i.e., to provide the Platform services.
• Linear Ventures does not process Personal Data for its own commercial purposes, advertising, or profiling.

3. Linear Ventures' Obligations

Linear Ventures agrees to:

• Process Personal Data only on documented instructions from the Controller, except where required by law
• Ensure that persons authorised to process Personal Data are under appropriate confidentiality obligations
• Implement appropriate technical and organisational security measures, including encryption at rest (AES-256) and in transit (TLS), access controls, and tenant isolation
• Assist the Controller in responding to data subject rights requests (access, correction, erasure, portability) within 30 days
• Delete or return all Personal Data upon termination of the subscription, at the Controller's election, as described in §8 and the Data Retention & Offboarding Policy
• Make available all information reasonably necessary to demonstrate compliance with this DPA
• Notify the Controller without undue delay (and within 72 hours where feasible) upon becoming aware of a Personal Data breach affecting the Controller's data

4. Controller's Obligations

The Controller agrees to:

• Ensure it has a lawful basis for collecting and entering Personal Data into the Platform
• Provide appropriate privacy notices to data subjects whose Personal Data is entered into the Platform
• Ensure that any instructions given to Linear Ventures comply with Applicable Data Protection Law
• Not instruct Linear Ventures to process Personal Data in a way that violates Applicable Data Protection Law

5. Sub-processors

The Controller authorises Linear Ventures to engage the following Sub-processors:

Linear Ventures will notify the Controller of any intended changes to Sub-processors (additions or replacements) with at least 14 days' notice, giving the Controller the opportunity to object.

6. International Data Transfers

Some Sub-processors are located outside India or the UAE. Linear Ventures ensures that such transfers are made subject to appropriate safeguards, including reliance on the Sub-processor's standard contractual commitments and security certifications (SOC 2 Type II where applicable). All major Sub-processors (Neon, Vercel, Google, Meta, Cloudflare) maintain SOC 2 certifications and/or equivalent international security standards.

7. Security Measures

Linear Ventures maintains the following technical and organisational measures:

• Encryption of data at rest (AES-256) and in transit (TLS 1.2+)
• Logical tenant isolation — each Subscriber's data is scoped by a unique Company ID
• Access controls — database credentials stored exclusively in encrypted environment variables, not in code
• Authentication via Google OAuth with session tokens (HTTP-only secure cookies)
• Role-based access control (VIEWER → OPS → MANAGER → ADMIN → OWNER) within each tenant
• Regular dependency updates and security patching

8. Data Retention and Deletion

• Recovery window. Personal Data is retained for the duration of the subscription and for 90 days after termination, so the Controller can reactivate the workspace or obtain a complete export.
• Retention split. At the end of the 90-day window, Linear Ventures permanently deletes marketing, messaging, AI, bug-report, demo and account-identity data, together with full-data restore points. Statutory financial records and the records that support or evidence them are retained for at least 8 years from the end of the Indian financial year to which they relate, for records created on or before termination (and for any longer period required by applicable UAE VAT law); in practice we use a single cutoff at the end of the termination financial year plus 8 years. They are then deleted. Invoice branding and payment QR codes are retained with the invoices so that a re-issued tax invoice keeps its legal appearance.
• Erasure at the Controller's request. The Controller may instruct Linear Ventures to erase the entire workspace, including financial records, where the Controller has determined that it is not required to retain them. Linear Ventures will first deliver a complete export of the Controller's data (the complete SQL export; tenant media files such as invoice logos and QR codes are provided on request) and require confirmation of receipt, then delete all tenant SQL data and all tenant-owned objects in Linear Ventures' object storage (restore points, logos, QR codes and bug-report media). Erasure overrides the retention split and is completed within 30 days of a verified request.
• Surviving records. An offboarding receipt containing company identifiers, dates, record counts, the export receipt and the legal-acceptance evidence is retained for at least 8 years as proof of performance; it contains no business data. Linear Ventures' own invoices to the Controller and its own accounting records are retained under Linear Ventures' own statutory obligation. Whole-database backups age out on a rolling 14-day schedule and are never used to restore an erased tenant.
• Controller responsibility. The Controller is the seller/taxpayer of record and remains responsible for retaining any exported records for its own statutory period. Erasure removes Linear Ventures' copy only.

The full schedule, the recovery procedure and the erasure steps are published in the Data Retention & Offboarding Policy.

9. Data Breach Notification

In the event of a Personal Data breach affecting the Controller's data, Linear Ventures will:

• Notify the Controller without undue delay, and within 72 hours of becoming aware where feasible
• Provide available details of the breach: nature, categories of data affected, approximate number of records, likely consequences, and measures taken or proposed
• Cooperate with the Controller in any required notifications to regulatory authorities or data subjects

10. Term and Termination

This DPA remains in effect for the duration of the subscription agreement. It automatically terminates when the subscription agreement ends. Obligations regarding data deletion and breach notification survive termination.

11. Governing Law

This DPA is governed by the laws of India. For UAE-based Controllers, the parties agree that UAE Federal Decree-Law No. 45 of 2021 applies to the extent it imposes additional obligations on the Processor.

12. Contact

Linear Ventures — Data Protection Contact
Email: support@linearventures.in
Subject line: "DPA Request — [Your Company Name]"

To execute a signed copy of this DPA, email us with your company details. We will countersign and return within 5 business days.