Data Processing & Subprocessor Policy

Where Goafreet processes personal data or customer records on behalf of a client during service delivery, Goafreet acts as a Data Processor or service provider under applicable Indian data protection laws. Goafreet processes such information strictly in accordance with the documented instructions of the Client and applicable service agreements.

To deliver reliable, scalable digital services, Goafreet engages trusted third-party technology providers and infrastructure partners. Approved subprocessor categories include: (a) Tier-1 Cloud Infrastructure & CDN Providers for hosting and distributed content delivery; (b) Customer Relationship & Project Systems for managing workflow deliverables; (c) Business Communications for professional correspondence; and (d) Secure File Transfer & Storage systems.

Prior to onboarding any third-party subprocessor, Goafreet assesses the provider’s security architecture, encryption capabilities, and compliance with data protection standards. Goafreet binds all subprocessors to written data processing terms imposing confidentiality, access restrictions, and security obligations no less protective than those established in Goafreet’s client agreements.

Certain cloud infrastructure and enterprise software providers maintain geographically distributed server architectures. Where cross-border data transmission occurs, Goafreet complies with cross-border transfer requirements notified under Indian law and ensures appropriate technical security controls are maintained.