Data Processing Agreement (DPA).

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions governing the use of NewzBari services.

This DPA establishes the responsibilities and obligations of NewzBari and the Publisher concerning the processing, storage, protection, and handling of personal data through the NewzBari platform.

NewzBari is an initiative of RyteByte Labs and provides a multi-tenant, white-label News SaaS platform for independent publishers and media organizations.

This DPA applies where NewzBari processes personal data on behalf of a Publisher in connection with the provision of contracted services.

2. Parties and Definitions

2.1 Parties

Data Controller / Publisher

The individual or organization subscribing to NewzBari and determining the purposes and means of processing personal data through its Publisher Portal, where applicable.

Data Processor / Service Provider

NewzBari, an initiative of RyteByte Labs, acting as a service provider under the applicable subscription arrangement.

2.2 Definitions

Personal Data: Information relating to an identified or identifiable natural person.

Processing: Any operation performed on personal data, including collection, storage, organization, retrieval, use, transmission, disclosure, restriction, deletion, or destruction.

Data Subject: The individual to whom personal data relates.

Subprocessor: A third-party service provider engaged by NewzBari to process personal data on behalf of a Publisher.

Personal Data Breach: A security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data.

Applicable Data Protection Laws: The data protection and privacy laws applicable to the relevant processing activity, including the Bangladesh Personal Data Protection Act, 2026, and the GDPR where its territorial and material scope applies.

3. Roles and Responsibilities

3.1 Publisher as Data Controller

Where a Publisher determines the purposes and essential means of processing information collected through its Publisher Portal, the Publisher acts as the Data Controller or equivalent legal entity.

The Publisher is responsible for:

1. Determining the lawful purposes of data collection.
2. Providing appropriate privacy notices.
3. Obtaining legally required consent.
4. Ensuring lawful collection and processing.
5. Responding to data subject requests.
6. Maintaining appropriate records.
7. Ensuring that submitted instructions are lawful.
8. Complying with applicable data protection obligations.

3.2 NewzBari as Data Processor

Where NewzBari processes personal data on behalf of a Publisher, NewzBari acts as a Data Processor or equivalent service provider.

NewzBari shall:

• Process personal data only for the provision of contracted services.
• Follow documented and lawful instructions from the Publisher.
• Maintain appropriate security measures.
• Restrict unauthorized access.
• Maintain confidentiality.
• Engage subprocessors subject to this DPA.
• Assist the Publisher with applicable data protection obligations.

3.3 Independent Processing Activities

NewzBari may independently act as a Data Controller for personal data relating to:

• Publisher account registration.
• Subscription administration.
• Billing and payment records.
• Platform security.
• Fraud prevention.
• Customer support.
• Legal compliance.
• NewzBari's own business operations.

Such processing is governed by the NewzBari Privacy Policy and applicable law.

4. Scope and Purpose of Processing

NewzBari processes personal data only to the extent necessary to provide and maintain the contracted services.

Processing activities may include:

1. Hosting publisher websites.
2. Storing publisher-managed information.
3. Maintaining publisher databases.
4. Providing content management functionality.
5. Processing reader submissions where supported.
6. Managing authentication and access.
7. Maintaining technical logs.
8. Providing operational backups.
9. Maintaining system security.
10. Troubleshooting and technical support.
11. Providing service continuity and recovery.

NewzBari shall not intentionally use Publisher-controlled personal data for unrelated commercial purposes.

5. Categories of Personal Data

Depending on the Publisher's configuration and activities, the processed data may include:

• Names.
• Email addresses.
• Telephone numbers.
• Account identifiers.
• Usernames.
• IP addresses.
• Device information.
• Browser information.
• Login records.
• Reader comments.
• Contact form submissions.
• Newsletter subscription information.
• Author and contributor information.
• Website interaction information.
• Other information submitted through Publisher Portals.

Special categories of personal data should not be submitted unless the Publisher has a lawful basis and the processing is specifically necessary and legally permitted.

6. Categories of Data Subjects

The relevant data subjects may include:

• Website visitors.
• Registered readers.
• Newsletter subscribers.
• Comment contributors.
• Journalists.
• Authors.
• Editors.
• Publisher employees.
• Publisher administrators.
• Other individuals interacting with the Publisher Portal.

7. Processing Instructions

NewzBari shall process personal data according to the Publisher's documented and lawful instructions.

Instructions may be provided through:

• Publisher dashboard configurations.
• Account settings.
• Written service requests.
• Contractual instructions.
• Other authorized communication channels.

NewzBari shall inform the Publisher if, in its reasonable opinion, an instruction appears to violate applicable data protection law.

NewzBari may refuse an unlawful instruction.

8. Confidentiality

NewzBari shall ensure that individuals authorized to access personal data are subject to appropriate confidentiality obligations.

Access to personal data shall be restricted to personnel and service providers who require access for legitimate operational purposes.

NewzBari shall take reasonable steps to prevent unauthorized disclosure or misuse of personal data.

9. Technical and Organizational Security Measures

NewzBari shall implement reasonable technical and organizational security measures appropriate to the nature, scope, and risks of the processing.

Such measures may include:

9.1 Access Control

• Role-based access where supported.
• Restricted administrative access.
• Authentication controls.
• Account permission management.

9.2 Communication Security

• Secure communication protocols.
• Appropriate protection of information transmitted over networks.
• Secure administrative access.

9.3 Infrastructure Security

• Hosting infrastructure protection.
• Security monitoring.
• Technical maintenance.
• Vulnerability management.
• Abuse prevention.

9.4 Backup and Recovery

• Operational backup mechanisms.
• Appropriate backup access restrictions.
• Recovery procedures.
• Protection against unauthorized backup access.

9.5 Incident Management

• Security incident monitoring.
• Investigation procedures.
• Appropriate containment measures.
• Incident documentation.
• Legally required notifications.

The specific measures implemented may vary depending on the selected services and technical environment.

10. Subprocessors

NewzBari may engage third-party subprocessors to support the provision of its services.

Such providers may include:

• Cloud hosting providers.
• Data storage providers.
• Content delivery network providers.
• DNS and infrastructure providers.
• Security service providers.
• Email delivery providers.
• Technical monitoring providers.
• Customer support providers.

NewzBari shall impose appropriate data protection obligations on subprocessors through contractual arrangements.

Where applicable law requires prior authorization or notice, NewzBari shall provide the required information.

The Publisher may raise a reasonable, documented objection to a new subprocessor on legitimate data protection grounds.

If the parties cannot resolve a material objection, the parties may discuss an appropriate alternative or discontinuation of the affected service, subject to the applicable agreement and law.

The current subprocessor list, including provider names, service categories, and relevant processing locations, may be requested by contacting [email protected]. NewzBari will provide relevant details as required by applicable law and this DPA.

11. International Data Transfers

NewzBari may use subprocessors and infrastructure located outside Bangladesh.

Where personal data is transferred internationally, NewzBari shall implement appropriate safeguards and comply with applicable transfer requirements.

Depending on the applicable law, safeguards may include:

• Adequacy decisions.
• Standard contractual clauses.
• Approved transfer mechanisms.
• Other legally recognized safeguards.

The Publisher acknowledges that international infrastructure may be necessary for the delivery of NewzBari services.

12. Data Subject Rights Assistance

NewzBari shall provide reasonable assistance to the Publisher, taking into account the nature of the processing and the technical information available, to help the Publisher respond to legally valid data subject requests.

These requests may include:

• Access.
• Correction.
• Deletion.
• Restriction.
• Objection.
• Applicable portability rights.
• Withdrawal of consent.

If NewzBari receives a request directly relating to data controlled by a Publisher, it may refer the request to the relevant Publisher unless it is legally required to respond directly.

NewzBari will not independently determine the legal merits of a Publisher's data subject request.

13. Personal Data Breach Notification

NewzBari shall notify the affected Publisher without undue delay after becoming aware of a personal data breach involving personal data processed on the Publisher's behalf, where notification is required by applicable law.

Where reasonably available, the notification may include:

• Nature of the incident.
• Categories of affected information.
• Known or estimated impact.
• Measures taken to contain the incident.
• Recommended protective measures.
• Additional information as it becomes available.

NewzBari shall reasonably cooperate with the Publisher in investigating and addressing the incident.

The Publisher remains responsible for determining and fulfilling its own legal obligations to notify competent authorities and affected individuals.

Where GDPR applies, the Controller's applicable notification deadline, including the 72-hour supervisory authority notification requirement where triggered, remains the Controller's responsibility.

14. Data Protection Impact Assessments

Where required by applicable law, NewzBari shall provide reasonable assistance to the Publisher in conducting a Data Protection Impact Assessment (DPIA), taking into account the nature of the processing and the information reasonably available to NewzBari.

The Publisher remains responsible for determining whether a DPIA is legally required for its activities.

15. Data Retention and Deletion

NewzBari shall retain personal data only for the duration necessary to provide the contracted services and fulfill applicable legal obligations.

15.1 Active Subscription

During an active subscription, NewzBari may store and process personal data as necessary for service delivery, platform functionality, and operational backup purposes.

15.2 Subscription Expiration

When a Publisher's subscription expires or is terminated:

• Access to the Publisher Portal may be suspended.
• Dashboard access may be restricted.
• Access to operational backups may be discontinued.
• Personal data may be deleted or otherwise disposed of according to applicable retention practices and legal requirements.

15.3 End-of-Service Instructions

At the end of the processing services, the Publisher may instruct NewzBari to delete or return personal data where required under applicable law.

NewzBari shall comply with the applicable legal requirements, subject to any lawful retention obligation.

Return of personal data under this section is distinct from a commercial website migration service.

15.4 Backup Retention

Personal data contained in operational backups may remain in protected backup storage until the applicable backup rotation or deletion process is completed.

Such information shall remain subject to appropriate security protections and shall not be restored or otherwise used except for legitimate recovery, security, or legal purposes.

16. Website Migration and Commercial Data Export

NewzBari does not provide complete website migration, source code delivery, external hosting migration, or custom bulk database export as part of its standard subscription services.

This commercial service limitation does not remove:

• Applicable statutory data subject rights.
• Mandatory personal data return or deletion obligations.
• Lawful data protection requests.
• NewzBari's obligations under this DPA.

Where legally required, NewzBari shall provide reasonable assistance or perform the required data return or deletion without creating an obligation to migrate the complete Publisher Portal to another platform.

17. Audits and Compliance Information

NewzBari shall make available reasonable information necessary to demonstrate compliance with applicable processor obligations under this DPA.

Where applicable law requires an audit, the Publisher may request a reasonable compliance review.

Any audit shall:

• Be requested with reasonable advance notice.
• Be conducted during reasonable business hours.
• Protect the confidentiality of NewzBari and other Publishers.
• Avoid unnecessary disruption.
• Respect applicable security and access restrictions.

Where appropriate, NewzBari may provide relevant security documentation or independent audit reports instead of allowing unrestricted infrastructure access.

18. Third-Party Advertising Services

Some advertising services may be provided directly by independent advertising networks or agencies.

Where an advertising provider independently determines the purposes and means of its own data processing, it may act as an independent controller rather than a NewzBari subprocessor.

Publishers are responsible for reviewing applicable advertising terms, privacy disclosures, and consent requirements.

This DPA does not automatically govern independent processing activities conducted by third-party advertising providers.

19. Publisher Obligations

The Publisher agrees to:

1. Process personal data lawfully.
2. Provide appropriate privacy notices.
3. Obtain legally required consent.
4. Maintain accurate privacy disclosures.
5. Follow applicable data protection laws.
6. Provide lawful processing instructions.
7. Restrict unnecessary sensitive information.
8. Maintain appropriate account security.
9. Respond to data subject requests.
10. Notify NewzBari of relevant security concerns.
11. Maintain independent copies of important business records.

20. Liability

Each party shall remain responsible for its respective legal obligations under applicable data protection laws.

Nothing in this DPA excludes or limits liability that cannot lawfully be excluded or limited.

Any contractual liability limitations in the main Terms shall apply only to the extent permitted by applicable data protection law.

21. Governing Law

This DPA shall be governed by the laws of Bangladesh, subject to applicable mandatory data protection requirements.

Where GDPR or another mandatory foreign data protection law applies to a particular processing activity, the relevant mandatory provisions shall also apply.

22. Relationship with the Main Terms

This DPA supplements the NewzBari Terms & Conditions and Privacy Policy.

In case of conflict concerning personal data processing, this DPA shall take precedence over inconsistent general provisions to the extent necessary to satisfy applicable data protection requirements.

23. Contact Information

For data protection matters, please contact:

NewzBari An initiative of RyteByte Labs

Email: [email protected] Phone: +880 18 13 48 53 48 Website: https://www.newzbari.com

---

ANNEX I — DETAILS OF PROCESSING

Subject Matter: Processing of personal data through NewzBari's News SaaS platform.

Duration: For the duration of the Publisher's active subscription and any subsequent retention period required by law or the applicable retention schedule.

Nature of Processing:

• Collection.
• Hosting.
• Storage.
• Organization.
• Retrieval.
• Access management.
• Transmission.
• Backup.
• Security monitoring.
• Deletion.

Purpose of Processing: Providing and maintaining the Publisher Portal, content management functionality, technical infrastructure, security, and associated services.

Categories of Data Subjects:

• Readers.
• Website visitors.
• Newsletter subscribers.
• Comment contributors.
• Authors.
• Journalists.
• Editors.
• Publisher staff.
• Publisher administrators.

Categories of Personal Data:

• Names.
• Email addresses.
• Telephone numbers.
• IP addresses.
• Account identifiers.
• Device information.
• Browser information.
• Login records.
• Comments and submissions.
• Other information submitted through the Publisher Portal.

Special Categories: Not intentionally processed unless specifically authorized, necessary, and legally permitted.

ANNEX II — SECURITY MEASURES

NewzBari shall maintain appropriate security measures based on the nature and risk of processing, including relevant access controls, secure communications, infrastructure security, backup protection, monitoring, and incident response procedures.

The specific technical measures shall reflect the services actually implemented.

ANNEX III — SUBPROCESSOR INFORMATION

Current subprocessor information may be requested at [email protected], subject to applicable law and this DPA.