Vahanse Subprocessor List

Status: DRAFT — FOR LEGAL REVIEW — NOT FOR EXECUTION

Version: 0.9 - Counsel Review Draft

Draft date: 31 August 2026

Operator: Vahanfin Solutions Private Limited (CIN U52290JH2023PTC021512)

Brand: Vahanse

Head office: Vahanfin Solutions Pvt Ltd, Nabibux House, 3rd Floor, Vakola Bridge Road, Santacruz (E), Mumbai 400 055, Maharashtra, India

This document is a Vahanse-specific working draft prepared for Vahanfin Solutions Private Limited (CIN U52290JH2023PTC021512), which operates the Vahanse brand. It is not legal advice and must be reviewed, approved and adapted by qualified Indian counsel before publication, signature or reliance. Commercial values, support contacts, regulatory representations, security commitments, service levels and any customer-specific terms must be validated against actual operations and contracts.

Purpose: Enterprise transparency register for third parties that process customer personal data.

Audience: Enterprise customers and privacy/security reviewers

1. Publication Rule

This is a controlled register. Do not publish vendor names until technology/finance/legal teams verify current production usage, data categories, purpose and processing location. A vendor should not be listed merely because a library/account exists but is not used to process customer data.

2. Required Fields

For each material subprocessor record: Legal Name; Service; Purpose; Data Categories; Data-Subject Categories; Hosting/Processing Location; Transfer/Remote Access Location if relevant; Contract/DPA Status; Security Review Date; Production Status; Effective Date.

3. Categories Expected for Vahanse

• Cloud infrastructure / compute / database / object storage.
• Email/SMS/WhatsApp or communications provider.
• Payment gateway / banking service (note where provider acts independently rather than as Vahanse processor).
• Analytics/performance monitoring.
• Customer support/CRM.
• Security/logging/monitoring.
• Document storage/processing.
• Authorized vehicle/compliance data sources.
• Execution vendors where they receive personal data to fulfil a customer instruction.

4. Customer Notice

For enterprise contracts that require notice, Vahanse will provide [15/30] days’ advance notice of a new material subprocessor where practicable, except urgent replacements required for security/legal continuity. Customer objections must be based on reasonable data-protection concerns and handled under the DPA.

5. Current Register Template

1. [Provider Legal Name] | [Service] | [Purpose] | [Data] | [Location] | [Status].
2. [Provider Legal Name] | [Service] | [Purpose] | [Data] | [Location] | [Status].
3. [Provider Legal Name] | [Service] | [Purpose] | [Data] | [Location] | [Status].

6. Review Frequency

Technology and Privacy owners should review the register at least quarterly and before onboarding a new enterprise customer with contractual subprocessor requirements.