Data Processing
Addendum

"Personal Data", "Data Fiduciary", "Data Processor", "Data Principal", "Personal Data Breach" have the meanings in the DPDP Act. "Customer Data" means data submitted to the Service by or for the Tenant. "Sub-processor" means a third party engaged by VANVED to process Customer Data.

• The Tenant is the Data Fiduciary; VANVED is the Data Processor for Customer Data.
• Subject matter: providing the modules the Tenant uses. Duration: the subscription term plus the retention period in section 11.
• Categories of Data Principals: Tenant's employees, candidates, students and guardians, members, customers, leads and contacts, visitors, website visitors.
• Categories of data: identity and contact details, employment and payroll data (salary, bank, PAN, UAN/ESIC), attendance and location/photo/biometric device IDs, education records, communications logs, financial/invoice data, documents and signatures, visitor logs, and any data the Tenant adds in custom fields.
• Nature: hosting, storage, retrieval, transmission via messaging/payments providers, backup, support access.

The Tenant shall: give notice and obtain valid consent (or rely on a legitimate use) before data is entered; obtain verifiable parental or guardian consent for children's data (school and similar modules) and avoid tracking or targeted advertising to children; keep data accurate; manage user access; configure retention; send messages only to opted-in recipients; and handle Data Principal requests and Board proceedings as Data Fiduciary.

VANVED shall:

1. Process Customer Data only on the Tenant's documented instructions (the Terms, this DPA, and use of the Service features), unless law requires otherwise.
2. Ensure personnel with access are bound by confidentiality.
3. Apply reasonable security safeguards (see Security), including measures to prevent breach, access control and logging, and review them periodically.
4. Not sell Customer Data or use it for its own marketing or to train AI models.
5. Assist the Tenant, by appropriate tools or on request and at reasonable effort, in responding to Data Principal requests (access, correction, erasure, grievance), and in impact assessments where applicable.
6. Not disclose Customer Data except to Sub-processors or authorities as permitted below.

The Tenant gives general authorisation for the sub-processors in the Privacy Policy section 7 (hosting provider [FILL: hosting provider & region]; Razorpay and Cashfree where the Tenant uses payments through its own account with them; Meta WhatsApp Cloud API; SMS/DLT providers; SMTP email providers; Anthropic for AI features if enabled; Google for sign-in/Calendar if enabled; Firebase for notifications; GST/e-invoice service providers if enabled). Where the Tenant connects its own accounts (own gateway, WhatsApp, SMTP), that provider is the Tenant's own vendor. VANVED will bind sub-processors to equivalent obligations, stay liable for them, and give 15 days' notice of new sub-processors; the Tenant may object in writing and, if unresolved, terminate.

VANVED shall notify the Tenant without undue delay and within 48 hours of becoming aware of a breach affecting Customer Data, with available details (nature, categories, likely effect, measures taken). The Tenant, as Data Fiduciary, is responsible for intimating the Data Protection Board of India and affected Data Principals (the DPDP Rules require intimation to the Board without delay and a detailed report within 72 hours). VANVED will assist. VANVED will also report to CERT-In where required (within 6 hours of noticing a reportable incident).

If VANVED receives a request directly from a Data Principal about Customer Data, it will redirect them to the Tenant and inform the Tenant, unless it is legally barred.

Primary storage is in India at [FILL: hosting provider & region]. Some Sub-processors (e.g. messaging, AI) may process data outside India. Transfers happen only to countries not restricted by the Central Government under the DPDP Act.

On reasonable notice (not more than once a year, unless after a breach), VANVED will provide information needed to show compliance, such as written answers to a security questionnaire. On-site audits only by mutual agreement. We do not currently hold SOC 2 or ISO 27001 certifications.

Subject to the limitation in the Terms. Each party is responsible for its own compliance with the DPDP Act.

When the subscription ends the Tenant may export its data for [FILL: export window] days. After that VANVED deletes or anonymises Customer Data within [FILL: days] days, except where law requires retention, and backups expire within [FILL: backup retention].

[FILL: Grievance Officer name], [FILL: Grievance email]; [FILL: Registered address].

Process data to run the enabled modules; send messages the Tenant triggers; generate documents (invoices, payslips, e-signature certificates); keep audit logs; back up; support troubleshooting with minimum necessary access.