Data processing agreement

What this is

This agreement governs personal data that a customer business (the "Customer") puts into gobazo, operated by CONSENKO STUDIOS PRIVATE LIMITED of 2nd Floor, B-30, Block B, Sector 4, Noida, Uttar Pradesh 201301 (the "Processor"). It forms part of the Terms of service. Where those terms and this agreement conflict on the handling of that data, this agreement wins.

The split of roles

Under the Digital Personal Data Protection Act, 2023, the Customer is the Data Fiduciary for the personal data it loads into its workspace: its own customers, staff, suppliers and their contact and transaction details. The Customer decides why and how that data is processed.

CONSENKO STUDIOS PRIVATE LIMITED is the Data Processor for that data. We process it only to provide the service, and only on the Customer's instructions.

This split has a consequence the Act is explicit about: engaging us does not move the Customer's responsibility to us. The Customer remains answerable to its own data principals for that data, and this agreement is the "valid contract" the Act requires before a fiduciary hands personal data to a processor.

Separately, we are the Data Fiduciary for the account data of the Customer's own users — names, work emails, sign-in records — because we decide how that is processed in order to run accounts. That is governed by the Privacy notice, not by this agreement.

Subject matter, duration and scope

• Subject matter — provision of the gobazo service.
• Duration — for as long as the subscription runs, plus the deletion window below.
• Nature and purpose — hosting, storing, organising, analysing and transmitting personal data so the Customer can run the apps it has subscribed to.

Annex 1 — Categories of data principals and personal data. The categories depend on which apps the Customer has enabled. Across the apps gobazo offers, they are:

• Data principals — the Customer's own retail customers; its staff and workers; its suppliers and their representatives; and any individuals named in the records the Customer loads.
• Personal data — names and contact details (phone, email, address); customer purchase, transaction and loyalty history; billing and payment-reference data; staff identity, role, attendance and task-assignment data; supplier contact and order data; and any personal data contained in the messages, tickets or documents the Customer chooses to store.

The Customer should record here the specific subset that applies to the apps it has enabled.

Our obligations as Processor

• Instructions only. We process the Customer's personal data only to provide, secure and support the service, and on the Customer's documented instructions. Using the service is itself an instruction. If we believe an instruction breaks the law, we tell the Customer instead of quietly complying.
• No other purpose. We do not sell it, use it for our own marketing, or use one Customer's data to serve another. Aggregate statistics we derive to improve the product are aggregated and de-identified so no individual and no Customer can be identified.
• Confidentiality. Access is limited to personnel who need it to do their job, each bound by confidentiality obligations that survive their employment.
• Security. We maintain reasonable security safeguards to prevent a personal data breach, as section 8(5) of the Act requires. Annex 2 — Technical and organisational measures. These include: encryption of data in transit (TLS); logical separation of each Customer's data, enforced at the database with row-level security so one workspace cannot read another's; access restricted to personnel who need it, on the principle of least privilege; administrative access that is authenticated and logged; audit logging of security-relevant events; regular automated backups; and personnel bound by confidentiality obligations. Anthropic, our AI sub-processor, does not use data sent to its API to train its models.
• Helping with rights requests. If a data principal contacts us about the Customer's data, we do not answer for the Customer. We pass it on without undue delay and give the Customer the assistance and the tooling to answer it within the Act's timeframe.
• Breach. If we become aware of a personal data breach affecting the Customer's data we notify the Customer without undue delay, with what we know, and we help the Customer make the notifications the Act requires to the Data Protection Board of India and to affected data principals. Those notifications are the Customer's to make, because the Customer is the fiduciary.
• Deletion and return. On termination the Customer can export its data for 30 days. After that we delete it and instruct our sub-processors to do the same, except where law requires retention. Backups age out on their normal cycle; we do not restore deleted data from them for any other purpose.
• Assistance and information. We give the Customer the information reasonably needed to demonstrate compliance with this agreement.

Sub-processors

We use sub-processors to run the service — hosting, email and messaging delivery, error monitoring and payment processing.

• Each is bound by data protection obligations no weaker than these.
• We remain responsible to the Customer for what they do.
• We keep a current list and give reasonable notice before adding or replacing one, so the Customer can object.

Annex 3 — Sub-processors. As at the date of this agreement:

• Amazon Web Services (AWS) — cloud hosting, database and file storage — Asia Pacific (Mumbai) region, India.
• Amazon Cognito (AWS) — authentication and identity — Asia Pacific (Mumbai) region, India.
• Amazon SES (AWS) — transactional email delivery.
• Cloudflare, Inc. — content delivery, DNS and network security — global edge network.
• Anthropic — AI features (assistant, insights, drafting) — United States.
• Meta Platforms / WhatsApp — WhatsApp message delivery, where the Customer uses that channel.

We keep this list current and give reasonable notice before adding or replacing a sub-processor.

The Customer's obligations

• Have a lawful basis for every piece of personal data it loads, and give its own data principals the notice section 5 requires and take the consent section 6 requires.
• Load only the personal data the purpose needs. A workspace is not an archive.
• Keep the data accurate, and act on correction and erasure requests from its own data principals.
• Manage its users' access, and remove access promptly when it is no longer needed.
• Not use the service for special categories of data or for purposes the service was not designed for without agreeing that with us first.

Location of processing

The service processes and stores personal data in India, in Amazon Web Services' Asia Pacific (Mumbai) region. Two sub-processors process limited data outside India: our AI provider (Anthropic) processes text sent to AI features in the United States, and Cloudflare routes and protects network traffic through a global edge network. Section 16 of the DPDP Act permits such transfer except to a country the Central Government restricts, and no such restriction applies to these transfers as at the date of this agreement.

Audit

The Customer may verify our compliance once a year, on reasonable notice, through our security documentation and written responses, and — where a regulator requires more — through an audit agreed in advance, at reasonable times, without disrupting the service or exposing another customer's data.

For the avoidance of doubt: verification is through the security documentation and written responses described above, and any on-site audit is limited to where a regulator or applicable law requires it, arranged in advance, at reasonable times, and without exposing another customer's data. We do not offer unrestricted on-site audit rights.

Liability and term

Liability under this agreement is subject to the limits in the Terms of service. This agreement starts when the subscription starts and ends when deletion under it is complete.

Contact

Anything under this agreement: mohit.dhawan@consenko.com, or CONSENKO STUDIOS PRIVATE LIMITED, 2nd Floor, B-30, Block B, Sector 4, Noida, Uttar Pradesh 201301. General service contact: hello@consenko.com.