Data Processing Terms

1.About these terms

These Data Processing Terms (also called a data processing addendum) form part of our Terms of Service between Qlomack Global Technologies LLP (“Qlomack”, “we” or “us”) and the Customer. They apply whenever we process personal data contained in Customer Data on the Customer’s behalf.

They are intended to meet the requirements for contracts between a data fiduciary and a data processor under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), and between a controller and a processor under Article 28 of the EU and UK General Data Protection Regulation (“GDPR”), where those laws apply.

If these terms conflict with the Terms of Service on the processing of personal data, these terms prevail. Words defined in the Terms of Service have the same meaning here.

2.Definitions

• Customer Personal Data: personal data contained in Customer Data that we process on the Customer’s behalf.
• Data Protection Law: the DPDP Act and the rules made under it, the GDPR and the UK GDPR, and any other data protection law that applies to the processing of Customer Personal Data.
• Controller includes a data fiduciary, and processor includes a data processor, as those terms are used in Data Protection Law.
• Personal Data Breach: a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor: a third party that we engage to process Customer Personal Data.

3.Roles of the parties

The Customer is the controller of Customer Personal Data, and Qlomack is its processor.

If the Customer itself processes the data on behalf of another controller, the Customer confirms that its instructions to us are authorised by that controller, and we act as its sub-processor.

We are a separate controller for personal data that we process for our own purposes, such as account, billing and security data, as described in our Privacy Policy.

4.Details of the processing

5.Processing on the Customer’s instructions

We process Customer Personal Data only on the Customer’s documented instructions. These consist of the Terms of Service, these terms, the Customer’s use and configuration of the Service by its Users, and any further written instructions we agree with the Customer.

If the law requires us to process Customer Personal Data in another way, we will tell the Customer before doing so, unless the law prohibits it. We will also tell the Customer if we believe an instruction breaks Data Protection Law, but we are not obliged to review the Customer’s instructions for legal compliance.

6.The Customer’s responsibilities

The Customer is responsible for:

• having a lawful basis, and giving any notices and obtaining any consents required, to collect Customer Personal Data and to put it into the Service;
• the accuracy of Customer Personal Data and the lawfulness of its instructions;
• deciding which Users can access which data, and managing their roles, branch access and security settings, such as two-factor authentication;
• entering only the personal data it needs; and
• where Customer Personal Data relates to children, obtaining verifiable parental consent where Data Protection Law requires it.

7.Confidentiality

We allow our personnel to access Customer Personal Data only where they need to, and only if they are bound by appropriate obligations of confidentiality. Our staff do not access Customer Personal Data except to provide support the Customer asks for, to keep the Service secure and working, or where the law requires it.

8.Security measures

We maintain technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration and unauthorised disclosure or access. They currently include:

• Encryption in transit. The website, the application and the API are served over HTTPS (TLS), and sign-in cookies are sent only over secure connections.
• Passwords. Passwords must be at least 12 characters and are stored only as one-way Argon2id hashes, never in readable form. Sign-in attempts are rate limited, with a progressive lockout after repeated failures.
• Two-factor authentication. Every user can turn on two-factor authentication with an authenticator app. Authenticator secrets are stored encrypted, and recovery codes are stored only as hashes.
• Sessions. Sessions use long random tokens, of which we store only a hash. They end after a period of inactivity and after a maximum lifetime. Users can see their active sessions and sign out other devices, and resetting a password signs out every device.
• Tenant isolation. Each organization’s data is kept separate from every other organization’s. Every request is checked against the user’s membership of the organization, and the database enforces row-level security, so a query without the correct organization context returns no data.
• Access control. Within an organization, access follows role-based permissions, with optional limits to particular branches, set by the organization’s owners and admins.
• Audit trail. Significant actions in an organization are recorded in an append-only audit log, written together with the change itself.
• Private document storage. Uploaded documents, generated reports and data exports are kept in private storage and can be downloaded only through short-lived links issued after a permission check.
• Protected credentials. Credentials for integrations that an organization connects are stored encrypted.
• Backups. The database is backed up every night, each backup is checked when it is made, and backups are kept for 14 days by default. Restores are tested.
• Limited staff access. Platform administration does not give access to organizations’ business data by default. Our staff access Customer Data only where needed to provide support you ask for, to keep the service secure, or where the law requires it.

We may update these measures over time, provided that the overall level of protection is not reduced.

9.Sub-processors

The Customer gives us general authorisation to engage Sub-processors. We currently use Sub-processors in these categories: cloud hosting (the application, the database and its backups), object storage (uploaded documents, report files and data exports) and email delivery.

We will give the Customer our current list of Sub-processors, with their locations, on request at support@qlomack.com. We will tell Owners by email at least 30 days before we add or replace a Sub-processor.

The Customer may object to a new Sub-processor on reasonable data protection grounds within that period. We will then work with the Customer in good faith to find a solution. If we cannot, the Customer may end the affected Subscription and receive a refund of prepaid Fees for the rest of the paid period.

We impose data protection obligations on each Sub-processor, by written contract, that are no less protective than these terms, and we remain responsible to the Customer for their performance.

Razorpay and Stripe, which process subscription payments, act as independent controllers for payment data and do not process Customer Data. Third-party services that the Customer connects through integrations or webhooks act on the Customer’s instructions and are not our Sub-processors.

10.International transfers

We are based in India. The Customer authorises us to transfer Customer Personal Data to India and to the countries where our Sub-processors process it, as needed to provide the Service. We will tell the Customer where its data is hosted on request.

We make transfers in line with Data Protection Law, including any restrictions that the Government of India notifies under the DPDP Act.

Where Data Protection Law requires a transfer mechanism, for example for Customer Personal Data subject to the GDPR or the UK GDPR, we will on request enter into the European Commission’s standard contractual clauses (and the UK addendum to them, where relevant) with the Customer. Those clauses take precedence over these terms for the transfers they cover.

11.Help with requests from individuals and other obligations

The Service lets the Customer find, correct, export and delete records itself, including a full data export in Settings → Data Export and CSV exports from each module.

If we receive a request from an individual about Customer Personal Data, we will pass it to the Customer without undue delay and will not respond to it ourselves, except to tell the individual that we have done so. Taking into account the nature of the processing, we will give the Customer reasonable assistance in responding to such requests where it cannot do so using the Service.

We will also give the Customer reasonable assistance, using information available to us, with data protection impact assessments, consultations with regulators and its security obligations. We may charge a reasonable fee for assistance that goes beyond what the Service provides as standard.

12.Personal Data Breaches

We will notify the Customer without undue delay after we become aware of a Personal Data Breach affecting Customer Personal Data. We will send the notice to the Organization’s Owners by email.

The notice will describe, as far as we know at the time: what happened and when; the categories and approximate number of individuals and records concerned; the likely consequences; the steps we have taken or propose to take; and a contact point for more information. We will provide further information as it becomes available.

We will take reasonable steps to contain, investigate and reduce the effects of the breach. As controller, the Customer is responsible for any notifications to regulators, including the Data Protection Board of India, and to affected individuals; we will help it with information we hold. Notifying a breach is not an admission of fault.

13.Return and deletion of data

During the Subscription, and while the Organization is read-only afterwards, the Customer can export its Customer Data at any time using the Service.

When the Customer asks us to delete an Organization, we delete its Customer Personal Data, including uploaded documents, from our live systems within 30 days of confirming the request. Copies in our backups are removed automatically as those backups expire, which under our default backup retention is within 14 days after deletion from live systems. Section 13 of the Terms of Service also explains when we may delete data after a long period without a Subscription.

We may keep Customer Personal Data after that only where the law requires us to, and we will continue to protect it under these terms while we do. We will confirm deletion in writing on request.

14.Information and audits

We will make available to the Customer the information reasonably necessary to demonstrate that we comply with these terms, including written answers to reasonable security questionnaires and a description of our security measures.

If that information is not enough to meet the Customer’s obligations under Data Protection Law, or a regulator requires it, the Customer may audit our compliance with these terms by reasonable request, on these conditions:

• the Customer gives at least 30 days’ written notice and agrees the scope, timing and method with us in advance;
• audits take place no more than once in any 12 months, unless there has been a Personal Data Breach affecting the Customer or a regulator requires it;
• audits are carried out during business hours, without unreasonable disruption, and without access to other customers’ data or to information whose disclosure would compromise the security of the Service;
• the Customer, or an independent auditor it appoints who is not our competitor, is bound by confidentiality obligations; and
• the Customer bears its own costs of the audit.

15.Liability and duration

Each party’s liability under these terms is subject to the limitations and exclusions in the Terms of Service.

These terms apply for as long as we process Customer Personal Data on the Customer’s behalf.

16.Contact

Questions about these terms, requests for our list of Sub-processors, and requests for standard contractual clauses can be sent to support@qlomack.com or raised by phone on +91 7337546393. Our company details are listed below.