Data processing agreement

This agreement forms part of the terms of service between TATHA VASTU PRIVATE LIMITED ("the Processor") and the customer ("the Fiduciary"). It takes effect on 1 November 2026 and applies for as long as we process personal data for the customer.

Roles

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), the customer is the Data Fiduciary for personal data inside its work orders: the names, mobile numbers and emails of its users, the names of client engineers and subcontractors written into bills, and the photographs and locations recorded with measurements. Tatha Vastu processes that data only on the customer's behalf, as its Data Processor.

Scope of processing

The table sets out what we process and why.

Our obligations

• Process personal data only on the customer's documented instructions, which are these terms, this agreement and the customer's settings in the product.
• Tell the customer if we believe an instruction breaks the DPDP Act or another Indian law.
• Make sure everyone at Tatha Vastu who can reach customer data is bound by a duty of confidentiality and has access only as their work needs.
• Keep reasonable security safeguards in place, as described on the security page, to prevent a personal data breach.
• Store customer data on servers located in India.
• Help the customer answer requests from Data Principals to access, correct or erase their data, and to have grievances heard.
• Not use customer data for our own purposes, for advertising or to train systems for other customers.

Subprocessors

The customer authorises us to use subprocessors in the categories listed on our subprocessors page. Each one is bound by a written contract with obligations no less protective than these. We share the named list with customers on request and give at least 30 days' notice by email before adding or replacing a subprocessor. If the customer objects on reasonable data protection grounds, we will discuss alternatives, and if none works, the customer may end the affected service and receive a pro rata refund of prepaid fees.

Personal data breaches

If we become aware of a personal data breach affecting customer data, we will tell the customer without undue delay and in any case within 24 hours of confirming it. Our notice will describe what happened, the data and people affected, what we have done to contain it, and a point of contact. We will give the customer the information it needs to inform the Data Protection Board of India and affected Data Principals as the DPDP Act and its rules require, and we will cooperate with any inquiry.

Audit

Once a year, or after a breach, the customer may ask for a written description of our security measures and answers to a reasonable security questionnaire. Where that is not enough to show compliance, the customer may carry out an audit with 30 days' notice, during working hours, by an auditor bound by confidentiality, without access to other customers' data.

Return and deletion

When the subscription ends, the customer can export its data in Excel and PDF for 60 days. After that, we erase customer data from live systems, and from backups as they expire, unless Indian law requires us to keep it. On request, we confirm deletion in writing.

Liability and law

Liability under this agreement is subject to the limits in the terms. This agreement is governed by the laws of India, and the courts at Mumbai, Maharashtra have exclusive jurisdiction.

Contact

Questions about this agreement go to TATHA VASTU PRIVATE LIMITED, 31, Poddar Chamber, S A Brelvi Road, Horniman Circle, Mumbai, Maharashtra 400001, India, through the Grievance Officer form or the contact form.