Data Processing Agreement

This agreement is part of the Terms of Service between the Firm and CADesk. It covers personal data that the Firm, its team and its clients put into CADesk ("Client Personal Data").

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Firm is the Data Fiduciary for Client Personal Data — it decides why and how it is used. CADesk is the Data Processor: it processes that data only on the Firm’s behalf.

• Whose data: the Firm’s clients and their contacts and directors, the Firm’s team, and people who use the client portal.
• What data: names, contact details, PAN, Aadhaar (masked where possible), GSTIN, addresses, bank details, income and tax details, uploaded documents, notices, messages, portal logins (encrypted) and similar information the Firm chooses to keep.
• What we do with it: store it, back it up, show it to the Firm’s authorised users and clients, and produce the documents, files and messages the Firm asks for.
• For how long: while the Firm uses the software, then as in section 8.

CADesk processes Client Personal Data only to provide the software and support, and as the Firm instructs through its use of the software or in writing. It does not sell it, use it for advertising, or use it for any purpose of its own.

If the law requires CADesk to process or disclose data in another way, it will tell the Firm first unless the law forbids that.

Only CADesk staff who need access to run or support the service can reach Client Personal Data. They are bound to keep it confidential, and access to production systems is limited and recorded. Support staff look at a firm’s data only when the firm asks for help or to keep the service secure.

CADesk keeps reasonable security safeguards in place, including:

• each firm’s data kept separate, with automated checks that one firm cannot reach another’s;
• encrypted connections (HTTPS) and encrypted storage of saved passwords;
• passwords stored only as one-way hashes, emailed sign-in codes for partners and admins, and lock-out after repeated wrong passwords;
• role-based access within each firm and a tamper-proof audit trail;
• servers and storage in India (Google Cloud Platform, Mumbai), with public access blocked;
• nightly, checked backups.

If CADesk becomes aware of a breach affecting Client Personal Data, it will tell the Firm without undue delay and within 24 hours, with what is known about what happened, the data and people affected, and the steps taken. It will keep the Firm updated and help it meet its own duty to inform the Data Protection Board of India and the people affected.

CADesk will help the Firm, by means of the software or otherwise, to answer requests from its clients to access, correct or erase their data, to handle grievances, and to show that it meets the DPDP Act. Requests sent to CADesk directly by a Firm’s client will be passed on to the Firm.

For 90 days after the account is closed, the Firm can sign in and download its data. CADesk then deletes Client Personal Data from its live systems within 30 days, and backups are overwritten within 30 days after that — unless the law requires something to be kept longer, in which case it is kept only for that purpose. On request, CADesk will confirm the deletion in writing.

Client Personal Data is stored and processed in India. CADesk will not transfer it outside India except as the DPDP Act allows, and only after telling the Firm.

On reasonable request (normally once a year), CADesk will give the Firm the information it needs to check compliance with this agreement, such as a description of security measures and answers to a security questionnaire.

The Firm will give its clients any notice the DPDP Act requires, have a valid reason (such as consent or a legitimate use) for each kind of data it keeps, keep data accurate, give access only to people who need it, and remove access when someone leaves.

The limits of liability in the Terms of Service apply to this agreement. If this agreement and the Terms of Service conflict about Client Personal Data, this agreement prevails. A firm that needs a signed copy of this agreement can request one at info@cadesk.si.