1. Roles
When we build or run systems that touch your customers', staff's or users' personal data, you decide why and how that data is used, and we process it only on your behalf. Under the DPDP Act you are the Data Fiduciary and we are your Data Processor; under the GDPR you are the controller and we are the processor. These terms form part of every project agreement.
2. What we commit to
- Process your personal data only to deliver the agreed work and on your documented instructions.
- Keep it confidential, and limit access to the people working on your project, who are bound by confidentiality.
- Use secure methods: encrypted connections, accounts in your name where possible, least-privilege access, no copies on personal devices.
- Use real personal data in testing only when necessary, and prefer samples or anonymised data.
- Tell you without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting your data, and help you meet your notification duties.
- Help you respond to requests from the people whose data it is.
- At the end of the project, return the data or delete it from anything we control, and confirm in writing.
3. Sub-processors
Systems we build usually run in your own accounts with the providers you choose (for example your CRM, WhatsApp Business account, AI provider or cloud host). Where we need to use another provider ourselves, we will tell you in advance and use only providers with appropriate data protection terms.
4. What you commit to
- You have a lawful basis, such as consent, for the data you ask us to process, and have told the people concerned how it is used.
- You will not ask us to process sensitive data unless we agree in writing on extra safeguards.
- You decide how long data in your systems is kept, and we will build to that.
5. AI providers
When a system sends data to an AI provider, we configure it so the provider does not use your data to train its models where the provider offers that option, and we tell you which provider and settings are used.