This addendum applies when you store personal data about your clients, their employees or customers ("client data") in vDPO. It forms part of the Terms of Use.
1. Roles
For client data, you (or your client) decide why and how it is processed. vDPO processes it only on your behalf, to provide the service, and acts as a Data Processor within the meaning of the Digital Personal Data Protection Act, 2023 (DPDP Act). Where you are yourself processing for your client, this addendum applies to vDPO as your sub-processor.
2. What we do with client data
- We process client data only to provide vDPO to you: storing it, showing it to you, calculating scores, producing reports and backups, and deleting it when you ask.
- We do not use client data for our own purposes, sell it, or use it to train any model.
- We follow your documented instructions, given through your use of vDPO or in writing, unless the law requires otherwise. We will tell you if we think an instruction breaks the law.
3. Your responsibilities
You are responsible for having a lawful basis to store client data in vDPO, for giving any notices and obtaining any consents required, and for adding only the data you need.
4. Confidentiality and access
Only people who need access to operate or support vDPO can reach the systems that hold client data, and they are bound by confidentiality. Administrative screens are designed not to show the contents of real-client workspaces.
5. Security
We apply reasonable security safeguards suited to the nature of the data, as described on the Security page, including encryption of real-client notes and registration numbers with a separate key for each client.
6. Service providers
We use the service providers listed on the Service Providers page. Each receives only what it needs. We will update that page before adding a provider that receives client data, and you may object by writing to us; if we cannot address your objection, you may stop using the affected feature or close your account.
7. Personal data breaches
If we become aware of a breach affecting client data, we will tell you without undue delay, and within 48 hours, with the information we have, so that you can meet your own obligations to the Data Protection Board of India and affected people. We will help you with reasonable follow-up information.
8. Helping with requests
vDPO lets you view, correct, export (as a backup) and delete client data yourself. If you need more help responding to a request from a Data Principal or an authority, write to us and we will assist where reasonable.
9. Deletion
When you delete a client or your account, its client data is deleted from our live systems straight away, including its encryption key. Copies may remain in hosting backups for a limited period until they are overwritten. Backup files you downloaded are under your control.
10. Transfers outside India
Client data is hosted in the United States. Transfers are made as permitted under the DPDP Act, s. 16, and will stop for any country the Central Government restricts.
11. Information and audits
On reasonable written request, we will give you the information you need to show that this addendum is being followed, such as answers to a security questionnaire.
12. Liability
The limits of liability in the Terms of Use apply to this addendum.