Data Processing Addendum
1. Purpose and scope
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Customer”, the data fiduciary / controller) and Appstowork Dot Com (“Processor”) and applies when we process personal data on the Customer’s behalf through ATW Collectrix. It supports compliance with the Digital Personal Data Protection Act, 2023 and other applicable data protection law.
2. Details of processing
| Subject matter | Providing the receivables management Service (sync, ageing, statements, reminders, reports, writeback). |
|---|---|
| Duration | The subscription term plus the export period in section 9. |
| Nature | Storage, retrieval, organisation, analysis, transmission to channels chosen by the Customer, and deletion. |
| Personal data | Names, contact details, addresses, GSTIN, account balances, invoice and payment history of the Customer’s debtors, suppliers and staff; delivery logs. |
| Data subjects | The Customer’s customers (debtors), suppliers, executives and other staff. |
3. Customer instructions
We process personal data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use of the Service’s features and settings, unless the law requires otherwise. We will tell the Customer if we believe an instruction breaches the law. The Customer is responsible for the lawfulness of the data and instructions it gives, including notices to and consent from data subjects.
4. Confidentiality
We ensure that personnel with access to personal data are bound by confidentiality obligations and access it only as needed for the Service, support or security.
5. Security measures
We maintain reasonable technical and organisational safeguards, including: encrypted transport (HTTPS); hashed passwords and optional two-factor authentication; encryption at rest of stored third-party credentials; per-company data isolation and role-based access; request rate limiting; audit logging; network and application hardening; and regular backups. We review these measures as risks change.
6. Sub-processors
The Customer authorises us to use sub-processors, currently: infrastructure / hosting providers for servers, database and backups. Email and WhatsApp gateways are chosen and contracted by the Customer, and are not our sub-processors. We bind sub-processors to data protection terms no less protective than this DPA and stay responsible for their performance. We will notify the Customer of new sub-processors in advance; the Customer may object on reasonable grounds.
7. Assisting the Customer
Taking into account the nature of processing, we will reasonably help the Customer to respond to requests from data subjects (access, correction, erasure), and to meet security, breach-notification and impact-assessment obligations. We will forward to the Customer any request we receive directly from a data subject about the Customer’s data.
8. Personal data breaches
We will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting the Customer’s data, with the information we have to help the Customer meet its own notification duties. Contact for incidents: support@appstowork.com.
9. Return and deletion
On termination or expiry, the Customer may export its data for 30 days. After that we delete personal data from live systems and, in the normal backup cycle, from backups, unless the law requires retention. The Customer can also delete a company’s data in the Service at any time.
10. Audit
On reasonable written notice and no more than once a year (unless a breach has occurred), we will provide information needed to show compliance with this DPA, such as a description of our security practices. Any on-site audit needs mutual agreement on scope and confidentiality and is at the Customer’s cost.
11. Transfers
We will transfer personal data outside India only where permitted by applicable law and any restrictions notified by the Government of India.
12. Liability and order of precedence
Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on processing of personal data, this DPA prevails.
13. Contact
Appstowork Dot Com
Email: support@appstowork.com
Phone: +91 9698309555