Data Processing Agreement

• The Customer is the Data Fiduciary for the personal data it records in SiteCash: it decides what is recorded about its staff, vendors, labour contractors and others, and why.
• We are the Data Processor: we process that personal data only on the Customer’s behalf, to provide SiteCash. What the Customer’s users do and set in SiteCash counts as the Customer’s instructions.
• For our own records about SiteCash accounts (logins, billing and security logs) we are responsible directly, as described in the Privacy policy.

• People: the Customer’s users; vendors, labour contractors, drivers and other payees named in entries and bills.
• Data: names, email addresses and mobile numbers of users; names and details written in entries, bills and notes; bill photos and PDFs, which may show names, phone numbers or GSTINs; phone notification tokens; sign-in records with IP addresses.
• Purpose: providing SiteCash to the Customer (cash books, vouchers, approvals, cash requests, vendor bills, reports, Tally export and alerts), keeping it secure, and support.
• Duration: while the Customer uses SiteCash, and then until deletion as set out in section 8.

• Process the personal data only for the purpose above and on the Customer’s instructions, unless Indian law requires otherwise (in which case we tell the Customer, where the law allows).
• Make sure everyone at our end who can access it is bound to keep it confidential and has access only when needed.
• Keep reasonable security safeguards in place, as described on the Data security & integrity page, and keep them at least as strong during the agreement.
• Help the Customer answer requests from Data Principals (to see, correct or erase their data). Most of this the Customer can do directly in SiteCash; for the rest, write to support@feedautomate.com.
• Never use the personal data for our own purposes, never sell it and never use it for advertising.

• If we become aware of a personal data breach affecting the Customer’s data, we tell the Customer’s owner without undue delay and in any case within 48 hours, so that the Customer can inform the Data Protection Board of India and affected people in time.
• We tell the Customer what happened, when, what data and roughly how many people are affected, the likely effects, and what we have done and will do about it; and we keep them updated.
• We take immediate steps to contain the breach, and we report cyber security incidents to CERT-In as Indian law requires.

The Customer allows us to use the providers below to run SiteCash. Each is bound to protect the data and use it only to provide its service to us, and we remain responsible to the Customer for them.

We will announce a new provider on this page and by email to Customer owners at least 15 days before it starts. If a Customer objects for a good data protection reason and we cannot address it, the Customer may end the agreement and receive a refund of the unused part of its prepaid period.

SiteCash’s servers and database are in the European Union, and some providers above work from other countries. The DPDP Act allows this except to countries the Government of India restricts. If a restriction ever applies to a country we use, we will move the processing or stop using that provider.

• Tell its staff and others whose data it records what is recorded and why, and have a lawful basis for it under the DPDP Act.
• Record only what is needed for petty cash and accounts. Do not enter Aadhaar numbers, bank account numbers or health details in entries, notes or photos unless there is a real need.
• Keep user access current: give each person their own login, the right role and only the sites they need, and remove people who leave.

The Customer can download its data at any time, and we provide a complete export on request. When the agreement ends, we delete the Customer’s data on the timetable in Terms, section 12: after 90 days if a plan simply ends, or within 30 days of the owner asking us to close the account, with backup copies overwritten within a further 30 days. We keep only what the law requires us to keep, such as invoices.

Once a year, and after any personal data breach, we will answer a reasonable written security questionnaire from the Customer or its auditors, and share our providers’ published security certifications on request.

• If this agreement and the Terms of Service disagree about personal data, this agreement prevails.
• The limits of liability in the Terms of Service apply to this agreement.
• Questions: support@feedautomate.com · Grievance Officer: [Name of the Grievance Officer].