Data processing agreement

1. Who is who

• You, the customer, are the Data Fiduciary. You decide why and how your users' personal data is processed.
• We, Chumbaq, are your Data Processor. We process that data for you, under this valid contract, as section 8(2) of the Act requires.
• Data Principals are the people the data is about: the users of your apps and websites, and the people you send messages to.

The Chumbaq party to this DPA is [contracting entity: which of Qleverlabs Technologies Pvt Ltd and Qleverlabs Technologies Inc contracts with which customers].

This DPA does not cover data about you and your team as account holders. For that data we are the Data Fiduciary, and our privacy policy applies.

2. We act only on your instructions

We process your users' personal data only on your documented instructions. Your instructions are:

• this DPA and the terms of service;
• what you set up in the dashboard, such as segments, campaigns, journeys, links and channel settings;
• what your apps, SDKs and servers send to our API with your project's keys;
• any other written instruction you give us that we agree to.

We do not process the data for our own purposes, sell it, or use it for advertising. If we think an instruction breaks the Act or another law, we will tell you and may pause that processing until you confirm or change it.

3. What we process and why

Purposes

• Recognise your users and their devices, and link a device to a signed-in user when your app identifies them.
• Store the traits and events your app sends, and build the segments you define from them.
• Send your push, email, SMS and WhatsApp messages through the provider accounts you connect, and show your in-app messages and banners.
• Respect your users' consent choices and opt-outs, and stop messages to addresses that bounce or unsubscribe.
• Run your short links: redirect a click to the right app or store, and match a later app install to that click.
• Report results to you: deliveries, opens, clicks, installs, conversions and revenue.
• Send events to webhooks you set up, and import cohorts from your Mixpanel account if you connect it.

Categories of personal data

You decide what traits and events to send. Do not send more than your purposes need, and do not send passwords, payment card numbers or government ID numbers.

To match an install to an earlier link click, we compare a cookie reference or, failing that, the IP address and platform of clicks in the previous 48 hours.

4. Your duties as Data Fiduciary

You are responsible for:

• giving your users the notice section 5 of the Act and Rule 3 require, and getting valid consent or relying on another lawful basis (section 6 and section 7);
• sending us your users' consent choices, so we can respect them when we send messages;
• having the right to use the provider accounts and credentials you connect;
• handling your users' requests and grievances, with our help (section 8 below);
• reporting personal data breaches to the Data Protection Board of India and to affected users, with our help (section 7 below).

Children

Section 9(3) of the Act forbids tracking or behavioural monitoring of children, and targeted advertising directed at them. A child is anyone under 18. You must not use Chumbaq to track, monitor the behaviour of, or target advertising at users under 18, unless an exemption under the Act or the Rules applies to you and you have told us which one. Where you process a child's data at all, you must get verifiable consent from a parent or lawful guardian first, as section 9(1) requires.

5. Confidentiality and staff access

Only Chumbaq staff who need to, to run the service, support you or investigate misuse, can access your project. They are bound by written confidentiality obligations [confirm staff and contractor confidentiality agreements are in place].

• Staff rights are granted from the server's command line only, never from the dashboard, and each grant is logged.
• Every time staff open an account's details, it is recorded in an append-only audit log.
• When staff view an account as its owner, the view is read-only, lasts at most 30 minutes, and is logged.
• Before viewing as an owner or suspending an account, staff must have signed in again within the last 15 minutes.

6. Security safeguards

Rule 6 of the Rules asks for reasonable security safeguards. These are the measures in place in the Chumbaq platform today:

• Encrypted credentials. The credentials you give us for push, email, SMS and WhatsApp providers, your Mixpanel service account password and your webhook signing secrets are encrypted with AES-256-GCM before they are stored.
• Hashed API keys. We store only a SHA-256 hash of each API key. A key belongs to one project and can be revoked at any time.
• Account protection. Passwords are stored as bcrypt hashes. Accounts can use passkeys or an authenticator app for two-step sign-in. Failed sign-ins are rate limited.
• Sessions you control. You can see each signed-in device and sign it out. Changing a password ends every other session. A session lasts at most 30 days by default.
• Logs. Sign-in and security events are logged with time, IP address and user agent, and kept for 365 days by default (never less than 180). Staff actions are kept in an append-only audit log.
• Separation between projects. Each project's data is reached only with that project's API keys, by its owner's account, or by staff as described in section 5.

The following depend on how the hosted service is deployed and will be confirmed before launch:

• Encryption of the database and backups at rest: [confirm and describe]
• TLS (HTTPS) for all traffic to the hosted dashboard and API: [confirm and describe]
• Backups, how often, where they are kept and how long: [confirm and describe]
• Monitoring for unauthorised access: [confirm and describe]

See also our security page.

7. Personal data breaches

If we become aware of a personal data breach affecting your users' data, we will tell you without undue delay, and in any case within [number of hours] hours. This is so that you can inform affected users and send the Data Protection Board of India the detailed report Rule 7 requires within 72 hours of becoming aware of the breach.

We will give you, as soon as we have it and updating it as we learn more:

• a description of the breach: its nature, extent, timing and where it happened;
• the people and data likely to be affected, and the likely impact;
• the facts, circumstances and reasons that led to it;
• what we have done and will do to reduce the harm and stop it happening again;
• what we know about who caused it;
• a contact person who can answer your questions.

We will email the account owner of each affected project, and keep a record of every breach.

8. Helping you with your users' rights

Your users can ask you for access to, correction of and erasure of their data, and can bring grievances (sections 11 to 14 of the Act). We will help you answer them:

• If one of your users contacts us directly, we will pass the request to you and not answer it ourselves unless you ask us to.
• You can look up a person's profile and events in the dashboard, and correct their traits there or by sending updated traits from your app.
• When you instruct us in writing to erase a person's data, we will erase it from the service without undue delay, and confirm to you when it is done.
• We record the consent and opt-out choices your app sends. On email, SMS and WhatsApp, we do not send to a person who has opted out, unsubscribed or replied STOP.

9. Sub-processors

You authorise us to use the sub-processors on our sub-processor list. Each one is bound by a written contract with data protection duties no weaker than ours under this DPA, and we stay responsible to you for their work.

We will email account owners at least [number of days] days before we add or replace a sub-processor. You can object in writing within that period, on reasonable data protection grounds. We will then work with you to find a solution. If we cannot, you may end the affected part of the service without penalty.

The push, email, SMS, WhatsApp and analytics providers you connect with your own accounts are your own processors, not ours. They are listed separately on the sub-processor page.

10. Transfers outside India

The hosted service runs in [hosting region]. Section 16 of the Act allows personal data to be transferred outside India, except to countries the Government of India restricts by notification. We will not process your users' data in, or transfer it to, a restricted country. Data you send to your own providers goes where those providers process it.

11. Retention, return and erasure

• While the service runs, we keep your users' data until you delete it or instruct us to delete it.
• Section 8(7) of the Act requires a Data Fiduciary to erase personal data, and to have its processors erase it, once consent is withdrawn or the purpose is no longer served. When you instruct us to erase data for that reason, we will do so.
• When the service ends, you can export your data for [number of days] days. After that we will erase your users' personal data, including from backups within [backup erasure period], unless the law requires us to keep it, and confirm the erasure to you in writing.
• The Rules ask for logs of processing to be kept for at least one year. Where we must keep logs for that reason, we keep only what is needed, protect them like the rest of your data, and erase them once the period ends. [lawyer to confirm how this applies to message and click logs after an erasure instruction]

12. Audits and demonstrating compliance

On request, we will give you the information you reasonably need to show that this DPA is being followed, including a description of our security measures and our sub-processors. You or an independent auditor you appoint may audit our compliance once a year, on [notice period] notice, at your own cost, under a confidentiality agreement, or sooner after a breach or if the Data Protection Board of India asks.

13. Liability, term and governing law

• Liability under this DPA: [liability cap and exclusions].
• This DPA lasts as long as we process personal data for you, including during the export period at the end.
• Governing law and courts: [governing law and courts for each contracting entity].