Data Processing Agreement
Version 2026-10 · Gangotri Consumable Retails Pvt Ltd, gangotrisales@gmail.com
This agreement is between the business that holds the ApnaLekha Cloud account (“Customer”, the Data Fiduciary) and Gangotri Consumable Retails Pvt Ltd (“Provider”, the Data Processor), under the Digital Personal Data Protection Act, 2023 and the rules made under it. It forms part of the Terms of Service.
1. Scope
Personal data of the Customer's customers, suppliers, employees and other people that the Customer enters into the Service (names, contact details, addresses, GSTIN/PAN, bank details, salary and attendance data, documents), processed for the duration of the account for the purpose of providing accounting, GST, inventory, payroll and related software.
2. Instructions
Provider processes this data only to provide the Service and on the Customer's documented instructions (the use of the Service is such an instruction), and not for its own purposes. Provider will tell the Customer if it believes an instruction breaks the law.
3. Confidentiality
Only staff who need access to run or support the Service may access Customer data, under a duty of confidentiality. Support access to a Customer's books happens only when the Customer asks for help.
4. Security safeguards
- A separate database and file folder for every customer; no data shared between customers.
- Encryption in transit (HTTPS) and encryption of off-site backups before they leave the server.
- Access control with roles; mandatory two-step verification for administrators.
- Logs of sign-ins, changes (audit trail) and administrative actions, retained for at least one year.
- Daily backups with an encrypted off-site copy, and the ability to restore.
5. Sub-processors
Provider uses the following service providers, each bound by written security and confidentiality obligations: hosting, encrypted backup storage and payment processing providers. Provider will give notice of changes to this list.
6. Personal data breach
Provider will inform the Customer without delay after becoming aware of a breach affecting Customer data, with what is known of its nature, extent, timing, likely impact and the steps taken — so that the Customer can inform the affected people and the Data Protection Board (including the detailed report within 72 hours). Provider keeps a register of incidents and cooperates with the Customer's investigation.
7. Helping the Customer
Provider gives the Customer the tools to access, correct, export and erase data so that the Customer can answer requests from the people concerned, and will otherwise assist on request.
8. Return and erasure
The Customer can download a complete backup at any time. When the account is closed and erasure is requested, Provider deletes the Customer's database and files from the live service, and encrypted backup copies are removed as they expire (within 90 days), except where the law requires retention (for example payment records and security logs, kept for at least one year).
9. Government requests
If an authority asks Provider for Customer data, Provider will, where legally allowed, tell the Customer and disclose only what is legally required.
10. Information
Provider will make available the information reasonably needed to show compliance with this agreement. Contact: Deepti Shahi — deepti.gangotri@gmail.com, 8859888812.