Legal
Data processing addendum
Version 0.1 (draft) · Last updated
Draft. This text describes Setubandh as it runs today. It is a working draft and may change before it is final; the version and date above change with it.
This addendum forms part of the agreement between Setubandh Labs (“Setubandh Labs”, “we”) and the company that subscribes to Setubandh (the “company”, “you”) under the terms of service. It sets out how we process personal data in company data on your behalf, as your Data Processor under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025.
1. Roles
For personal data in company data, you are the Data Fiduciary: you decide why and how it is processed. We are your Data Processor: we process it only on your behalf, to provide Setubandh.
2. What we process
| Subject matter | Running Setubandh for you: hosting, storing, displaying, searching, exporting and sending company data as your users direct. |
|---|---|
| Duration | The term of the agreement, plus the export and deletion period in section 9. |
| People concerned | Your users; your customers' and their counterparties' contact people (shippers, consignees, notify parties, billing contacts); recipients of e-mails your users send through Setubandh; people who approve documents through a Setubandh link; anyone else whose details your users enter. |
| Kinds of personal data | Names, business e-mail addresses and phone numbers, job roles, postal addresses; names and signatures that appear in uploaded documents; approval records (typed name, time, IP address, browser); anything else your users enter. Setubandh is not designed for sensitive personal data, and you will not put it there unless shipments require it. |
3. Your instructions
We process company data only on your documented instructions. The agreement, your users' use of Setubandh and your settings in it are your instructions. If a law requires other processing, we tell you first unless that law forbids it. If we believe an instruction breaks the DPDP Act, we tell you.
4. Our people
Only people who need it to run Setubandh can reach the systems holding company data, and they are bound to confidentiality. Our staff do not read company data: if you want our help with it, you create a user for us, which you can remove at any time.
5. Security
We keep reasonable security safeguards to prevent a personal data breach, including those the DPDP Rules name: encryption, access control, logging and monitoring of access, and backups to keep the service running. They are described on the security page, which forms the annex to this addendum. We may improve them but will not reduce their overall level during the term.
6. Sub-processors
- You allow us to use the sub-processors listed in the privacy policy.
- Each sub-processor is bound by a written contract to protect data at least as well as this addendum requires.
- We tell your administrators by e-mail at least 30 days before we add or replace a sub-processor that handles company data. If you object on reasonable data-protection grounds, we will discuss it with you; if we cannot resolve it, you may end the affected service and receive a refund of prepaid fees for the unused period.
- We remain responsible to you for our sub-processors.
7. Personal data breaches
We tell you without undue delay, and in any case within 72 hours, of becoming aware of a personal data breach affecting company data, so that you can inform the people affected and the Data Protection Board of India as the DPDP Rules require (the Board within 72 hours). We give you what we know — what happened, when, which data and how many people, the likely consequences and what we have done — and add to it as we learn more. We take reasonable steps to contain the breach and stop it recurring.
8. Helping you
We help you, as far as reasonably possible, to:
- answer requests from people exercising their rights (access, correction, erasure, grievance, nomination) — and we pass any such request we receive to you;
- meet your security and breach duties; and
- answer questions from the Data Protection Board of India about our processing.
9. Return and deletion
When the agreement ends you can ask for an export of company data for 30 days. After that we delete company data from the live system; it leaves our routine backups as they expire (within about five weeks, and the pre-release backups after five further releases). We keep data longer only where an Indian law requires it, and then only for that purpose. On request we confirm the deletion in writing.
10. Location and transfers
Company data is stored in India (Amazon Web Services, Mumbai). It is processed outside India only as the privacy policy describes — chiefly when a user asks the assistant a question — and never to a country the Government of India restricts.
11. Information and audits
We give you the information reasonably needed to show that we meet this addendum, including answers to security questionnaires. Any further audit is by agreement, on reasonable notice, at your cost, and at most once a year unless a breach or a regulator requires it.
12. General
The limits of liability in the terms of service apply to this addendum. If this addendum conflicts with the terms, this addendum wins on data protection.