This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Customer", the data controller) and EWARDS ENGAGEMENT PRIVATE LIMITED, 46 C, Chowringhee Road, 10th Floor, Room No. 10A/1, Middleton Row, Kolkata, West Bengal – 700071, India ("we", the data processor), for the AurDesk service. It applies to personal data we process on the Customer's behalf and reflects the Digital Personal Data Protection Act, 2023 and, where applicable, the GDPR.
1. Scope and instructions
We process personal data in tickets, customer records, attachments and messages (email, portal, WhatsApp) only to provide and support the service and on the Customer's documented instructions, which are the agreement, its settings and its use of the product. We will tell the Customer if we believe an instruction breaks the law.
2. Customer responsibilities
The Customer decides what personal data to place in the service, has a lawful basis for it, and gives any required notices and obtains any required consent, including opt-in for business-initiated messages.
3. Confidentiality and security
People who handle this data are bound by confidentiality. We apply the measures in our Security Overview, including encryption in transit and at rest, role-based access, tenant isolation, session controls and audit logging.
4. Sub-processors
The Customer authorises the use of sub-processors for hosting, email, messaging (including the WhatsApp Business Platform and our messaging provider), push notifications and, where the Customer enables them, AI providers. We bind each sub-processor to data-protection terms and stay responsible for them. The current list is available on request, and we will give notice of material changes so the Customer can object.
5. International transfers
Where personal data is processed outside India, or outside the Customer's own country, we use contractual safeguards required by applicable law.
6. Data-subject requests
We will pass on to the Customer any request we receive from an individual about data we process for the Customer, and give reasonable help so the Customer can respond within legal time limits.
7. Personal-data breaches
We will notify the Customer without undue delay after becoming aware of a breach affecting its personal data, with the information we have to help the Customer meet its legal duties.
8. Return and deletion
On termination the Customer may export its data for a reasonable period. We then delete it within 30 days, unless the law requires us to keep it. Retention rules the Customer configures apply during the term.
9. Audits
We will provide information reasonably needed to show compliance with this DPA, and allow reasonable audits, at the Customer's cost and with notice, no more than once a year unless a breach has occurred.
10. Contact
Privacy and DPA questions: support@aurdesk.com.