Data Processing Terms

# Data Processing Terms

Effective date: 2026-07-26

These Data Processing Terms ("DPT") describe the baseline responsibilities for processing customer data through the DFM Finance Control Centre application (the "Service").

This document is a commercial readiness draft and must be reviewed by qualified legal counsel before public launch or customer signature. A signed customer agreement may override or supplement these terms.

## 1. Roles

Unless otherwise stated in a signed agreement:

- Customer is the controller, data fiduciary, or business owner of customer data.
- Company acts as processor, data processor, service provider, or operator for customer data processed through the Service.
- Authorized users act under the customer organization.

## 2. Processing Subject Matter

The Service processes uploaded and generated finance, inventory, audit, MIS, support, and operational records for business automation, dashboarding, working-paper preparation, issue tracking, and related support.

## 3. Categories of Data

Customer data may include:

- Business finance and accounting data.
- Inventory, sales, purchase, GST, production, lease, ESOP, revenue reversal, and audit working data.
- User account and permission data.
- Support issue and developer note data.
- Operational logs and batch metadata.

Customer data may incidentally contain personal data if included in uploaded source files, such as names, emails, phone numbers, user IDs, employee records, supplier contacts, customer contacts, or invoice references.

## 4. Processing Instructions

Company will process customer data only:

- To provide, secure, maintain, support, and improve the Service.
- As instructed by the customer or authorized users through configuration, upload, calculation, export, and support workflows.
- As required by law or a signed agreement.

Company will not sell customer data.

## 5. Confidentiality

Company will restrict access to customer data to authorized personnel, developers, and service providers who need access for operation, support, security, or legal compliance and who are subject to confidentiality obligations.

## 6. Security Measures

The Service should be operated with appropriate administrative, technical, and organizational safeguards, including:

- User authentication and password hashing.
- Admin-controlled permissions.
- Client/tenant access restrictions where configured.
- CSRF protection and security headers.
- Audit logging of sensitive actions.
- ZIP upload validation against unsafe paths, file count, size, and suspicious compression.
- File type validation before supported processing.
- Production HTTPS and secure cookies.
- Backups, monitoring, and incident response controls appropriate to the deployment.

## 7. Subprocessors and External Services

Subprocessors may include hosting providers, storage providers, backup providers, support tools, email providers, AI providers, and infrastructure services approved for the deployment.

Hosted AI, hosted embeddings, Google Routes API, or similar external services must not be enabled silently. Known optional integrations and what they send:

- OpenAI limited question box (off by default): the user's typed question after PII redaction; optionally batch module status and row counts.
- Google Routes API (only when a Google Maps key is configured for Revenue Reversal distance checks): town/state names of dispatch and delivery locations.
- AWS KMS (production): no customer data; only encryption keys are generated and unwrapped for ERP credentials and backups.
- Customer ERP (Frappe/ERPNext): report requests with the selected filters, authenticated with the customer's own API key.

Before enabling any other service, the operator must document:

- Provider name.
- Purpose.
- Data sent.
- Retention and training policy.
- Region or transfer basis where relevant.
- Customer approval requirements.

## 8. AI and RAG Controls

Where RAG, local LLM, hosted LLM, or embeddings are used:

- Customer data must be isolated by tenant, owner, or customer scope.
- Retrieval must enforce database-level tenant filtering where vector search is used.
- Prompt injection protections should treat retrieved content as untrusted.
- Sensitive data should not be logged in plaintext.
- Deletion must remove both primary records and indexed/vector chunks where applicable.

## 9. Assistance With Rights Requests

Company will provide reasonable assistance for applicable access, correction, deletion, restriction, export, objection, or similar rights requests, taking into account the Service functionality and deployment model.

The customer is responsible for validating the requester and deciding whether the request is lawful and applicable.

## 10. Retention and Deletion

Retention should be defined in the customer agreement or deployment policy. Unless otherwise agreed, local deployments may retain uploaded files, generated exports, logs, MIS snapshots, cache records, and helpdesk issues until deleted by an authorized administrator or retention process.

On valid deletion request or termination, Company should delete or return customer data according to the applicable agreement, except where retention is required for legal, security, backup, audit, or dispute reasons.

## 11. Incident Notification

Company should notify the customer without undue delay after confirming a security incident involving customer data, subject to the information available at the time.

Notice should include, where reasonably available:

- Nature of the incident.
- Categories of affected data.
- Affected systems or customers.
- Mitigation steps taken.
- Recommended customer actions.

## 12. Audit and Compliance

Company should maintain reasonable records demonstrating security and processing controls. Customer audit rights, frequency, notice, confidentiality, and cost allocation must be defined in the signed customer agreement.

## 13. International Transfers

If customer data is processed across countries, the parties must ensure an appropriate transfer basis and contractual terms are in place for the relevant jurisdictions.

## 14. India Data Protection Addendum

Where Indian law applies, these India-specific terms are intended to support compliance with the Digital Personal Data Protection Act, 2023 and related rules/notices, and the Information Technology Act, 2000 including Section 43A and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 to the extent applicable.

### 14.1 India Roles

Unless a signed agreement states otherwise:

- Customer is the Data Fiduciary for personal data included in customer data.
- Company is the Data Processor for customer data processed through the Service.
- Authorized users act under the customer's authority.

### 14.2 Valid Contract and Instructions

Company will process Indian personal data under a valid contract and only for customer-instructed purposes connected with the Service, including finance automation, audit support, MIS reporting, access control, support, security, backup, and legal compliance.

### 14.3 Data Principal Rights and Grievances

Customer is responsible for managing Data Principal requests where the customer determines the purpose and means of processing. Company will provide reasonable technical assistance for access, correction, erasure, grievance, withdrawal, and nomination-related requests where supported by the Service and required under the customer agreement.

Each production deployment should define:

- Grievance Officer or privacy contact.
- Request verification process.
- Response timelines.
- Escalation process.

### 14.4 Security Safeguards

Company and customer should maintain reasonable security safeguards appropriate to the nature of the data, including access controls, authentication, audit logs, secure hosting, HTTPS, secure cookies, least-privilege administration, backup controls, incident response, and deletion controls.

### 14.5 Breach Handling

If a personal data breach involving Indian personal data is confirmed, Company and customer should coordinate to assess impact, preserve relevant logs, mitigate harm, and provide notices to the Data Protection Board of India and affected Data Principals where required by applicable law.

### 14.6 Retention and Erasure

Personal data should not be retained longer than necessary for the specified purpose unless retention is required for legal, accounting, tax, audit, backup, security, dispute, or contractual reasons. Where deletion is required, deletion should cover uploaded files, generated exports, primary records, caches, and indexed/vector records where applicable.

### 14.7 Cross-Border Processing

Cross-border hosting or support access must follow applicable Indian law, customer instructions, government restrictions if any, and the signed customer agreement.

## 15. Return or Deletion at End of Service

At the end of service, customer data should be returned or deleted according to the customer agreement. Backups may remain for a limited period under normal backup rotation, subject to protection and eventual deletion.

## 16. Contact

[Company Legal Name]

[Company Address]

Data processing contact: [privacy contact email]