Data Processing Addendum

Last updated 2024-06-28

1. Roles

For the personal data you (the customer) enter about your own customers, suppliers and staff, you act as the Data Fiduciary/Controller and WhizzAct Private Limited acts as the Data Processor, processing such data only on your documented instructions to provide the service. For your own account data, WhizzAct Private Limited is the Data Fiduciary (see the Privacy Policy).

2. Scope & purpose

We process personal data contained in your books (e.g. party names, contact details, GSTIN/PAN) solely to provide, secure, maintain and support the accounting service, and as required by law.

3. Confidentiality

Personnel authorised to process the data are bound by confidentiality obligations.

4. Security

We maintain reasonable technical and organisational measures including encryption in transit, hashed credentials, role-based access, tenant isolation and an immutable audit trail.

5. Sub-processors

You authorise the sub-processors listed below. We remain responsible for their performance and will impose data-protection terms no less protective than this Addendum.

6. Data principal requests

We will assist you, taking into account the nature of processing, to respond to requests from data principals to access, correct or erase their data, via the in-app tools and support.

7. Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and cooperate as required (GDPR Art 33/34; DPDPA s.8(6)).

8. Return & deletion

On termination we delete or return personal data, except records we must retain by law (books of account for 8 years).

9. International transfers

Where data is processed outside its country of origin, we apply appropriate safeguards as required by applicable law.

Sub-processors

To request a signed copy of this Addendum or ask about our sub-processors, contact Grievance Officer at privacy@whizzact.com.

WhizzAct Private Limited · Mumbai, Maharashtra, India