Effective date: [[EFFECTIVE DATE]]
These Data Processing Terms (the "DPA") form part of the Terms of Service between the merchant ("Merchant", "you") and [[COMPANY NAME]] ([[COMPANY REGISTRATION DETAILS]]), registered office [[REGISTERED ADDRESS]] ("Grind Shop", "we"). They apply to the personal data that we process for you when your shoppers and customers use your store, and replace nothing in the Privacy Policy, which covers the data we handle for our own purposes.
1. Roles
- You are the Data Fiduciary: you decide why and how the personal data of your shoppers and customers is processed.
- Grind Shop is your Data Processor: we process it on your behalf, only to provide the Service.
- Words such as "personal data", "Data Principal", "processing" and "personal data breach" have the meaning they have in the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and its rules.
2. What we process, and for how long
Annex A describes the data, the people it relates to, the purposes and the duration. We process it for as long as your account is open, and then as section 11 says.
3. Your responsibilities
You are responsible for:
- having a lawful ground for the data you collect, and giving your shoppers the notice and obtaining the consent the DPDP Act requires, including for marketing messages;
- the accuracy of the data and the instructions you give us;
- answering the requests and complaints of your shoppers and customers;
- telling the Data Protection Board of India and the affected people about a personal data breach, as the law requires of a Data Fiduciary;
- the apps and services you connect to your store (see section 7).
4. What we do
We will:
- process personal data only on your documented instructions, which are these terms and your use of the Service, and for no purpose of our own, except where the law requires otherwise (we will tell you first if we can);
- make sure that people who can access the data are bound by confidentiality;
- keep the security measures in Annex B;
- help you to answer requests of Data Principals, as section 9 says;
- tell you about a personal data breach, as section 8 says;
- give you the information you reasonably need to show that you comply with this DPA;
- delete or return the data at the end, as section 11 says.
5. Security
We protect personal data with technical and organisational measures that fit the risk, listed in Annex B. We may change them as long as the level of protection does not fall.
6. Confidentiality and access
We allow our personnel to access merchant data only as far as they need it to run, support or secure the Service. We do not look at your store's customer data except to provide support you ask for, to keep the Service secure, to meet a legal duty, or to prevent or investigate abuse.
7. Sub-processors and apps you connect
- You agree that we may use sub-processors to provide the Service. Annex C lists them. We will tell you about a new sub-processor at least [[SUB-PROCESSOR NOTICE PERIOD]] before it starts to process your data, and you may object in writing on reasonable grounds.
- We bind every sub-processor to terms that protect personal data at least as well as this DPA, and we stay responsible to you for their work.
- Apps and services you connect are yours, not ours. If you connect a payment gateway, a courier, a messaging tool or any other app, data goes to it on your instruction. You are responsible for choosing it and for the contract with it. It is not our sub-processor.
8. Personal data breach
If we become aware of a personal data breach that affects data we process for you, we will tell you without undue delay and within [[BREACH NOTICE PERIOD]]. We will say what we know about what happened, the data and people affected, the likely effects and what we are doing, and we will update you as we learn more. We will help you with the information you need to inform the Data Protection Board of India and the affected people.
9. Requests from Data Principals
If a Data Principal contacts us about data we process for you, we will pass the request to you without undue delay and will not answer it ourselves unless you tell us to. We will help you to access, correct, complete, update or erase data. Where a tool for this is not yet available in the admin, we will do it for you on a written request, within [[DATA REQUEST RESPONSE PERIOD]].
10. Audits and information
On a written request, no more than once a year unless there has been a breach, we will give you reasonable information about how we meet this DPA. If that does not answer your questions, you may carry out an audit with reasonable notice, during business hours, subject to confidentiality, and at your cost.
11. End of the service
When your account ends you can ask for an export of your data within [[DATA EXPORT PERIOD]]. After that, we delete the personal data we process for you within [[DATA DELETION PERIOD]], and from backups when they are replaced, unless the law requires us to keep it. We then confirm the deletion if you ask.
12. Where data is processed
We process the data at [[HOSTING REGION]]. We transfer personal data outside India only where the DPDP Act and its rules allow it.
13. Liability and order of precedence
The limits of liability in the Terms of Service apply to this DPA. If this DPA and the Terms conflict about the processing of personal data, this DPA prevails.
14. Term and law
This DPA lasts as long as we process personal data for you. It is governed by the laws of India, and the courts named in the Terms have jurisdiction.
15. Contact
Questions about this DPA: see the Contact page. Complaints go to our grievance officer, whose details are in the Privacy Policy.
Annex A: details of the processing
| Item | Description |
|---|---|
| Subject matter | Running the Merchant's online store on Grind Shop |
| Data Principals | The Merchant's shoppers and customers; visitors to the store; recipients of order notifications |
| Categories of data | Name, mobile number, e-mail address, delivery and billing address and PIN code, order history, cart contents, order notes, marketing consent choices, IP address and device details of store visitors |
| Purposes | Showing the store, taking and recording orders, calculating tax and totals, sending order messages the Merchant asks for, keeping the Service secure and preventing abuse |
| Duration | As long as the Merchant's account is open, then as section 11 says |
| Special categories | None are intended. The Merchant must not collect sensitive data through the Service. |
Annex B: security measures
- Encrypted connections (HTTPS) between shoppers, merchants and the Service.
- Each store's data is kept apart from the data of other stores by the application and by row-level security in the database. The application connects to the database with a role that cannot bypass that security.
- Checkout runs on its own web address, separate from stores and the admin, with a strict content security policy and no third-party scripts.
- Merchant passwords are stored only as one-way hashes. Two-step verification is mandatory for store owners and admins.
- Gateway keys and integration secrets are stored encrypted.
- Limits on repeated sign-in attempts, protection against forged form submissions, and security headers on all pages.
- Access of our personnel to production systems is limited to what they need. [[ACCESS CONTROL AND LOGGING DETAILS]]
- Backups: [[BACKUP FREQUENCY AND RETENTION]].
Annex C: sub-processors
| Sub-processor | What it does | Location |
|---|---|---|
| [[HOSTING PROVIDER]] | Servers and storage for the Service | [[HOSTING REGION]] |
| [[EMAIL PROVIDER]] | Delivery of e-mail sent by the Service | [[EMAIL REGION]] |
| [[OTHER SUB-PROCESSORS]] | [[PURPOSE]] | [[LOCATION]] |