Data processing agreement

This data processing agreement (“DPA”) is between you, the business that uses PrimoERP, and QalbIT Infotech Pvt Ltd (“we”), which makes and runs PrimoERP. It forms part of our terms of service and applies automatically when you accept them. You do not need to sign it, but we will countersign a copy if you ask.

It covers the personal data that you and your users put into PrimoERP, or that we handle for you while we set up or support your account. For that data, you decide why and how it is used: you are the Data Fiduciary (India) or controller (EU, UK and UAE). We process it for you: we are your Data Processor or processor. If you are yourself a processor for someone else, we are your sub-processor, and you pass on their instructions.

It does not cover personal data we handle for our own purposes, such as the contact and billing details of your administrators, your requests to our support team, or visits to our website. We are responsible for that data ourselves, and our privacy policy explains how we use it.

India’s Digital Personal Data Protection Act, 2023 says that a Data Fiduciary may use a Data Processor only under a valid contract. This DPA is that contract. It also meets Article 28 of the EU GDPR and the UK GDPR, for customers who process the personal data of people in those places. Where a law’s duties come into force in stages, such as the DPDP Rules, 2025, this DPA applies them as they do.

Words defined in our terms of service have the same meaning here. In this DPA, each term below includes the matching terms used by the data protection laws that apply to you:

• “Data protection law” means the laws on personal data that apply to the processing: India’s Digital Personal Data Protection Act, 2023 and its rules, and until they fully replace it, section 43A of the Information Technology Act, 2000 and its rules; the UAE’s Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; and the EU GDPR and UK GDPR where they apply.
• “Personal data” means any data about a person who can be identified from it, or with other data.
• “Customer personal data” means the personal data this DPA covers (see “Scope and parties”).
• “Data Fiduciary” and “controller” mean the party that decides why and how personal data is processed: you.
• “Data Processor” and “processor” mean the party that processes personal data on the controller’s behalf: us.
• “Data Principal” and “data subject” mean the person the personal data is about.
• “Personal data breach” means any unauthorised processing of personal data, or accidental or unlawful loss, destruction, change or disclosure of it, or access to it, that compromises its confidentiality, integrity or availability.
• “Sub-processor” means a company we engage to process customer personal data for us.
• “Board” means the Data Protection Board of India; “supervisory authority” means a data protection regulator elsewhere.
• “SCCs” means the EU standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914; “UK Addendum” means the UK Information Commissioner’s International Data Transfer Addendum to them.

We process customer personal data only on your documented instructions. Your instructions are our terms of service and this DPA, your order, the way you and your users set up and use PrimoERP, and any other written instruction you give us that we agree is within the service. This includes instructions about transfers abroad.

We do not use customer personal data for our own purposes, sell it, or use it for advertising. If the law requires us to process it in another way, we tell you before we do, unless the law forbids that.

If we believe an instruction breaks data protection law, we tell you straight away, and we may pause that processing until you confirm or change the instruction.

If an authority asks us for customer personal data, we refer it to you where we can, tell you about the request unless the law forbids it, and disclose only what we are legally required to.

The details of the processing:

• Subject matter: hosting PrimoERP for you and providing it to your users, with onboarding, support and the related services in your order.
• Nature: collecting, recording, organising, storing, retrieving, using, sending, exporting, backing up, restoring and erasing personal data, as the service needs.
• Purpose: providing the service to you under our terms of service, keeping it secure, and meeting the law.
• Duration: for as long as your agreement is in force, then until the data is returned and deleted as “Return and deletion at the end” says.

You decide what you put into PrimoERP, so the personal data depends on the modules you use. Typically it concerns these groups of people:

• Your users: name, work email, role, sign-in and security records (such as login attempts and the devices and network addresses used), and their actions in the audit trail.
• Your customers, suppliers and their contact people: names, contact details, addresses, tax registration numbers (such as GSTIN, PAN or TRN), bank details for payments, and the transactions with them.
• Your employees and contractors, if you use HR and payroll: identity and contact details, date of birth, gender, nationality, job and employment details, attendance and leave, salary, deductions and bank details, statutory identifiers, and, for the UAE, identity, passport and visa details.
• Anyone else whose details you choose to record, for example in notes or attachments.

Only people who need customer personal data to provide, support or secure the service can reach it, and only as far as they need to. Each of them has agreed in writing to keep it confidential, or is under a legal duty of confidentiality, and that duty continues after they leave us.

We train our people on data protection and security when they join and at least once a year, and we remove their access as soon as they no longer need it.

We take technical and organisational measures that are appropriate to the risk, so that customer personal data stays confidential, accurate and available. They include at least the safeguards listed in Rule 6 of India’s DPDP Rules, 2025 and Article 32 of the GDPR. Our security page describes them in plain words and forms Annex 2 of this DPA. In short:

• each customer’s data is kept apart from every other customer’s, in the application and again in the database;
• data is encrypted in transit and at rest, and personal data fields have encryption keys of their own;
• access is denied unless it has been granted, and you control your users’ roles and permissions, with two-step sign-in on every plan and single sign-on on Enterprise;
• access and changes are logged, monitored and reviewed, and the logs are kept for at least a year;
• data is backed up continuously, and restores are tested;
• our own access to your data is limited, needs a recorded reason, and appears in your audit trail.

You give us general permission to use sub-processors to provide the service. Annex 3 lists the sub-processors we use today.

If one of our implementation partners delivers an onboarding package we have sold you, that partner is our sub-processor for that work. If you hire a partner yourself, under your own contract, the partner works for you and is not our sub-processor.

We bind each sub-processor by a written contract to data protection duties at least as protective as this DPA, including on security. We stay responsible to you for what our sub-processors do.

We tell you by email at least 30 days before a new sub-processor starts processing customer personal data, or before we replace one. You may object within 15 days of our notice, on reasonable grounds about data protection. We then work with you in good faith to find a solution. If we cannot, you may end the affected part of the service, and we refund the fees you paid for the time left.

Your data is stored in one region, set when your account is created, and it does not move to another country, even for disaster recovery. For customers in India, that region is an Amazon Web Services (AWS) region in India. Our team works from India, so they may reach customer personal data from India when they support you.

India’s DPDP Act allows personal data to go abroad except to countries the Government restricts by notification. We will not transfer customer personal data to such a country.

If the EU or UK GDPR applies to your processing, the transfer to us in India is a transfer to a country without an adequacy decision. For it, the SCCs apply and are part of this DPA: Module 2 where you are a controller, Module 3 where you are a processor. You are the data exporter and we are the data importer. Clause 7 (docking) applies. Under Clause 9, option 2 (general written authorisation) applies, with the notice period in “Sub-processors”. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the SCCs are governed by Irish law, and disputes go to the courts of Ireland. Annex I of the SCCs is filled in by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by Annex 3.

For transfers from the UK, the UK Addendum applies and amends the SCCs as it says. If the SCCs and this DPA differ, the SCCs win.

People have rights over their personal data, such as the rights to know about it, to correct it, to have it erased and to complain. PrimoERP gives you the tools to deal with most requests yourself: you can find a person’s records, correct them, export them and erase them. Erasing a person destroys the encryption key for their personal data fields, so those fields can no longer be read anywhere, including in backups.

Some records cannot be erased while the law requires them to be kept, such as ledger and payroll records. PrimoERP keeps them, and you can tell the person why.

If a person sends a request about customer personal data to us, we pass it to you without delay and do not answer it ourselves, unless you ask us to.

We also help you, as far as the nature of the processing and the information we hold allow, with your security duties, with personal data breaches, with data protection impact assessments, and with questions from the Board or a supervisory authority. If the help you need goes beyond what the service and our normal support provide, we may charge for it at reasonable rates, which we agree with you first.

If we become aware of a personal data breach that affects customer personal data, we tell you without undue delay, and in any case within 24 hours. Under India’s DPDP Rules you must inform the Board without delay and give it a full report within 72 hours, so we tell you early, even before we know everything, and add the rest as we learn it.

Our notice goes to your administrators by email and phone, and says, as far as we know at the time:

• what happened, when, and how we found out;
• the kinds of personal data and the groups of people affected, and roughly how many;
• the likely consequences;
• what we have done and will do to contain it, reduce harm and stop it happening again;
• what you or the affected people can do to protect themselves;
• who at PrimoERP you can contact for more information.

You can export customer personal data at any time while your agreement is in force. When it ends, your account first stays open read-only, so that you can check and export everything.

For 90 days after your agreement ends, you can ask us for a complete export of your data: each kind of record as CSV or JSON files, documents and attachments as the original files, and your audit trail. After those 90 days we delete customer personal data. Encryption keys are destroyed first, so that the deleted data cannot be read again even if a backup is restored. We keep a report of what was deleted and what was kept, and give you a copy on request.

We keep only what the law requires to be kept, for as long as it requires. Records such as ledgers and payroll, which the law requires to be kept for a set period, are moved to a separate archive that nobody can sign in to, and deleted when that period ends. Logs of the processing are kept for at least one year, as the DPDP Rules require, and then deleted. Anything under a legal hold is kept until the hold ends. Everything we keep stays protected by this DPA.

Copies in our backups expire on the backup cycle described on our security page.

We give you the information you reasonably need to show that we meet this DPA: our security page, answers to reasonable security questionnaires, and summaries of independent tests and audits once we have them.

If that is not enough, or a regulator requires it, you may audit our compliance once in any 12 months, yourself or through an independent auditor who is bound by confidentiality and is not our competitor. Give us at least 30 days’ written notice and a plan of what the audit will cover. Audits take place in working hours, without disrupting our service or putting other customers’ data at risk. Each of us pays its own costs.

You may audit more often, at shorter notice, after a personal data breach that affects you, or when a regulator orders it.

Each party’s liability under this DPA is subject to the limits in our terms of service, and counts towards them; they are one combined limit, not a second one. Nothing in this DPA limits any right a person has under data protection law, or anything the SCCs do not allow to be limited.

If documents differ on personal data, they apply in this order: the SCCs or the UK Addendum, where they apply; then this DPA; then our terms of service and your order.

This DPA lasts as long as we process customer personal data for you, including after your agreement ends. We may update it as the terms of service allow, and only to keep it in line with the law, to add protections, or to reflect a change you have been told about, never to lower the protection it gives.

These annexes form part of this DPA, and fill in the annexes of the SCCs where those apply:

• Annex 1, details of the processing: the parties are you (Data Fiduciary or controller, data exporter) and QalbIT Infotech Pvt Ltd (Data Processor or processor, data importer). The people, kinds of personal data, nature, purpose and duration are in “Processing on your instructions” and “Personal data and people concerned”. The processing is continuous while the agreement is in force. Retention and deletion are in “Return and deletion at the end”.
• Annex 2, technical and organisational measures: our security page, as it stands at the time.
• Annex 3, sub-processors: Amazon Web Services (AWS): cloud hosting, storage, backups and encryption keys, in India. We add any other sub-processor to this list, with the notice above, before it handles your data.

For any question about this DPA, to ask for a signed copy, or to tell us about a request from someone whose data you hold, write to our privacy officer at the address below. We reply within 2 working days. For anything else about your account, write to [email protected].

Privacy officer: Afzal Ali
Email: [email protected]