GGMBQrcodePartner program
Log inBecome a partner
All partner documents

GMBQrcode white-label partner program

Data Processing Addendum

Version
1.0
Effective

How your end customers' personal data is handled under India's Digital Personal Data Protection Act, 2023: you are the Data Fiduciary and Xscade is your Data Processor. It covers sub-processors, security measures, breach notification, processing outside India, and export and deletion after termination.

This document forms part of your agreement with Xscade Technologies Private Limited.

This Data Processing Addendum (the "DPA") forms part of the Agreement between you and Xscade Technologies Private Limited ("Xscade", "we", "us" or "our"). Capitalised terms that are not defined here have the meanings given in the White-Label Reseller Agreement (the "Reseller Agreement").

1. Scope and purpose

1.1 Scope. This DPA applies to Personal Data in End-Customer Data that we process on your behalf in providing the Service under the Agreement.

1.2 Purpose. The parties intend this DPA to be the contract under which you, as Data Fiduciary, engage us as your Data Processor, as the DPDP Act requires.

2. Definitions

  • "DPDP Act" means the Digital Personal Data Protection Act, 2023 and the rules made under it, as in force from time to time.
  • "Data Protection Law" means the DPDP Act, the Information Technology Act, 2000 and the rules made under it to the extent applicable, and any other law on the protection of personal data that applies to the processing of End-Customer Data.
  • "Personal Data", "Data Fiduciary", "Data Processor", "Data Principal", "Personal Data Breach", "processing" and "Board" have the meanings given in the DPDP Act. Where another Data Protection Law applies, they include the equivalent terms in that law (such as "controller", "processor" and "data subject").
  • "End-Customer Data" means all data, including Personal Data, that End Customers, their users or Reviewers submit to the Partner Site or the Service, that is generated through their use of it (including AI output), or that the Service obtains on an End Customer's behalf, such as data from an End Customer's Google Business Profile and the status of its subscription in your Connected Razorpay Account. It does not include Partner Account Data.
  • "Partner Account Data" means Personal Data about you and your personnel, such as owner and contact details and records of your acceptance of the Partner Documents, and records of Commission, Commission Invoices and payments between you and us.
  • "Export Window" means the period of 30 days after the Agreement ends.
  • "Sub-processor" means a third party we engage to process End-Customer Data on your behalf.

3. Roles of the parties

3.1 You are the Data Fiduciary. As between you and us, you are the Data Fiduciary for End-Customer Data and we are your Data Processor. You determine the purposes and means of processing through your Customer-Facing Terms and through the way you and your End Customers configure and use the Service.

3.2 End Customers' own data. Some End-Customer Data is Personal Data for which an End Customer is itself responsible, for example the details of its own customers who use its review pages, or of its employees enrolled in staff features. You are responsible for your arrangements with End Customers for that data, and we process it on your instructions as your processor.

3.3 Where we act for ourselves. We are an independent Data Fiduciary for Partner Account Data. We also process limited End-Customer Data for our own purposes where this is necessary to: (a) calculate and reconcile Commission; (b) keep the Platform secure, prevent fraud and abuse and enforce the AUP; (c) comply with law and with lawful requests of authorities; and (d) establish, exercise or defend legal claims. We handle that processing in accordance with Data Protection Law.

3.4 Continuity after termination. Where, under clause 16.1(g) of the Reseller Agreement, an End Customer chooses to continue using the Service directly with us or through another partner after the Agreement ends, you instruct and authorise us to continue processing the End-Customer Data relating to that End Customer for that purpose. From then on, that data is processed under our arrangements with that End Customer or that partner, and not on your behalf.

4. Your obligations

4.1 Lawful processing. You are responsible for ensuring that the processing of End-Customer Data through the Service is lawful, including that a valid basis (consent or a legitimate use permitted by the DPDP Act) exists and that the notices the DPDP Act requires have been given to Data Principals. The template privacy policy published on the Partner Site is a starting point that you must review and adapt as needed.

4.2 Instructions. Your instructions must comply with Data Protection Law. The Agreement, the configuration of the Service by you and by End Customers, and any further written instructions we agree with you, are your complete instructions to us.

4.3 Contact and grievances. You must publish the business contact information of a person who can answer Data Principals' questions about the processing of their Personal Data, and operate a grievance redressal mechanism, as the DPDP Act requires. The template privacy policy shows your support email address for this purpose.

4.4 Children. The Service is designed for businesses and is not directed at children. You must not, and must ensure that End Customers do not, use the Service to knowingly process Personal Data of children (individuals under 18) except in compliance with the DPDP Act.

4.5 Data minimisation. You must not instruct us to process Personal Data that is not necessary for the Service, and must ensure that End Customers do not use review pages, feedback forms or staff features to collect sensitive Personal Data.

4.6 Significant Data Fiduciary. If you are notified as a Significant Data Fiduciary under the DPDP Act, you must tell us. Any assistance you then need from us to meet your additional obligations will be provided under clause 5.6.

5. Our obligations

5.1 Processing on instructions. We will process End-Customer Data only on your instructions under clause 4.2 and to provide the Service, unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits this. We will tell you if we believe an instruction breaches Data Protection Law, and we may suspend the affected processing until the instruction is confirmed or changed.

5.2 Purpose limitation. We will not sell End-Customer Data, use it to market our own products or services to End Customers, or use it to train or fine-tune AI models.

5.3 Confidentiality. We will ensure that our personnel who have access to End-Customer Data are bound by appropriate obligations of confidentiality.

5.4 Security. We will implement reasonable security safeguards to protect End-Customer Data and to prevent Personal Data Breaches, including the measures in Schedule 2. We may update those measures, provided that the overall level of protection is not materially reduced.

5.5 Sub-processors. We will engage Sub-processors only as set out in clause 6.

5.6 Assistance. Taking into account the nature of the processing, we will give you reasonable assistance, through the functionality of the Service or otherwise, so that you can respond to Data Principals exercising their rights (including access to information, correction, completion, updating and erasure, grievance redressal and nomination), meet your security and breach notification obligations, and carry out any assessment or audit that the DPDP Act requires of you. We may charge you our reasonable costs for assistance that goes beyond the standard functionality of the Service.

5.7 Requests we receive directly. If we receive a request from a Data Principal about End-Customer Data, we will forward it to you promptly where we can identify you as the relevant Partner. We will not respond to it ourselves, other than to acknowledge it and direct the Data Principal to you, unless the law requires us to.

5.8 Requests from authorities. If an authority asks us to disclose End-Customer Data, we will tell you before disclosing it, unless the law prohibits this, and we will disclose only what we are legally required to disclose.

6. Sub-processors

6.1 Authorisation. You authorise us to engage the Sub-processors listed in Schedule 3, and further Sub-processors in accordance with clause 6.3.

6.2 Our responsibility. We will engage each Sub-processor on written terms that require it to protect End-Customer Data in a manner appropriate to the processing it performs, and we remain responsible to you for the performance of our Sub-processors under the Agreement.

6.3 New Sub-processors. We will tell you, by email or in the Partner Panel, at least 15 days before we engage a new Sub-processor. Where we must replace a Sub-processor urgently to keep the Service secure or available, we will tell you as soon as practicable afterwards.

6.4 Objections. You may object to a new Sub-processor on reasonable data protection grounds by telling us within that 15-day period. We will discuss your objection in good faith. If we cannot resolve it, you may terminate the Agreement by notice to us, with effect from the date stated in your notice, without having to give the notice period required by clause 15.2 of the Reseller Agreement.

7. Processing outside India

7.1 Locations. End-Customer Data may be processed outside India by us and by our Sub-processors, including in the locations described in Schedule 3.

7.2 Restricted countries. We will not transfer End-Customer Data to any country or territory to which the Central Government of India has restricted transfers under the DPDP Act, and we will comply with any conditions that apply to such transfers.

7.3 Other laws. If another Data Protection Law applies to End-Customer Data (for example, because some of your End Customers are outside India), you must tell us, and you are responsible for any transfer mechanism that law requires. We will cooperate reasonably with you.

8. Personal Data Breach

8.1 Notice to you. We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting End-Customer Data.

8.2 Content of the notice. Our notice will describe, as far as then known: the nature, extent, timing and location of the breach; the categories and approximate number of Data Principals and records affected; its likely consequences; the measures taken or proposed to contain and mitigate it; and a contact person. We will provide further information as it becomes available.

8.3 Containment. We will take reasonable steps to contain, investigate and mitigate the breach, and will preserve relevant information.

8.4 Notifying the Board and Data Principals. As the Data Fiduciary, you are responsible for informing the Board and affected Data Principals as the DPDP Act requires, and we will give you the information and assistance you reasonably need to do so. We will not notify End Customers or Data Principals directly about a breach affecting End-Customer Data unless you ask us to, the law requires us to, or it is necessary to protect them from imminent harm. Where we do, we will do so under the Partner Brand where practicable.

8.5 CERT-In. We will report cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) where directions issued under the Information Technology Act, 2000 require us to. Such reports do not need your consent.

8.6 No admission. Our notification of a Personal Data Breach is not an admission of fault or liability.

9. Retention, export and deletion

9.1 During the Term. We retain End-Customer Data for as long as needed to provide the Service. When an End Customer deletes its account or particular data through the Service, we delete it in line with our standard processes.

9.2 Export. During the Export Window, you may ask us by email to info@xscade.com for an export of End-Customer Data in a structured, commonly used, machine-readable format. We will provide it within a reasonable time, normally within 15 days of your request.

9.3 Deletion. Within 30 days after the end of the Export Window, we will delete End-Customer Data, except:

  • (a) data we must retain to comply with law;
  • (b) data relating to an End Customer that continues to use the Service under clause 3.4;
  • (c) copies held in backups, which are deleted or overwritten in the ordinary course of our backup cycle and remain protected by this DPA until then; and
  • (d) aggregated and anonymised information that does not identify any individual.

9.4 Partner Account Data. We retain Partner Account Data for as long as we need it to meet our legal, tax and accounting obligations and to resolve disputes, and then delete it.

9.5 Confirmation. On request, we will confirm in writing that deletion under clause 9.3 has been completed.

10. Information and audits

10.1 Information. On written request, no more than once in any 12-month period (unless a regulator requires it or a Personal Data Breach has occurred), we will give you the information reasonably necessary to demonstrate our compliance with this DPA, such as written answers to a reasonable security questionnaire and a summary of our security measures.

10.2 Audits. We will allow an on-site audit only where the law or a competent authority requires it. Any such audit must be on reasonable written notice, during business hours, carried out by an auditor bound by confidentiality, conducted so as not to disrupt our operations unreasonably, and at your cost.

11. Liability, duration and precedence

11.1 Liability. Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in clause 14 of the Reseller Agreement.

11.2 Duration. This DPA applies for as long as we process End-Customer Data on your behalf, including after the Agreement ends.

11.3 Precedence. If this DPA conflicts with another Partner Document, the order of precedence in clause 19 of the Reseller Agreement applies.

Schedule 1: Details of the processing

Subject matter and duration. The provision of the Service under the Agreement, for the Term and until deletion under clause 9.

Nature and purpose. Hosting, storing, organising, retrieving, transmitting, analysing and generating content from End-Customer Data in order to provide the Service, including:

  • creating and managing End-Customer accounts and authenticating users;
  • review pages and QR codes, including AI-assisted review drafting;
  • collecting private feedback and routing Reviewers;
  • retrieving reviews and profile data from Google Business Profile, and publishing replies and posts at an End Customer's direction;
  • generating replies, posts and analysis with AI models;
  • ranking and profile analysis;
  • staff review-reward tracking;
  • managing subscriptions through your Connected Razorpay Account; and
  • support, security and troubleshooting.

Categories of Data Principals.

  • Owners, employees and other authorised users of End Customers.
  • Reviewers.
  • Individuals who have posted Google reviews about End Customers.
  • Employees of End Customers enrolled in staff features.

Categories of Personal Data.

  • Identity and contact data, such as names, email addresses and phone numbers.
  • Account and authentication data, such as login identifiers and authorisation tokens for Google Business Profile access.
  • Business data, such as business names, addresses, categories, services and Business Profile content, posts and performance data.
  • Review and feedback data, such as ratings, selected services, feedback text, review drafts, Google reviews with the reviewer's public name and profile details, and replies.
  • Staff data, such as employee names, phone numbers and the number of reviews attributed to them.
  • Subscription data, such as plan, status, amounts, dates and Razorpay subscription and payment identifiers. Card, UPI and bank account details are collected by Razorpay and are not received by us.
  • Technical data, such as IP addresses, device and browser information, logs and cookie data.

Sensitive data. The Service is not intended for processing sensitive Personal Data, such as health, financial, biometric or government identity information.

Frequency. Continuous, for as long as the Service is used.

Schedule 2: Security measures

As at the effective date of this DPA, we maintain the following measures:

  • Encryption in transit. The Partner Site, the Partner Panel and our APIs are served over HTTPS (TLS).
  • Encryption at rest. End-Customer Data is stored with managed cloud providers that encrypt stored data at rest. In addition, your Razorpay API key secret and webhook secret are encrypted at the application level using AES-256-GCM, with a key derived from a secret held outside the database, and are decrypted only in memory when needed for a Razorpay API call.
  • Payment data. Card, UPI and bank account details for End-Customer Payments are entered into Razorpay's checkout and are never received or stored by us.
  • Authentication. Partner Panel passwords are stored only as salted scrypt hashes, and Partner Panel sessions use signed, httpOnly cookies. End Customers sign in through Firebase Authentication. Access to Google Business Profiles uses Google's OAuth authorisation, which the End Customer can revoke at any time.
  • Access control. Administrative access to the Platform is restricted to authorised personnel on a need-to-know basis. Each End-Customer account is linked to a single partner, and the Partner Panel shows you only data relating to your own Partner account.
  • Personnel. Personnel with access to End-Customer Data are bound by confidentiality obligations.
  • Sub-processors. We use established infrastructure and service providers and engage them on written terms under clause 6.2.
  • Monitoring and incident response. We log application errors and security-relevant events, and we follow the breach response process in clause 8.
  • Maintenance. We keep software dependencies and infrastructure up to date and address vulnerabilities according to their severity.

Schedule 3: Sub-processors

  • Google Cloud (Google LLC and its affiliates): cloud computing, background processing and file storage.
  • Vercel (Vercel Inc.): hosting and delivery of the Partner Site, the Partner Panel and our APIs.
  • MongoDB Atlas (MongoDB, Inc.): managed database hosting.
  • Firebase Authentication (Google LLC): End-Customer sign-in and authentication.
  • OpenAI: AI text generation and analysis.
  • Google Gemini (Google LLC): AI text generation and analysis.
  • DeepSeek: AI text generation.
  • Razorpay (Razorpay Software Private Limited): payment processing. For End-Customer Payments, Razorpay provides your Connected Razorpay Account to you under your own agreement with Razorpay, and we access it on your instructions under clause 4.6 of the Reseller Agreement. Razorpay also processes your Commission payments to us.

Locations. Processing may take place in India, the United States and other countries where these providers or their facilities are located. DeepSeek has stated that it stores data on servers located in the People's Republic of China.

Google services used at an End Customer's direction. When an End Customer connects its Google Business Profile, Google receives and provides data (such as replies and posts the End Customer publishes) under the End Customer's own agreement with Google. Google does not act as our Sub-processor for that purpose.

Other partner documents