This Data Processing Agreement ("DPA") is entered into between:

1. Definitions

• "DPDP Act" means the Digital Personal Data Protection Act, 2023 and its Rules, 2025.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Processing" means any operation performed on Personal Data.
• "Data Principal" means the individual to whom the Personal Data relates (your client).

2. Scope of Processing

We process Personal Data only to provide the CA Saathi Service, which includes:

• Client management (name, GSTIN, PAN, phone, email, address).
• Document storage and management.
• GST reconciliation and reporting.
• Invoice generation, tracking, and collection.
• Compliance calendar and reminders.
• UDIN tracking.
• WhatsApp and email communication.
• Reports and analytics.

3. Duration of Processing

We process Personal Data for as long as you maintain an active CA Saathi account. Upon termination, we delete Personal Data within 30 days, except where retention is required by law.

4. Our Obligations as Data Processor

• Process Personal Data only on your documented instructions.
• Implement appropriate technical and organisational security measures.
• Ensure our personnel who process Personal Data are bound by confidentiality.
• Assist you in responding to Data Principal rights requests.
• Notify you without undue delay of any Personal Data breach.
• Delete or return Personal Data at the end of the agreement.
• Provide reasonable audit information to demonstrate compliance.

5. Security Measures

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access controls.
• Secure authentication via Supabase Auth.
• Regular security reviews.
• Data backups.

6. Sub-Processors

We use the following sub-processors. We remain fully liable for their performance:

• Supabase — database, authentication, storage
• Razorpay — payment processing
• OpenAI — AI reconciliation
• Firebase / Google — hosting
• Meta / WhatsApp — message delivery

7. Breach Notification

In the event of a Personal Data breach, we will:

• Notify you within 48 hours of becoming aware of the breach.
• Provide details of the nature of the breach, likely consequences, and measures taken.
• Assist you in notifying the Data Protection Board of India and affected Data Principals.

8. Your Obligations as Data Fiduciary

• Obtain valid consent from your clients before entering their data into CA Saathi.
• Inform your clients about how their data will be used.
• Respond to your clients' Data Principal rights requests.
• Use the Service only for lawful purposes.

9. Data Principal Rights

We will assist you in responding to your clients' requests to:

• Access their Personal Data
• Correct inaccurate Personal Data
• Erase their Personal Data
• Withdraw consent
• Nominate a person to exercise their rights

10. Termination

On termination of this DPA:

• We will delete all Personal Data within 30 days, unless retention is required by law.
• We will provide a certificate of deletion on request.

11. Governing Law

This DPA is governed by the laws of India. Any disputes will be subject to the exclusive jurisdiction of the courts in Jharkhand, India.

12. Signatures

By signing below, both parties agree to the terms of this Data Processing Agreement.

13. Contact

← Back to home