Data Processing Terms

1. Purpose and parties

These Data Processing Terms ("DPT") form part of the agreement between Qlooto Technologies, a sole proprietorship of Vaibhav Bhati, House No. 45, B Block, Sector P-3, Phase 3, Greater Noida, Uttar Pradesh 201310 (GSTIN 09AJPPB7916C3Z5) ("Qlooto", the "Processor") and the distributorship using DeskGas (the "Distributor", the "Fiduciary"). They apply to personal data of the Distributor's customers, credit customers, delivery men, staff and other individuals that the Distributor or its Users put into DeskGas ("Distributor Personal Data"), and set out the contract required by section 8(2) of the Digital Personal Data Protection Act, 2023 ("DPDP Act") between a Data Fiduciary and a Data Processor.

2. Roles

• The Distributor is the Data Fiduciary. It alone decides the purpose and means of processing Distributor Personal Data, and is responsible to the individuals concerned and to authorities for complying with the DPDP Act, the DPDP Rules and all other laws.
• Qlooto is the Data Processor. It processes Distributor Personal Data only to provide DeskGas and only on the Distributor's documented instructions. Use of DeskGas features by the Distributor's Users, and these Terms, are the Distributor's instructions.

3. The Distributor's responsibilities

• Give every notice and obtain and record every consent required by sections 5 and 6 of the DPDP Act before entering personal data in DeskGas or sending messages through it, including consent of customers to receive complaint updates by SMS or email.
• Process personal data only for lawful purposes connected with its distributorship, and keep it accurate, complete and limited to what is necessary.
• Honour the rights of individuals (access, correction, erasure, grievance, nomination) and respond to them within the legal timelines, using DeskGas features where possible.
• Not enter sensitive data that DeskGas is not designed for (see the Privacy Policy), or any data of children except where lawful and with any required parental consent.
• Control who has logins, deactivate leavers promptly, and keep passwords secure.
• Be solely responsible, and indemnify Qlooto, for any claim, penalty or loss arising from the Distributor's failure to meet these responsibilities, including any penalty imposed by the Data Protection Board of India.

4. Qlooto's responsibilities

• Process Distributor Personal Data only on the Distributor's instructions, unless the law requires otherwise (in which case Qlooto will tell the Distributor, if lawful).
• Ensure that persons authorised to process it are bound by confidentiality.
• Maintain the reasonable security safeguards described in the Privacy Policy, as required by section 8(5) of the DPDP Act and rule 8 of the SPDI Rules.
• Help the Distributor, to a reasonable extent and taking into account the nature of the processing, to respond to requests from individuals and to meet its obligations on security and breach notification.
• Not use Distributor Personal Data for its own purposes, except anonymised or aggregate data as the Terms allow, and except as required by law.

5. Sub-processors

The Distributor authorises Qlooto to use the service providers listed in the Privacy and Data Protection Policy as sub-processors. Qlooto may add or replace sub-processors by updating that list. Qlooto will engage sub-processors only on terms that require them to protect the data, and remains responsible for their performance as required by law, subject to the limits of liability in the Terms. If the Distributor reasonably objects to a new sub-processor on data-protection grounds, its only remedy is to end its subscription and receive a refund of the unused part of fees already paid.

6. Transfers outside India

The Distributor authorises processing and storage of Distributor Personal Data in India and in other countries where Qlooto's sub-processors operate, except countries restricted by the Central Government under section 16 of the DPDP Act.

7. Personal data breaches

Qlooto will notify the Distributor without undue delay after becoming aware of a personal data breach affecting Distributor Personal Data, with the information reasonably available, so that the Distributor can inform the Data Protection Board and affected individuals as section 8(6) of the DPDP Act and the DPDP Rules require. Qlooto will also make any report to CERT-In that it is itself required to make. Notification is not an admission of fault or liability.

8. Individuals' requests and authorities

If Qlooto receives a request from an individual about Distributor Personal Data, it will refer the person to the Distributor and, where possible, tell the Distributor. If an authority lawfully demands Distributor Personal Data, Qlooto may comply and will tell the Distributor where the law allows.

9. Return and deletion

At the end of the subscription the Distributor may export its data within 30 days. Qlooto will then delete or anonymise Distributor Personal Data within a further 60 days, and from backups as they roll off (at most 12 months later), except where the law requires Qlooto to keep it. Section 8(7) of the DPDP Act requires the Distributor to ensure erasure when the purpose is served; the Distributor may delete records itself in DeskGas, or ask Qlooto in writing.

10. Information and audits

On written request, not more than once a year and with 30 days' notice, Qlooto will give the Distributor information reasonably necessary to show compliance with this DPT, such as a description of its security measures. Any audit is at the Distributor's cost, during business hours, without access to other customers' data or to confidential security details, and subject to a confidentiality undertaking.

11. Liability

Each party's liability under this DPT is subject to the exclusions and limits in the Terms of Service. Disputes are governed by Indian law and resolved only in Gautam Budh Nagar, Uttar Pradesh, as set out in the Terms.