Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between the business that owns a SheetCRM workspace ("you", the controller / data fiduciary) and Dev Group ("we", the processor / data processor). It applies to the personal data we process for you in order to provide the service, and it forms part of the Terms of Service.

It is written to satisfy Article 28 of the EU/UK GDPR and section 8(2) of India's DPDP Act, 2023. Where the two differ, the stricter obligation applies to the data it covers.

2. What we process

Subject matter: hosting, organising, searching, exporting and notifying on the records you keep in SheetCRM.

Duration: for as long as the workspace exists, plus the retention periods in the Privacy Policy.

Nature and purpose: storage, retrieval, backup, report generation, notification delivery, access control and support.

Types of personal data: names, work email addresses, phone numbers, company names, job titles, deal values, notes and task history — whatever fields your workspace defines. You agree not to store special-category data (health, biometric, caste, religious belief, sexual orientation, financial account numbers) unless you have a lawful basis and have told us in writing.

Categories of data subjects: your employees and team members, your leads and customers, and anyone else whose details you enter.

3. Our obligations

We will:

1. process personal data only on your documented instructions — these terms, the settings you choose, and any written instruction you send us — and tell you at once if an instruction appears to break the law;
2. keep the people who process data under a duty of confidentiality;
3. apply the technical and organisational measures in clause 5;
4. help you answer a data subject's request (access, correction, erasure, portability, objection) using the self-service export and deletion features, and by hand where those are not enough;
5. help you with a data protection impact assessment and with prior consultation of a regulator, to the extent the information is available to us;
6. tell you without undue delay, and in any event within 72 hours of becoming aware, if personal data is breached, with what we know, what we have done and what we recommend you do;
7. at your choice, delete or return all personal data at the end of the service, and delete copies we hold, except where law requires us to keep it;
8. give you the information you need to show we comply, and allow an audit — remote by default, on 30 days' notice, no more than once a year unless there has been an incident.

4. Your obligations

You will:

1. have a lawful basis for the personal data you put into SheetCRM, and give the notices your law requires to the people in it;
2. answer data subject requests that reach you, using the tools in the product and asking us for help when you need it;
3. choose sensible roles for your team, remove people who leave, and keep your own credentials safe;
4. tell us promptly if you learn of a breach affecting your workspace.

5. Security measures

• Encryption in transit (HTTPS/TLS) for every page and API call; the app refuses to render over plain HTTP.
• Passwords stored as one-way hashes; no reversible storage of secrets in the database.
• Role-based access control enforced server-side on every request, not just hidden in the interface.
• Workspace isolation: every record, activity and field is scoped by workspace ID, and a query cannot cross into another workspace.
• Rate limits on sign-in, registration and password reset, plus a log of administrative actions.
• Payment secrets and API tokens kept out of client code and logs; Razorpay signatures verified server-side.
• Access to production systems limited to named staff, reviewed when someone leaves.

6. Sub-processors

You authorise the sub-processors listed on the sub-processors page. We impose the same data-protection obligations on each of them that this DPA imposes on us. We will give at least 30 days' notice by email before adding or replacing one, and you may object on reasonable data-protection grounds; if we cannot resolve it, you may terminate the affected service and we refund the unused part of the period you paid for.

7. International transfers

Workspace data is stored in the database of this installation, normally in India. Where a sub-processor processes data outside India, the EEA or the UK, we rely on the safeguards that provider offers — standard contractual clauses, an adequacy decision, or a transfer the DPDP Act permits — and we will tell you which applies on request.

8. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms, this DPA wins on data-protection questions.

To sign a copy — for a procurement or vendor file — write to hello@dg2.in with the legal name and address of your business and we will send a countersigned version.