1. Roles
Where you supply personal data of your own clients to Saudaa, you act as the Data Fiduciary (controller) and Saudaa acts as the Data Processor, processing only on your documented instructions. For data we collect directly from members, Saudaa is the Data Fiduciary.
2. Scope of Processing
Subject matter: provision of the Saudaa research platform. Duration: for the term of the subscription plus statutory retention. Categories of data: identity and contact details, authentication data, subscription and transaction metadata, and platform usage records. Data subjects: your personnel and clients who use the platform.
3. Our Obligations
We process only on your instructions; keep personnel bound by confidentiality; apply the technical and organisational measures set out in our Security Policy; assist you in responding to data-principal requests; and delete or return the data at the end of the engagement, save where law requires retention.
4. Sub-processors
We use vetted sub-processors, currently: Supabase (managed database hosting), Vercel (application hosting), Razorpay (payment processing) and Google (analytics). We remain liable for their performance and will give notice of any material change.
5. Data Location and Transfers
Application infrastructure is operated in the Mumbai region where available. Where a sub-processor stores or accesses data outside India, transfers are made only to jurisdictions permitted by applicable law and under appropriate contractual safeguards.
6. Security Incidents
We notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data, with the information reasonably required for your own notification duties.
7. Audit
On reasonable written notice, and not more than once a year unless required by a regulator, we will provide the information necessary to demonstrate compliance with this agreement.
8. Governing Law
This agreement is governed by the laws of India and is read together with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Contact: contact@saudaa.co.in.