Data Processing Agreement.

1. Who this agreement is between

This Data Processing Agreement (“DPA”) is between SmartDuke Technologies (“SmartDuke”, the processor) and the business that uses SmartDuke (the “Customer”, the data fiduciary or controller). It is part of our Terms of Service and applies automatically to every SmartDuke account. A business that needs a signed copy can ask at support@dukeos.app.

Words used here: “personal data”, “processing”, “data fiduciary”, “data principal” and “personal data breach” have the meanings in India's Digital Personal Data Protection Act, 2023 (DPDP Act); for data covered by the GDPR, “controller”, “processor” and “data subject” have the GDPR meanings.

2. What we process

• Purpose: providing SmartDuke to the Customer, including Duke, the AI assistant, as described in the Terms and as the Customer configures it.
• Data principals: the Customer's own customers, members, patients, students, leads and contacts, and the Customer's team members.
• Types of data: whatever the Customer keeps in SmartDuke, typically names, contact details, bookings, memberships and attendance, invoices and payments, notes, documents, photos, messages sent and received, and custom fields. The Customer decides; SmartDuke is not designed for data it doesn't need, such as card numbers or government ID numbers.
• Duration: for as long as the Customer has an account, then until deletion as set out in section 9.

3. The Customer's responsibilities

The Customer decides why and how its customers' data is processed. It is responsible for having a lawful basis (including valid consent where required) for the data it puts into SmartDuke and the messages it sends through it, for giving its customers the notices the law requires, for answering their requests, and for its instructions to SmartDuke being lawful. Where the Customer keeps data about children, it is responsible for verifiable parental consent where the DPDP Act requires it.

4. Our commitments as processor

SmartDuke will:

• process the Customer's personal data only to provide the service and on the Customer's documented instructions, which are these terms and the Customer's use and settings of the app, unless the law requires otherwise (in which case we'll tell the Customer first if the law allows);
• not sell the data, not use it for advertising, and not use it to train AI models;
• make sure the people who can reach it are bound by confidentiality, and limit staff access to what is needed to run and support the service, with staff actions on a business recorded in that business's audit log;
• keep appropriate security measures in place (section 5);
• use subprocessors only as described in section 6;
• help the Customer answer requests from its data principals (section 7) and meet its duties on security, breach notice and, under the GDPR, impact assessments, as far as reasonable given what we know;
• tell the Customer if we believe an instruction breaks the law.

5. Security

• Separation of each business's data, enforced by the application and by row-level security in the database.
• HTTPS for all traffic; passwords hashed; connected-service keys and tokens encrypted at rest.
• Role-based permissions for every person, and for Duke acting for them, with optional or required two-factor sign-in.
• An audit log of every change to business data and every approved AI action.
• Virus scanning of uploaded files.
• Nightly backups kept for 30 days, with a restore test every week.
• Per-address limits on sign-in and other public endpoints; security updates applied to servers and software.

6. Subprocessors

The Customer agrees that SmartDuke may use the subprocessors on our Subprocessors page. We have a written contract with each one that protects the data at least as well as this DPA, and we remain responsible for them.

We will update that page and tell account owners by email at least 30 days before adding or replacing a subprocessor. If the Customer has a reasonable data-protection objection, it can tell us within that time; if we can't resolve it, the Customer may cancel the affected service and receive a refund of fees paid for the period after the change.

Services the Customer connects itself (its own WhatsApp number, payment provider or AI key) are not our subprocessors; the Customer's own agreement with them applies.

7. Requests from data principals

SmartDuke gives the Customer tools to answer requests itself: finding and correcting records, exporting data, and erasing a person's personal data completely (including blanking their values in history). If a data principal contacts us directly about the Customer's data, we will pass the request to the Customer and not answer it ourselves unless the Customer asks us to.

8. Personal data breaches

If we become aware of a personal data breach affecting the Customer's data, we will tell the Customer without undue delay, and in any case within 72 hours, with what we know: what happened, the data and people likely affected, what we have done and what we recommend. We will update the Customer as we learn more and help it notify the Data Protection Board of India, supervisory authorities and the people affected, as the law requires.

9. Deletion and return

The Customer can export all of its data at any time from Settings. When the Customer closes its business, the data is deleted 90 days after closing, and copies disappear from backups within 30 days after that. Drafts never published on a paid plan are deleted after 30 days. We keep data longer only where the law requires, for example our own invoices to the Customer.

10. Where data is processed

SmartDuke stores data on servers run by our hosting provider Contabo in Germany (European Union); uploaded files and backups are kept in Contabo Object Storage in the European Union. Some subprocessors process data in other countries, as listed on the Subprocessors page. We will not transfer data to a country the Government of India restricts under the DPDP Act. For data covered by the GDPR, transfers outside the EEA or UK are made under an adequacy decision or the European Commission's standard contractual clauses (and the UK addendum), which are incorporated into this DPA where needed.

11. Audits

On reasonable request, no more than once a year (or after a breach), we will answer the Customer's written security and privacy questions and provide the information needed to show we meet this DPA. Any on-site audit must be agreed in advance, at the Customer's cost, and must not put other customers' data at risk.

12. General

This DPA lasts as long as we process the Customer's personal data. If it conflicts with the Terms of Service on data protection, this DPA wins. The limits of liability in the Terms apply, except where the law doesn't allow it. Questions: support@dukeos.app, or our Grievance Officer, Dinakar, at support@dukeos.app.