Data Processing Agreement

1. Roles

You are the controller of the personal data you put into your workspace — your leads, clients, and their messages. You decide what to collect and why. Abidott Solutions (OPC) Private Limited is the processor: we process that data only to provide the service and only on your documented instructions, which your use of the product’s features constitutes.

Where you connect your own Stripe, Razorpay, Google or Meta account, that provider acts on your instructions, not ours, and your agreement is with them directly.

2. Scope of processing

• Subject matter: provision of a CRM and messaging platform.
• Duration: for as long as your workspace exists, plus the deletion window in section 6.
• Categories of data subject:your staff, your leads and prospects, and your clients’ contacts.
• Categories of data: names, contact details, message content, meeting and deal records, and billing details.
• Special category data: not requested by the product. Do not enter health, biometric, or similar data into free text fields.

3. Our obligations

• Process personal data only on your instructions, and tell you if we believe an instruction breaches applicable data protection law.
• Bind everyone with access to a duty of confidentiality.
• Apply the technical and organisational measures in section 5.
• Assist you with data subject requests, impact assessments, and breach notifications, to the extent you cannot do so yourself with the product’s export and deletion tools.
• Notify you without undue delay after becoming aware of a personal data breach affecting your workspace.

4. Sub-processors

You give general authorisation for the sub-processors below. We will give notice before adding a new one, and you may object on reasonable data protection grounds — in which case you may terminate the affected service.

5. Technical and organisational measures

• Encryption in transit (TLS) and at rest.
• Third-party credentials you store — payment keys, messaging tokens, OAuth refresh tokens — are additionally encrypted at the application layer.
• Tenant isolation: every record carries a workspace identifier and all access passes through a single enforcement point.
• Role-based access control, optional two-factor authentication, and an immutable audit log of administrative actions.
• Managed, backed-up database infrastructure.

6. International transfers

Abidott Solutions (OPC) Private Limitedis established in India, which does not benefit from a European Commission adequacy decision. Transfers of EU personal data to us, and onward to the sub-processors above, are made under the European Commission’s Standard Contractual Clauses together with the measures in section 5. Contact us at info@abidottsolutions.com to execute the SCCs for your organisation.

7. Return and deletion

You can export your full workspace as JSON at any time from Settings → Data & privacy, and delete the workspace yourself, which cascades to every record scoped to it. On termination we delete remaining copies within 30 days, except where retention is legally required.

8. Audits

On reasonable written request, and no more than once a year, we will provide the information necessary to demonstrate compliance with this agreement.