Data Processing Addendum
Last updated: 16 October 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Infraforge Consulting Private Limited ("Processor") and the customer ("Controller") and applies to personal data in the customer's content ("Customer Personal Data") — for example the names, emails and addresses of the customer's clients. It applies automatically when you accept the Terms; email hello@infraforgeconsulting.com if you need a signed copy.
1. Roles and instructions
The customer is the controller (data fiduciary) and we are the processor. We process Customer Personal Data only on the customer's documented instructions — the Terms, this DPA, and the customer's use of the Service's features — unless the law requires otherwise, in which case we will tell the customer first where permitted. We will tell the customer if we believe an instruction breaches data-protection law.
2. Details of processing
| Item | Detail |
|---|---|
| Subject matter and purpose | Providing invoicing, quotes, reminders, payment pages, time/expense tracking, document storage, analytics, exports and AI-assisted drafting |
| Duration | While the customer has an account, plus the deletion period in the Privacy Policy |
| Data subjects | The customer's clients and their contacts; the customer's team members |
| Types of data | Names, email addresses, phone numbers, postal addresses, company names, tax identifiers (e.g. GSTIN/VAT), invoice and payment details, documents the customer uploads |
| Sensitive data | Not intended; the customer must not upload it |
3. Confidentiality and security
Everyone with access to Customer Personal Data is bound by confidentiality. We maintain the technical and organisational measures described on our Security page, including encryption in transit and at rest at our infrastructure providers, access control and role-based permissions, rate limiting, audit logging, signed short-lived file access, and secure development practices.
4. Sub-processors
The customer authorises the sub-processors on our Sub-processors page. We bind each to data-protection obligations no less protective than this DPA, remain responsible for their performance, and give 30 days' notice of new ones so the customer can object.
5. Data-subject requests and assistance
Self-service export and deletion tools are in the app. If a data subject contacts us about Customer Personal Data we will refer them to the customer and not respond substantively without the customer's instruction. We will reasonably assist the customer with data-subject requests, impact assessments and consultations with authorities, taking into account the nature of the processing.
6. Personal-data breaches
We will notify the customer without undue delay, and in any case within 72 hours of becoming aware of a personal-data breach affecting Customer Personal Data, with the information we have to help the customer meet its own notification duties (including to CERT-In, the Data Protection Board of India and EU/UK authorities where they apply).
7. International transfers
The customer authorises transfers to the sub-processors' locations listed on the Sub-processors page. For transfers of EU/UK personal data to countries without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Module 2: controller to processor; Module 3 where the customer is itself a processor) and the UK Addendum, with the customer as exporter, us as importer, Indian law and courts of Lucknow, Uttar Pradesh where a governing law is required, and the details in sections 2–4 as the annexes.
8. Return and deletion
On termination the customer may export its data and then delete its account; we delete Customer Personal Data on account deletion (backups within the retention period in the Privacy Policy), except where the law requires us to keep it.
9. Audits
On reasonable written request, not more than once a year, we will provide information needed to show compliance with this DPA, and allow for audits by the customer or an auditor it appoints (under confidentiality, with reasonable notice, at the customer's cost) where required by data-protection law.
10. Liability and order of precedence
Each party's liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms about the processing of Customer Personal Data, this DPA prevails; the Standard Contractual Clauses prevail over both for the transfers they cover.