Data processing terms

This draft is awaiting review by a lawyer. It is not yet in force. Items marked [TO CONFIRM] are for the lawyer or the parties to settle.

These terms are between the customer and [TO CONFIRM: legal name of the company that sells Dexta] (“Dexta”, “we”). They form part of the customer’s agreement for Dexta and apply under the Digital Personal Data Protection Act, 2023 (the “Act”) and the Digital Personal Data Protection Rules, 2025 (the “Rules”).

1. Roles

• The customer is the data fiduciary for the personal data of its employees, former employees, candidates, contractors and others that it puts into Dexta.
• Dexta is the customer’s data processor (section 2(k) of the Act) for that data.
• Where Dexta decides its own purposes, for example its own staff, administrators’ sign-in records for security, billing, and Dexta Books subscriptions, Dexta is a fiduciary for that use. Our privacy notice covers it.

2. What we process, and for how long

• Subject matter: providing the Dexta apps the customer switches on, for as long as the subscription runs, plus the time needed to return or erase data at the end (section 12).
• People concerned: the customer’s employees, former employees, candidates and referred candidates, contractors, nominees and family members recorded for payroll and benefits, and the customer’s own contacts such as vendors and clients in Dexta Books.
• Kinds of data: what each app holds, as listed in the customer’s privacy notice in Dexta Hub. This includes identity and contact details, employment records, attendance and timesheets, salary, bank and tax details, expense claims, reviews, help desk requests, and sign-in and activity logs.

3. Only on the customer’s instructions

We process personal data only to provide the service and on the customer’s documented instructions, which include the agreement, these terms, and the settings and actions of the customer’s administrators. We never use it for our own purposes (section 8 of the Act). If we think an instruction breaks the law, we will say so.

4. Our people

Everyone at Dexta who can reach customer data is bound to keep it confidential, and has access only as far as their work needs.

5. Security

We keep the safeguards that rule 6(1) of the Rules describes, including:

• Encryption: every database dump and uploaded-files archive is encrypted (AES-256) before it is copied off the server; connections use TLS.
• Access control: sign-in with strong passwords, optional or compulsory two-step sign-in, single sign-on, and role-based access in each app.
• Logs and monitoring: sign-in and activity logs, reviewed for misuse, kept for at least one year (rule 8(3)), and for at least 180 days in India as CERT-In’s 2022 directions require.
• Backups and continuity: on our cloud, daily backups, copied every six hours to storage in India and kept for 400 days.
• Checking: regular review that these measures are working. [TO CONFIRM: independent security test and its frequency.]

6. Personal data breaches

• We will tell the customer without delay, and within [TO CONFIRM: number] hours of becoming aware of a breach affecting its data.
• We will give the facts rule 7 needs: the nature, extent, timing and location of the breach and its likely impact, and update them as we learn more.
• We will help the customer make its report to the Data Protection Board (an intimation without delay, then a detailed report within 72 hours) and its notices to the people affected.
• [TO CONFIRM: who reports a cyber incident to CERT-In within the 6 hours its directions require, when it happens on our cloud.]

7. Help with people’s rights

We help the customer answer requests from people to see, correct, complete, update or erase their data, to nominate someone, and to complain, within the customer’s deadlines (sections 11 to 14 of the Act and rule 14). Dexta Hub’s Privacy pages let the customer handle most requests itself.

8. Sub-processors

We use the sub-processors below. Several are used only when the customer switches a feature on.

• Server hosting (the data centre the deployment runs in) [TO CONFIRM: provider name]. Runs the Dexta apps and their databases. Data: Everything the apps hold. Location: India. When used: Always, on our cloud.
• Off-site backup storage (an S3-compatible bucket, for example AWS Mumbai) [TO CONFIRM: provider name]. Encrypted copies of the databases and uploads, for recovery. Data: Everything the apps hold, encrypted. Location: India. When used: When off-site backups are set up.
• Email delivery (the customer’s own mail server, or the mail account Dexta’s deployment uses). Invitations, password resets and notifications. Data: Name, email address, the message. Location: Depends on the mail provider [TO CONFIRM]. When used: Always.
• Anthropic (Claude). Writing suggestions in Dexta Cheer and skill matching in Dexta Skills. Data: The text being worked on. Location: United States. When used: Only when the customer turns AI on with its own key.
• Microsoft Entra ID (Microsoft Graph). Bringing people and groups in from the customer’s directory. Data: Names, emails, groups. Location: The customer’s Microsoft tenant region. When used: Only when the customer connects Entra ID.
• Masters India (GST Suvidha Provider). E-invoices and e-way bills in Dexta Books. Data: Invoice and party details. Location: India. When used: Dexta Books only, when switched on.
• Setu (account aggregator). Bank statement feeds in Dexta Books. Data: Bank transactions. Location: India. When used: Dexta Books only, when switched on.
• Razorpay. Subscription payments for Dexta Books. Data: Billing contact and payment details. Location: India. When used: Dexta Books subscribers only.
• Cloudinary. Keeping uploaded files: receipts in Dexta Spend, appraisal files in Dexta Growth. Data: The uploaded files. Location: Where the customer’s Cloudinary account stores files (often outside India). When used: Only when the customer turns it on with its own account.
• RazorpayX (payouts). Paying expense claims to people’s bank accounts from Dexta Spend. Data: Name, bank account and IFSC, amount, claim reference. Location: India. When used: Only when the customer turns on payouts with its own account.
• Browser and phone push services (Google, Apple, Mozilla, Microsoft). Delivering notifications to a phone or browser. Data: The notification, encrypted so the push service can’t read it. Location: Depends on the person’s browser or phone. When used: Only for people who turn on notifications.
• WhatsApp and SMS provider (MSG91, Gupshup or Twilio, whichever we set). WhatsApp and SMS alerts and one-time codes to confirm a mobile number. Data: Mobile number and a short fixed alert, never amounts, PAN or bank details; WhatsApp messages also pass through Meta. Location: MSG91 and Gupshup: India. Twilio and Meta: outside India. When used: Only when the customer switches it on and the person agrees.

The current list is always shown to the customer’s administrators in Dexta Hub.

• We will tell the customer [TO CONFIRM: number] days before adding or replacing a sub-processor. The customer may object on reasonable grounds; if we can’t resolve it, the customer may end the affected service and get a refund of fees paid for the unused period. [TO CONFIRM]
• Each sub-processor is bound to duties at least as protective as these. We stay responsible to the customer for what our sub-processors do.

9. Where data is stored

On our cloud, the apps’ databases, uploaded files and backups are kept on servers in India, except files a customer chooses to keep on its own Cloudinary account, which are kept where that account stores them. Some optional features send limited data outside India, as the table above shows; the customer decides whether to switch them on.

Transfers outside India happen only as section 16 of the Act allows, and subject to any stricter Indian law, such as the Companies Act’s rule that a back-up of the books of account is kept on servers in India.

10. If the customer runs Dexta on its own server

When the customer runs Dexta on its own server, the customer hosts the data, not us. The server, its backups, its backup storage and its mail account are the customer’s choice and under the customer’s control.

• We reach the customer’s system or data only when the customer gives us access for support, and only for as long as needed. While we do, these terms apply.
• Sections 5 (on our cloud), 8 (hosting and backup rows) and 12 (erasure from our systems) apply only to data the customer sends us, for example in a support case.

11. Audits and information

We will give the customer the information it reasonably needs to show these terms are being met, including our answers to security questionnaires and, once it is done, a summary of an outside security test. [TO CONFIRM: audit rights, how often, how much notice, and who pays.]

12. Return and erasure at the end

• Until the subscription ends, the customer’s administrators can export all the company’s data from Dexta Hub at any time.
• After it ends, the customer has [TO CONFIRM: number] days to export. We then erase the customer’s data from the live service and confirm it in writing. Sub-processors do the same.
• The data leaves the live service at once. Encrypted backups hold every customer together and are not edited one by one; copies holding the customer’s data expire on their normal schedule, within 400 days, and are never restored into the live service for anyone else.
• We keep only what the law requires us to keep, such as logs for the one-year minimum in rule 8(3), and data under a legal hold, and erase it when that period ends. Dexta Books’ month-end backups are kept for eight years because company law requires books of account to be kept that long; the customer’s Books data in them expires when they do.

13. Liability

The customer stays responsible to its people for processing done for it (section 8(1) of the Act). Liability between the customer and us is as set out in the terms of service. [TO CONFIRM: any separate cap or indemnity for data protection.]

14. Changes in law

Most of the Act’s duties apply from 13 May 2027. We and the customer will update these terms when the Rules, the Board’s guidance or those dates change.