Data Processing Agreement (DPA)
Last Updated: 20 June 2026
This Data Processing Agreement forms part of our Terms of Service and governs the processing of personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Definitions
- Data Principal: Individual to whom personal data relates
- Data Fiduciary: ApprovalDesk / Umiya Innovations (determines purpose and means of processing)
- Data Processor: Third-party services processing data on our behalf
2. Scope and Purpose
We process personal data solely for the purpose of providing the ApprovalDesk platform services as described in our Privacy Policy. We do not process data beyond what is necessary for these purposes.
3. Data Processing Activities
- Account registration and authentication
- Storage and management of uploaded files and review content
- Email communication for platform notifications
- Payment processing via Razorpay
- Security monitoring and fraud prevention
4. Sub-processors
- Cloudflare R2: File storage
- Razorpay: Payment processing
- Email Service Provider: Transactional emails
All sub-processors are bound by equivalent data protection obligations.
5. Data Retention
- Active account data: Retained for the duration of the subscription
- Cancelled account data: Retained for 30 days, then deleted
- Payment records: Retained for 7 years as required by Indian law
- Security logs: Retained for 90 days
6. Data Breach Notification
In the event of a data breach, we will notify affected users and the Data Protection Board of India within 72 hours as required by DPDP Act 2023.
7. Contact
Data Protection Officer: [email protected]
