Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between you (the "Customer" / "Data Fiduciary") and Good Folks Innovations Private Limited ("Good Folks" / "Data Processor"). By accepting the Terms and Conditions, you also accept this DPA. This DPA is drafted to comply with the Digital Personal Data Protection Act, 2023 (DPDPA) of India and, where applicable, Article 28 of the EU General Data Protection Regulation (GDPR) for customers based in the EEA, UK or Switzerland.

1. Parties and Context

Data Processor / Service Provider:
Good Folks Innovations Private Limited ("Good Folks"), the company behind Dravyaa ERP, incorporated under the Companies Act, 2013, with its registered office at 4B-75, Bangur Avenue, Block C, Kolkata — 700055, India.

Data Fiduciary / Controller:
The Customer — the business entity (manufacturer, trader, distributor or other SME) that subscribes to the Dravyaa ERP platform and determines the purposes and means of processing personal data within it.

This DPA governs all personal data processed by Good Folks on behalf of the Customer through the Dravyaa platform, including its Inventory & Warehouse, Purchase, Sales, Production / BOM, Accounting, AI Assistant and B2B Webstore modules.

2. Definitions

Where not defined below, terms carry the meanings given in the DPDPA 2023, the GDPR (as applicable) and the Dravyaa Terms and Conditions.

• "Customer Data" — any personal data uploaded to, entered into or generated within the Dravyaa Service by or on behalf of the Customer (e.g. employee records, supplier and vendor contacts, buyer/customer master data, names and GST details on e-invoices).
• "Data Fiduciary / Controller" — the Customer, who determines the purpose and means of processing Customer Data.
• "Data Processor / Processor" — Good Folks, which processes Customer Data strictly on the documented instructions of the Customer.
• "Sub-processor" — any third-party service provider engaged by Good Folks to process Customer Data in connection with the Service.
• "DPDPA" — the Digital Personal Data Protection Act, 2023 (India) and rules made thereunder.
• "GDPR" — EU Regulation 2016/679 (General Data Protection Regulation), applicable to EEA, UK and Swiss customers.
• "Service" — the Dravyaa ERP platform as described in the Terms and Conditions.

3. Subject Matter, Duration, Nature and Purpose

• Subject matter: Processing of Customer Data through the Dravyaa ERP Service.
• Duration: For the term of the Customer's active subscription plus 90 days (data export window), after which Customer Data is deleted or irreversibly anonymised per Section 12, unless longer retention is required by Indian law (e.g. GST records under the CGST Act, 2017).
• Nature of processing: Storing, organising, retrieving, displaying, transmitting, backing up, running AI-assisted analytics on and exporting Customer Data as necessary to deliver the Service features selected by the Customer.
• Purpose: Provision of the Dravyaa ERP platform to enable the Customer to manage inventory, purchase, sales, production, accounting, GST compliance and related business operations.

4. Types of Personal Data and Categories of Data Subjects

4.1 Types of personal data processed

The exact personal data processed depends on what the Customer enters into the Service. It may include:

• Employee / user data: full names, work email addresses, mobile numbers, job titles, roles and permissions within the ERP.
• Supplier & vendor master data: contact person names, email addresses, phone numbers, GSTIN, PAN (business), bank account details for payment.
• Customer / buyer master data: business name, contact person, billing and shipping addresses, GSTIN, phone and email for order fulfilment and invoicing.
• Transactional data: names appearing on purchase orders, sales invoices (including e-invoices / IRN), delivery challans, goods receipts and credit/debit notes.
• Financial data: invoice amounts, payment terms, bank references (not full card numbers — those are processed by our payment gateway sub-processor).
• AI-query data: natural language queries submitted to the Dravyaa AI Assistant, which may incidentally contain personal identifiers.

4.2 Categories of data subjects

• The Customer's employees and ERP administrators.
• The Customer's suppliers, vendors and their representatives.
• The Customer's buyers, end-customers and their representatives.
• Any other individuals whose personal data the Customer chooses to enter into the Service.

5. Obligations of Good Folks as Data Processor

Good Folks shall:

• Process Customer Data only on documented instructions from the Customer (this DPA and the Terms and Conditions constitute those instructions), except where required by law — in which case Good Folks will inform the Customer unless prohibited.
• Ensure all personnel with access to Customer Data are bound by written confidentiality obligations.
• Implement and maintain the technical and organisational security measures set out in Section 9.
• Not engage sub-processors except in accordance with Section 7.
• Assist the Customer (taking into account the nature of processing) in fulfilling its obligations to respond to data principal / data subject rights requests (Section 8).
• Assist the Customer with security assessments, breach notification and, where applicable, Data Protection Impact Assessments under the DPDPA or GDPR Arts. 32–36.
• Delete or return Customer Data at the end of the service relationship (Section 12).
• Provide all information necessary to demonstrate compliance with this DPA and cooperate with audits (Section 11).
• Notify the Customer immediately if any instruction, in Good Folks's view, would breach the DPDPA, GDPR or other applicable data protection law.
• Not use Customer Data to train AI/ML models for general purposes or to benefit other customers. AI features operate on the Customer's own data solely to provide insights back to that Customer.

6. Customer's Obligations as Data Fiduciary

The Customer represents and warrants that:

• It has a valid legal basis (consent, contract, legitimate interest or another lawful ground) for all Customer Data it provides to Good Folks.
• It has provided all required privacy notices to its employees, suppliers and customers whose data it enters into the Service.
• It will only instruct Good Folks to process Customer Data in accordance with applicable law.
• It is solely responsible for the accuracy and lawfulness of Customer Data entered into the Service.
• It will maintain the security of its own user credentials and restrict access to authorised personnel.
• It will promptly inform Good Folks of any changes to its processing instructions that may affect Good Folks's compliance obligations.

7. Sub-processors

The Customer grants Good Folks general authorisation to engage sub-processors. Good Folks shall:

• Notify the Customer of any new or replacement sub-processor by updating this page at least 14 days before the change takes effect, giving the Customer the right to object on reasonable data-protection grounds.
• Impose data protection obligations on each sub-processor no less protective than those in this DPA, by written contract.
• Remain fully liable to the Customer for any breach of this DPA by a sub-processor.

Current sub-processors (updated June 2026)

SCCs = EU Standard Contractual Clauses (Commission Decision 2021/914). Customers with GDPR obligations may request copies of applicable SCCs by emailing [email protected].

8. Data Principal / Data Subject Rights

Under the DPDPA 2023, data principals (individuals) have rights including access, correction, erasure and grievance redressal. Under GDPR, data subjects have additional rights including restriction and portability. Good Folks shall:

• Forward, without undue delay, any rights request received that relates to Customer Data to the Customer (as Data Fiduciary / Controller), since the Customer is the party with decision-making authority over that data.
• Not respond directly to such requests without the Customer's authorisation, unless required by applicable law.
• Provide the Customer with reasonable technical assistance to fulfil rights requests within the timeframes required by the DPDPA (typically within 30 days) or GDPR (within one calendar month).
• Log rights requests and assist the Customer in maintaining the records required under applicable law.

9. Security Measures

Good Folks implements and maintains technical and organisational measures (TOMs) appropriate to the risks presented by the processing, including in particular accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Data:

Technical measures

• All data in transit encrypted with TLS 1.2 or higher; all data at rest encrypted with AES-256.
• Role-based access controls (RBAC) and principle of least privilege across all ERP modules.
• Multi-factor authentication (MFA) enforced for all administrative and engineering access to production systems.
• Daily automated encrypted backups stored in a geographically separate AWS region.
• Intrusion detection, vulnerability scanning and security event monitoring.
• Full audit logs of administrative access to Customer Data, retained for a minimum of 12 months.
• Regular penetration testing by qualified third parties.
• Logical data isolation between Customer tenants — no Customer can access another Customer's data.

Organisational measures

• Mandatory data protection training for all staff with access to Customer Data.
• Written confidentiality obligations for all personnel and contractors.
• Documented incident response and business continuity procedures.
• Security assessment of all sub-processors before onboarding.
• Annual review and update of all TOMs.
• Designated point of contact for data protection matters: [email protected].

10. Personal Data Breach Notification

In the event of a confirmed personal data breach affecting Customer Data, Good Folks shall:

• Notify the Customer without undue delay, and where feasible within 72 hours of becoming aware (in line with GDPR Art. 33; DPDPA timelines per rules as notified).
• Provide, to the extent available: nature of the breach, modules and data categories affected, approximate number of data subjects and records impacted, likely consequences, and measures taken or proposed to contain and remedy the breach.
• Cooperate with the Customer in any regulatory notifications to the Data Protection Board of India (under DPDPA) or EU/EEA supervisory authorities (under GDPR) as required.
• Not make any public statement about a breach affecting Customer Data without the Customer's prior consent, unless required by law.

11. Audits and Compliance Demonstration

Good Folks shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, subject to:

• At least 30 days' prior written notice (except where a confirmed breach requires urgent access).
• Audits conducted during normal business hours (IST) with minimal disruption to the Service and other customers.
• The auditor executing a confidentiality undertaking satisfactory to Good Folks.
• A maximum of one audit per calendar year, unless a confirmed breach warrants more.

Good Folks may satisfy audit requests by providing current third-party security certifications or audit reports (e.g. ISO 27001, SOC 2 Type II) in lieu of on-site inspection where these adequately address the audit scope.

12. Deletion and Return of Customer Data

Upon expiry or termination of the Customer's subscription:

• Good Folks will make Customer Data available for export (CSV / standard formats) for a period of 90 days following the termination date.
• After the 90-day window, Good Folks will delete or irreversibly anonymise all Customer Data from live systems and backups, unless retention is required by applicable Indian law (e.g. GST records under CGST Act, 2017 — typically 8 years from the date of filing the relevant return) or ordered by a court or regulator.
• Good Folks will confirm deletion in writing upon the Customer's request.
• Data retained solely to satisfy statutory requirements will be isolated and not used for any other purpose.

13. Cross-border Data Transfers

Customer Data is primarily stored in AWS Mumbai (India) region. Where data is processed by sub-processors outside India (e.g. for authentication, analytics or AI inference), Good Folks ensures appropriate safeguards are in place:

• For EEA/UK/Swiss customers: Transfers to India and other non-adequate countries are governed by EU Standard Contractual Clauses (Commission Decision 2021/914) or the UK IDTA, incorporated by reference into this DPA. Copies available on request at [email protected].
• For Indian customers: Cross-border transfers by sub-processors are made to countries and entities that provide an adequate level of protection, consistent with the DPDPA 2023 and any rules notified thereunder by the Central Government.

14. Liability

Good Folks's liability under this DPA is subject to the limitations in the Terms and Conditions. Each party is liable for fines, penalties and damages attributable solely to its own non-compliance with applicable data protection law. This DPA does not exclude or limit liability for damages caused by gross negligence, wilful misconduct, or breaches that cannot be excluded by law. Nothing in this DPA limits a data principal's or data subject's ability to exercise statutory rights.

15. Conflict

In the event of conflict between this DPA and the Terms and Conditions on data protection matters, this DPA prevails. Where applicable, the Standard Contractual Clauses prevail over both documents with respect to international data transfers from the EEA/UK/Switzerland.

16. Governing Law and Jurisdiction

This DPA is governed by the laws of India, including the DPDPA 2023 and the Information Technology Act, 2000. Disputes are subject to the exclusive jurisdiction of the courts in Kolkata, India. For EEA/UK/Swiss customers, the mandatory provisions of the GDPR apply as a matter of EU/UK law regardless of this governing law clause.

17. Updates to This DPA

Good Folks may update this DPA to reflect changes in law, sub-processors or processing activities. Material changes will be notified at least 30 days in advance via email or in-app notice. Continued use of the Service after the effective date of an updated DPA constitutes acceptance. Customers who object to a change may terminate their subscription in accordance with the Terms and Conditions.

18. Contact for Data Protection Matters

• Data protection / privacy queries: [email protected]
• General enquiries: [email protected]
• Phone / WhatsApp: +91 95356 73322
• Registered office: Good Folks Innovations Private Limited, 4B-75, Bangur Avenue, Block C, Kolkata — 700055, India.