Business Data Processing Terms

1. What these terms cover

DataJewellers means Data Doodles Tech Private Limited, the operator of the DataJewellers service ("we", "us"). These Business Data Processing Terms form part of the Terms & Conditions and apply whenever the data your business ("you", the "Business") enters into its workspace includes personal information about other people — your customers, suppliers, karigars and employees ("Business Personal Data").

They sit alongside the Privacy Policy, which describes the data we hold in our own right.

2. Roles

• You decide. You choose what to record about your customers, suppliers, karigars and staff, why, for how long, and who inside your business may see it. You are the party with the relationship to those people, and you are responsible for having a lawful basis and, where required, their consent under the Privacy Act, 2075 (2018), and for telling them what you collect and why.
• We process on your instructions. DataJewellers stores, hosts and processes Business Personal Data to provide DataJewellers to you. We do not decide the purposes for which your records are used, and we do not use them for our own purposes.

3. Our instructions and permitted purposes

We process Business Personal Data only:

1. To provide, operate and maintain the workspace and its features — stock, sales, purchases, invoicing, reporting, offline synchronisation and printing.
2. To keep the service secure and to investigate unauthorised access, abuse or fraud.
3. To provide support you have asked for, under section 7.
4. To back up and restore data.
5. To comply with law, or a valid order of a court or authority — in which case, unless we are legally prevented, we will tell you before we disclose anything.
6. On any further written instruction you give us that is technically feasible and lawful.

We do not sell Business Personal Data, do not use it to train models, do not use it for advertising or marketing, and do not disclose it to anyone except as set out in section 5. If we believe an instruction from you would breach the law, we will tell you and may decline to act on it.

4. Confidentiality

We treat Business Personal Data as confidential. Access inside DataJewellers is limited to the operators who need it to run the platform or to answer a support request, each of whom is bound by confidentiality obligations that survive the end of their engagement. Platform operators sign in to a separate console with their own credentials and multi-factor authentication (TOTP), and every administrative action they take is written to an append-only platform audit log.

5. Sub-processors and recipients

To deliver the service we use:

• Vercel — application hosting and content delivery, Singapore (sin1) region.
• Neon — the managed PostgreSQL database in which your workspace lives, Singapore.
• An SMTP email service, where the operator has configured one, to deliver transactional email such as verification, password reset and setup links. Where no email service is configured, no such email leaves the platform.

Two further recipients are not general sub-processors:

• FENEGOSIDA's public rates API — we fetch published daily metal rates once a day. No personal data is sent to it.
• The Inland Revenue Department's CBMS — used only if you enable e-billing with your own IRD-issued credentials. When you do, invoice data including the buyer's PAN where recorded is transmitted to the IRD on your instruction. Switching e-billing on is your decision and your instruction. DataJewellers is not IRD certified, IRD approved or listed by the IRD.

There is no analytics, error-monitoring, advertising, SMS, push or third-party sign-in provider in this product. If we intend to add a sub-processor that handles Business Personal Data, we will update this document and give notice before the change takes effect, so that you can object or cancel.

Your data is hosted in Singapore. The Privacy Act, 2075, as we have verified its text, contains no explicit cross-border transfer restriction for ordinary personal information. Where applicable, DataJewellers will handle personal information in accordance with applicable law.

6. Security measures

We maintain the measures described in the Privacy Policy and the Security & Responsible Disclosure page, including:

• Separation of each Business's data into its own database schema, resolved by hostname, so one workspace cannot read another's.
• Password hashing with bcrypt (cost 12), an enforced password policy, and immediate revocation of every live session on role change, deactivation or password reset.
• Signed session tokens in httpOnly, same-site cookies; 12-hour workspace sessions, 8-hour operator sessions, one-hour impersonation.
• Role and permission checks on every protected request, including custom roles you define.
• Cross-site request refusal, a strict content security policy, HSTS, and rate limiting keyed by IP address and account.
• Validation of all input and parameterised database queries.
• Append-only audit logs, on both the workspace and the platform side.
• Backups through the database provider's backup and point-in-time recovery facilities, plus optional operator-run backups that can be encrypted with AES-256-GCM.

Encryption at rest of the database is provided by the hosting provider, not implemented or separately certified by DataJewellers. We hold no security certification and make no certification claim.

7. Support access to your workspace

We do not browse your workspace. When investigating a problem requires it, a DataJewellers operator opens a support session:

• It requires a stated reason.
• It is time-boxed and expires automatically.
• It is recorded in your workspace's audit log, with the operator's identity, the reason and the time, so you can see and audit it afterwards.
• Where an operator needs to act as a user in your workspace, that impersonation is separately audited with a reason and expires within an hour.

You may ask us at any time for the record of support access to your workspace.

8. Helping you answer people's requests

If a customer, supplier, karigar or employee asks you to show, correct or delete what you hold about them, that request is yours to answer. We will help:

• The data is visible and editable in the application, and you can export it — CSV, Excel or PDF from the screens, and a JSON export per entity from Settings → Legal & Privacy.
• Where a request needs something the application does not do, write to support@datadoodlestech.com and we will assist within a reasonable time, and will acknowledge you within 5 business days.
• If a request comes to us directly, we will not answer it on your behalf. We will tell the person to contact you, and tell you it happened.

Note that some records cannot simply be erased: an issued invoice cannot be edited or deleted, only cancelled with a reason or corrected by credit or debit note, and tax law requires records to be kept — at least five years from the end of the income year concerned under the Income Tax Act, 2058, and, for transaction accounts, the period prescribed under the VAT Act, 2052 and its Rules (commonly stated as six years).

9. End of service: deletion and return

When your subscription ends, or you ask us to close your workspace:

1. Read-only. The workspace becomes read-only. Nothing is deleted; records remain visible and exportable.
2. Export. You export what you need, in the formats above. We will help if an export fails.
3. Archive. If the workspace is archived, it is scheduled for purge 90 days later. Throughout that period the data still exists and can be restored on request.
4. Purge. After that period the workspace can be purged. The purge is a deliberate manual act by an operator, not an automatic job, and it is irreversible.

Backups taken before a purge age out according to the provider's backup cycle. Where the law requires us to keep something — for example, invoices we issued to you, or records relevant to our own tax position — we keep that and nothing more. The Data Retention & Deletion Policy has the detail.

10. Records and audit

We keep records of our processing sufficient to show what we do: platform audit logs of operator actions, workspace audit logs of user actions, and this document's version history. On reasonable written request, and no more than once a year unless there has been an incident, we will answer your questions about our processing and security measures in writing, and give you the record of support access to your workspace. We are a small operation and do not offer on-site audits or bespoke security questionnaires as a matter of course; we will not claim a certification we do not hold.

11. Liability

Liability under these terms is subject to the limitations and the statutory carve-out in the Terms & Conditions, including the point that nothing excludes liability that cannot lawfully be excluded, such as liability under the Consumer Protection Act, 2075 (2018).

12. Your warranties as the Business

You confirm that:

• You have the authority, and where required the consent, to enter the personal data you enter, and to instruct us to process it.
• You will not record sensitive personal information — such as caste or ethnicity, political affiliation, religious belief, health, sexual orientation or another person's property details — beyond what your jewellery business genuinely needs. The Privacy Act, 2075 treats these categories as sensitive.
• You will not attempt to store government identity document scans, citizenship or passport numbers, or biometric data. DataJewellers has no fields for them, and free-text fields such as notes must not be used as a substitute.
• You will keep the personal data you enter accurate, and remove what you no longer need.
• You will tell the people concerned what you collect, and answer their requests.

You indemnify DataJewellers for claims arising from personal data you entered without a lawful basis or the required consent, as set out in the Terms.

13. Changes and contact

We publish changes with a new version number and effective date; older versions stay readable at /legal/data-processing/v/<version>. Questions about this document: support@datadoodlestech.com or support@datadoodlestech.com.