Data Processing Agreement
In short: your business decides how its customers' data is used; we only store and process it to run your inbox, keep it secure and confidential, tell you quickly if anything goes wrong, and delete it when you leave.
This agreement is part of the Terms of Service between your business (the "Business") and Pratik Niranjan Pai, trading as oneCommerce ("oneCommerce"). It applies to personal data that oneCommerce processes for the Business while providing the inbox, under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Roles
The Business is the Data Fiduciary. oneCommerce is the Data Processor and processes personal data only on the Business's behalf.
2. What is processed
| Whose data | The Business's customers and contacts who message its WhatsApp number; the Business's team members. |
|---|---|
| What data | Names, phone numbers, messages, photos, videos, voice notes and documents; internal notes and labels; Shopify order and delivery details and courier bookings if connected; login records of team members. |
| Why | To run the shared inbox and the features and add-ons the Business has chosen, including support, backups and security. |
| How long | For as long as the Business uses oneCommerce, then as in section 9. |
3. Instructions
oneCommerce processes personal data only as needed to provide the service and as the Business instructs through its settings and in writing. If an instruction appears to break the law, oneCommerce will say so.
4. Confidentiality
Only people at oneCommerce who need it to run the service can access the server, and they are bound to keep data confidential. A Business's chats are looked at only when the Business asks for help with them.
5. Security
- A separate inbox copy for each business, running as its own system user.
- Encrypted connections (https), strict browser security settings, protection against repeated login attempts.
- Optional two-step login, new-device alerts for admins, customer numbers hidden from team members unless allowed.
- Nightly backups, with a copy locked (encrypted) before it leaves the server. The unlock key is not kept on the server.
- Monitoring every 5 minutes, with alerts if an inbox or WhatsApp link stops working.
6. Sub-processors
The Business allows oneCommerce to use the service providers listed in our Privacy Policy (section 6). oneCommerce will give at least 15 days' notice before adding or replacing one; if the Business objects on reasonable grounds, it may end the service and receive a refund of unused prepaid fees. oneCommerce remains responsible for its sub-processors.
7. Personal data breaches
If oneCommerce becomes aware of a breach affecting the Business's personal data, it will tell the Business without undue delay and within 24 hours, with what is known so far, what is being done, and updates as more is learned. oneCommerce will help the Business meet its duties to inform the Data Protection Board of India and the people affected.
8. Helping the Business
oneCommerce will help the Business answer requests from people exercising their DPDP rights (access, correction, erasure, grievance), for example by finding or exporting a customer's chats.
9. When the service ends
On request, oneCommerce provides an export of the Business's data. Within 30 days after the service ends, oneCommerce deletes the Business's inbox and its backups on and off the server, unless the Business asks in writing for it to be kept longer or the law requires otherwise.
10. Information and checks
oneCommerce will answer the Business's reasonable questions about how its data is protected, and share the results of independent security tests once they have been done.
11. Contact
Data protection questions: Pratik Niranjan Pai, support@onecommerce.tech.