Draft for legal review. Remove this note once your lawyer has approved the text.
Scope and roles
This agreement applies when InspireGRC Solutions Private Limited ("Processor") processes personal data on behalf of a customer ("Data Fiduciary") through the InspireGRC platform. It forms part of the Terms of service. We sign it as a separate document on request.
Processing only on your instructions
We process personal data only to provide the service, on the customer's documented instructions, and for no other purpose. We will tell the customer if we believe an instruction breaks the law.
Data and people concerned
Typically: names, work email addresses, roles and activity records of the customer's staff, contractors and suppliers, and any personal data contained in evidence the customer uploads or connects. The customer decides what it puts into the service.
Our people
Only staff who need access to support the customer can access customer data, and they are bound by confidentiality.
Security
We apply the measures described on our Security & trust page, and we will not materially reduce them during the subscription.
Subprocessors
The customer authorises the subprocessors on our subprocessors page. We give at least 30 days' notice of a new subprocessor, and the customer may object on reasonable data protection grounds. We remain responsible for our subprocessors.
Personal data breaches
We notify the customer of a personal data breach affecting its data without undue delay and within 24 hours of becoming aware of it, with the information the customer needs to meet its own duties, including reporting to the Data Protection Board of India and to CERT-In.
Helping you meet your duties
We help the customer respond to requests from people exercising their rights under the DPDP Act, and with security reviews and impact assessments, to the extent the service allows.
Transfers outside India
Customer data is stored in India. Where a subprocessor processes data outside India, the transfer follows section 16 of the DPDP Act and is disclosed on our subprocessors page.
Return and deletion
When the subscription ends, the customer may export its data. We then delete customer data from the platform within 30 days and from backups within 90 days, unless the law requires us to keep it.
Audits
We answer the customer's reasonable security questionnaires and share relevant reports. Further audits are by agreement, with reasonable notice and confidentiality.