Data Processing Addendum

For end-customer personal data (buyers' names, phone numbers, addresses) uploaded by the business ('Customer'):

• The Customer is the Data Fiduciary.
• SaathiX ERP Technologies is the Data Processor.

For account, billing and shop-owner data, SaathiX ERP is itself a Data Fiduciary and processes such data as described in the Privacy Policy.

SaathiX ERP processes personal data only to (a) provide the SaathiX ERP services, (b) prevent fraud, (c) comply with legal obligations (e.g., GST invoice retention), and (d) generate aggregated, anonymised analytics. No processing occurs for advertising or resale.

SaathiX ERP engages the following categories of sub-processors, each bound by contractual data-protection obligations:

• Cloud infrastructure (India regions only, primary: Mumbai, secondary: Hyderabad).
• Payment gateways for subscription and payment collection (Razorpay, PhonePe).
• Communication rails (WhatsApp Business, transactional SMS/email).
• KYC and background verification partners for CA network.

An up-to-date list is available on request from dpo@saathix.com. SaathiX ERP will notify Customers of material changes at least 30 days in advance.

SaathiX ERP implements administrative, physical and technical safeguards including AES-256 encryption at rest, TLS 1.3 in transit, principle-of-least-privilege access, quarterly VAPT, and 24×7 monitoring. See the Security Policy for details.

SaathiX ERP will notify affected Customers and the Data Protection Board of India of a Personal Data Breach without undue delay and, where feasible, within 72 hours of becoming aware, in accordance with the DPDP Act and applicable rules.

SaathiX ERP will provide reasonable assistance to Customers in responding to requests from Data Principals (end customers) exercising their rights of access, correction, erasure, or grievance redressal under the DPDP Act.

Personal data of Indian Data Principals is stored on servers physically located within India. SaathiX ERP does not transfer such data outside India except as permitted by the Central Government under Section 16 of the DPDP Act.

Upon termination, SaathiX ERP will, at the Customer's option, return or delete Customer personal data within 90 days, except where retention is required by law (e.g., 8 years for GST invoices under Section 36 of the CGST Act).