Data Processing Agreement

• Data: buyer names, delivery addresses, phone numbers and order details from the Customer's marketplace accounts; the Customer's staff user details.
• Purpose: order, return, inventory, payment and reporting functions of SellSutra, as instructed by the Customer.
• Duration: for as long as the Customer uses SellSutra, plus the deletion period below.

• Process personal data only on the Customer's documented instructions and for no other purpose.
• Ensure everyone with access is bound by confidentiality.
• Apply reasonable security safeguards, including encryption, access control, logging and backups (see our Security page).
• Help the Customer respond to data principal requests and meet its DPDP obligations.
• Keep processing logs for at least one year.

Beact uses carefully chosen service providers for hosting, email delivery and payments. Each is bound by written terms that protect the data. We will tell Customers before adding or replacing a sub-processor that handles their buyers' data, and a current list is available on request.

Customer data in SellSutra is stored in India.

If Beact becomes aware of a personal data breach affecting Customer data, we will inform the Customer without undue delay, and in any case in time for the Customer to meet its 72-hour reporting duty. We will also report cyber incidents to CERT-In within 6 hours as required by its directions.

When the Customer closes their account, Beact will return the Customer's data on request and delete it within 30 days, except where the law requires longer retention.

On reasonable notice, Beact will provide information needed to show compliance with this DPA, including summaries of security assessments.

Data protection questions: Jignesh Kheni, jignesh@beactinfotech.com