This Data Processing Agreement ("DPA") forms part of the Terms of Service between Aasure Company Private Limited ("Aasure", the "Processor") and the business using the Service ("Customer", the "Controller"). It applies whenever Aasure processes Customer Personal Data on the Customer's behalf. No signature is needed: it takes effect when the Customer accepts the Terms.
1.Definitions
- "Customer Personal Data" means personal data about the Customer's clients, staff and other individuals that the Customer or its users put into the Service, or that is collected through the Customer's booking pages, websites and forms.
- "Data Protection Law" means all laws that apply to the processing, including the Digital Personal Data Protection Act, 2023 (India) and its rules, the UK GDPR and Data Protection Act 2018, and US state privacy laws.
- "Controller", "Processor", "Data Fiduciary", "Data Principal", "personal data", "processing" and "personal data breach" have the meanings given in Data Protection Law. Where Indian law applies, "Controller" includes "Data Fiduciary" and "Processor" includes "Data Processor".
- "Subprocessor" means a third party Aasure engages to process Customer Personal Data.
2.Roles
The Customer is the Controller of Customer Personal Data and decides why and how it is processed. Aasure is the Processor and processes it only on the Customer's behalf. Aasure is a separate Controller only for account, billing, security and usage data it needs to run its own business, which is covered by the Privacy Policy, not this DPA.
3.Customer instructions
Aasure will process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's use and configuration of the Service are the Customer's complete instructions. Aasure will tell the Customer if it believes an instruction breaks Data Protection Law, unless the law prevents it. If the law requires Aasure to process data in another way, it will tell the Customer first unless the law forbids that.
The Customer is responsible for the lawfulness of its instructions and for having a lawful basis, notices and consents for the Customer Personal Data it provides.
4.Confidentiality
Aasure ensures that anyone it authorises to process Customer Personal Data is bound by confidentiality and only accesses it as needed to provide, support or secure the Service.
5.Security
Aasure implements and maintains the technical and organisational measures in Annex 2, appropriate to the risk. Aasure may update these measures as long as the overall level of protection is not reduced.
6.Subprocessors
- The Customer gives general authorisation for Aasure to use Subprocessors. The current list is at aasure.app/subprocessors.
- Aasure will impose data protection obligations on each Subprocessor that are no less protective than this DPA, and remains responsible for their performance.
- Aasure will update the list and email the Customer's account owner at least 30 days before a new Subprocessor starts processing Customer Personal Data, except where an urgent change is needed to keep the Service running.
- The Customer may object on reasonable data protection grounds within that notice period by emailing contact@aasure.app. The parties will discuss the concern in good faith. If it cannot be resolved, the Customer may end its subscription and Aasure will refund any prepaid fees for the unused period after termination.
7.Requests from individuals
The Service lets the Customer access, correct and delete most Customer Personal Data itself. Where it cannot do so, Aasure will provide reasonable help with requests from individuals exercising their rights. If Aasure receives a request directly, it will not respond to it on its merits, except to point the individual to the Customer, and will pass it to the Customer without undue delay.
8.Personal data breaches
Aasure will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the data and individuals affected, the likely consequences and the steps taken. Aasure will take reasonable steps to contain and remedy the breach and will help the Customer meet its own notification duties, including to the Data Protection Board of India, the UK Information Commissioner's Office, and affected individuals.
9.Assistance
Taking into account the information available to it, Aasure will provide reasonable assistance with the Customer's data protection impact assessments and consultations with regulators relating to the Service.
10.Deletion at the end of the Service
The Customer can retrieve its Customer Personal Data from the Service while its account is active. After the Customer's business is deleted, Aasure will keep Customer Personal Data for 30 days and then delete it, unless the law requires Aasure to keep it. Data in backups is overwritten on the normal backup cycle and is protected in the meantime.
11.Information and audits
On written request, Aasure will provide the information reasonably needed to show that it complies with this DPA, including answers to security questionnaires and its Subprocessors' published certifications. If that information is not enough, or a regulator requires it, the Customer may carry out an audit no more than once a year, with at least 30 days' notice, during business hours, at its own cost, under confidentiality, and in a way that does not disrupt the Service or reveal other customers' data.
12.International transfers
Aasure is based in India and stores Customer Personal Data in the United States. The Customer authorises these transfers.
- From the United Kingdom: where a transfer of Customer Personal Data to Aasure is a restricted transfer under the UK GDPR, the International Data Transfer Agreement issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 is incorporated into this DPA by reference, with the Customer as exporter, Aasure as importer, the details in Annex 1 and the security measures in Annex 2.
- From India: transfers are made as permitted by the Digital Personal Data Protection Act, 2023, and Aasure will comply with any restrictions the Government of India notifies.
- Onward transfers to Subprocessors are protected by appropriate safeguards required by Data Protection Law, such as standard contractual clauses.
13.US state privacy laws
Where US state privacy laws apply, Aasure acts as the Customer's "service provider" or "processor". Aasure will not sell or share Customer Personal Data, will not retain, use or disclose it for any purpose other than providing the Service, will not combine it with personal data from other sources except as those laws allow, and will tell the Customer if it can no longer meet these obligations.
14.Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. This DPA lasts for as long as Aasure processes Customer Personal Data.
Annex 1.Details of processing
- Subject matter and purpose: providing the Service to the Customer — bookings, scheduling, client management, records of payments, email marketing, websites, AI assistance and support.
- Duration: the term of the Customer's use of the Service, plus the deletion period in section 10.
- Nature of processing: collection, storage, organisation, retrieval, use, transmission, display and deletion.
- Individuals: the Customer's clients and prospective clients, email subscribers, staff and team members, and visitors to the Customer's booking pages and websites.
- Categories of data: names, contact details, addresses, dates of birth, booking and appointment history, notes, form responses, marketing preferences and email engagement, records of payments the Customer enters (never card numbers), staff schedules, images and files, and any other data the Customer chooses to add.
- Sensitive data: not intended. Under the Acceptable Use Policy, the Customer must not store medical records or other health information in the Service.
- Frequency: continuous.
Annex 2.Security measures
- Encryption: TLS for all data in transit; encryption at rest by our hosting and database providers; additional application-level encryption for connected-account credentials; passwords stored only as one-way hashes.
- Tenant isolation: every request that reads or writes business data is scoped to that business, and each business's data is separated from every other business's in the application layer.
- Access control: role-based permissions inside each business; staff access to production systems limited to what is needed and protected by multi-factor authentication.
- Authentication: secure, HTTP-only session cookies; sign-in rate limiting and bot protection.
- Monitoring: error monitoring with personal data scrubbed and screen replays masked; application logs and traces.
- Resilience: managed database with backups; infrastructure hosted by established providers.
- Deletion: soft-deleted records permanently removed after 30 days by automated jobs; connected-account credentials deleted on disconnect.
- Suppliers: Subprocessors bound by written data protection terms.