Data processing terms

Version 0.1 (DRAFT), 5 November 2026. This text is a draft. It can change before the service starts for paying customers.

These terms are part of the terms of service. They tell how [OPERATOR NAME] ("we") processes the business data of a workspace for the customer.

1. The roles

• The customer is the controller of the business data in its workspace: for example its parties, the CNIC numbers, its employees and its documents.
• We are the processor of this data. We process it only to give the service and only on the instructions of the customer. The use of the product by the users of the workspace is an instruction.
• We are the controller of the user accounts, the sign-in data, the security log and the billing data. The privacy notice tells about this data.

2. Our obligations

• We do not use the business data for another purpose. We do not sell it.
• Only staff who need access have access. They must keep the data confidential.
• We protect the data with technical and organisational measures (section 4).
• We help the customer to answer the requests of the persons in the data (section 6).
• At the end of the service, we delete the data (section 7).

3. Support sessions

Our staff can open a support session in the workspace to help or to investigate a problem. The session starts as view only. A change needs a second confirmation and is possible for 30 minutes at most. Staff cannot change the passwords, the users or the roles. The platform records each action. The privacy notice tells more.

4. Security measures

• An encrypted connection (HTTPS) between the browser and the service.
• A strict separation of the workspaces: the server checks the workspace of each request.
• One-way hashes of the passwords; a second sign-in step; sealed CNIC numbers and authenticator keys.
• Permissions and roles for each user; the server checks each permission.
• A security log of the important actions and a history of the changes of the business records.
• Backups of the database. After a failure of the infrastructure, we restore the newest backup. The data of up to the last 3 days can be lost.

5. Sub-processors

We use other companies (sub-processors) to give the service, for example for the hosting and for the e-mail. The list of sub-processors shows them. Before we add or replace a sub-processor, we tell the workspace administrators 30 days before. If you do not agree, you can cancel the service before the change.

6. Requests of the persons in the data

If a person asks us about the business data of a workspace, we send the request to the administrators of that workspace within 7 days. We help them to answer it.

7. Deletion at the end

At the end of the service, the workspace is read-only for a retention window (90 days by default). You can export the data in this window. Then we delete the data. The backups that contain the data expire up to 30 days later.

8. A breach of personal data

If we know of a breach of the business data, we tell the administrators of each affected workspace within 7 days. We tell them what happened, which data is affected, and what the workspace must do.

9. Language

The Urdu text is a translation. If the two texts do not agree, the English text applies.