Data processing addendum

#When this applies

This addendum is part of our Terms of service and your proposal or agreement. It applies when Retales processes personal data on your behalf, for example your leads, customer lists, ad audiences, CRM records, or people who appear in content we make for you. For that data you are the Data Fiduciary (controller) and Retales is your Data Processor, under section 8(2) of the DPDP Act and Article 28 of the GDPR.

#What Retales will do

• Process the data only on your documented instructions (your brief, proposal and portal settings), and tell you if we think an instruction breaks the law.
• Make sure everyone who handles it is bound by confidentiality.
• Protect it with the security measures in our Privacy policy, including encryption in transit, role-based access, two-step login for staff and logging.
• Use only the sub-processors listed below, under written terms at least as protective as these.
• Help you answer requests from people using their rights, and with impact assessments, where reasonable.
• Tell you without undue delay, and within 48 hours of becoming aware, about a personal data breach affecting your data, with what we know and what we're doing, so you can meet your own reporting duties.
• At the end of the engagement, delete or return the data within 30 days, as you choose, unless the law requires us to keep it.
• Give you the information you reasonably need to show compliance, and allow one audit a year with 30 days' notice, at your cost and under confidentiality.

#What you will do

• Make sure you have a lawful basis, and have given the notices and got the consents needed, to share the data with us and have us process it.
• Give us only the data needed for the work.
• Not ask us to process sensitive data (such as health, financial or children's data) unless we've agreed in writing.

#Sub-processors

We'll tell you at least 14 days before adding or replacing a sub-processor that will handle your data. If you have a reasonable data protection objection, tell us at grievance@retales.in and we'll try to find a solution. If we can't, you can end the affected service and get a pro-rata refund of prepaid fees for it.

#International transfers

If you're in the EU, EEA or UK and send us personal data, the European Commission's Standard Contractual Clauses (Decision 2021/914, Module 2 for controller to processor, or Module 3 where you are yourself a processor) and, for UK data, the UK International Data Transfer Addendum, are incorporated into this addendum by reference. Retales is the data importer and you are the data exporter. The description of processing is your proposal, and the security measures are those in our Privacy policy. Transfers out of India follow section 16 of the DPDP Act.

#Liability and order of precedence

Liability under this addendum is subject to the limits in our Terms of service, except where the law doesn't allow it. If this addendum conflicts with the Terms of service on data protection, this addendum wins. If the Standard Contractual Clauses apply and conflict with either, the Clauses win. For a signed copy, email sales@retales.in.

Business

Retales India, a registered business in India

Registered office

DLF Prime Tower, Pocket F, Okhla Phase I, Okhla Industrial Estate, New Delhi, Delhi 110020, India

Grievance Officer

Grievance Officer, Compliance and Legal Desk, grievance@retales.in

Privacy and data requests

grievance@retales.in (subject: "Data Principal Request")

General support

hello@retales.in

Phone and WhatsApp

+91 9889889866