EaseDesk home
Log in Start free
Log in

Industries

Traders & distributors Retail shops Manufacturers Service businesses Pharma distributors Wholesalers Chartered Accountants All industries
Features Pricing Videos Free tools Questions Help Contact us

Data processing addendum

In effect from · Big Market 360 Private Limited

This addendum applies to every business that uses EaseDesk. It covers the personal data of your customers, vendors and staff that you keep in EaseDesk, and what EaseDesk does and does not do with it.

  1. 1. Roles

    For the personal data you keep in EaseDesk, you are the data fiduciary: you decide what is collected and why. Big Market 360 Private Limited ("EaseDesk") is your data processor: it handles that data only to provide the service to you. This addendum is the contract between a data fiduciary and its data processor that the Digital Personal Data Protection Act, 2023 (the DPDP Act) asks for, and its words have the meanings given in that Act and the Digital Personal Data Protection Rules, 2025.

  2. 2. What is processed

    • Whose data: your customers, vendors, leads, employees and users.
    • What data: names, addresses, phone numbers, email addresses, GSTIN and PAN, bank details you record, and the documents, payments and notes that mention them.
    • Why: to store it, show it to your users, make your documents and reports, send the emails and reminders you ask for, and back it up.
    • For how long: while your organisation is open, and as set out in section 9 after it is closed.

  3. 3. Your instructions

    EaseDesk processes your data only on your instructions. Your instructions are these terms, the settings you choose, and what you and your users do in the app. EaseDesk does not sell your data, use it for advertising, or use it to train AI models. If the law requires some other processing, you are told first unless the law forbids it.

  4. 4. Your part

    • You make sure you may lawfully keep the personal data you enter: with the consent of the people concerned, or for a use the DPDP Act allows without it. You give them the notice the Act requires, and you let them withdraw consent and use their rights.
    • You enter only the personal data you need. You do not keep a child’s data without the consent of a parent or guardian where the law requires it.
    • You answer the requests and complaints of the people whose data you keep, with our help (section 10).
    • You decide who in your organisation can see it, through roles.
    • You keep your users’ logins secure and remove access when someone leaves.

  5. 5. Confidentiality and staff access

    EaseDesk staff are bound to confidentiality. They do not see your records in the ordinary course of work. To help you, a member of staff opens a support session that needs a stated reason, lasts at most an hour, shows a banner in the app, cannot change passwords, is recorded in your audit log and is emailed to the Owner. Staff access is reviewed every quarter and removed when a person leaves.

  6. 6. Security

    EaseDesk keeps reasonable security safeguards, including:

    • encrypted connections (HTTPS) for all traffic;
    • each organisation’s records kept separate at the database level;
    • passwords stored only as one-way hashes, and two-step sign-in for staff;
    • encrypted nightly backups, with a restore tested every week;
    • an audit log of changes that nobody can edit;
    • access limited by role, with sign-ins, changes and server activity logged so that misuse can be found and stopped;
    • sign-in history and server logs kept for one year, as the DPDP Rules require, and a written incident procedure.

  7. 7. Sub-processors

    You agree to EaseDesk using the services named on the sub-processors page, each only for its job. Each is bound by contract to keep the data safe and use it only for that job. EaseDesk remains responsible to you for what they do with your data. Before a new sub-processor that handles your data is added, the page is updated and the Owner is told by email or in the app. If you object, you may stop using EaseDesk and export your data.

  8. 8. Where the data is

    The servers and the database are in India (Mumbai). Files and encrypted backups are kept in Cloudflare R2 storage. Some sub-processors may process data outside India, as the sub-processors page shows.

  9. 9. Return and deletion

    • The Owner can export everything at any time, also when the plan has lapsed: Excel files, PDFs of issued documents, uploaded files and data files in JSON.
    • When the organisation is closed, a final export is emailed to the Owners.
    • The data is kept for 90 days after closure, then the organisation’s records and files are deleted.
    • Encrypted backups that still hold it age out within a year and are not restored for any other purpose.
    • If you ask for particular personal data to be erased (for example, because a person has withdrawn consent), you can delete it in the app; where you cannot, EaseDesk erases it on your written request within 30 days, from backups as they age out.
    • Data the law requires EaseDesk to keep, such as logs for one year, is kept only for that purpose and then deleted.

  10. 10. Helping you with requests

    If a person asks you to see, correct, complete, update or erase their data, or to know who it has been shared with, you can do most of it yourself in the app, and the sub-processors page names who EaseDesk shares it with. Where you cannot, write to us and we help you within 15 days. A request or complaint that reaches EaseDesk directly about data in your organisation is passed to the Owner within 7 days, and the person is told that we have done so.

  11. 11. Breach notice

    If EaseDesk learns of a breach of personal data in your organisation, the Owners are told without delay, and within 24 hours at the latest: what happened, when, what data and how many people are affected, the likely consequences, what is being done, and whom to contact. Further facts follow as they are found. This gives you what you need to tell the people affected and the Data Protection Board of India, as the DPDP Act asks of a data fiduciary, within the 72 hours its Rules set; EaseDesk helps you with both. EaseDesk also reports the incident to CERT-In as its directions require.

  12. 12. Records and questions

    On request, EaseDesk gives you the information reasonably needed to show that it follows this addendum, such as a description of its safeguards and its list of sub-processors. On-site audits are not offered on the standard plans.

  13. 13. How this fits with the terms

    This addendum is part of the terms of service and lasts as long as EaseDesk holds your data. The limits on liability in the terms apply here too. If you need a signed copy for your records, write to hello@easedesk.com.

Big Market 360 Private Limited, F211, First Floor, Commercial Hub, B Wing, Express Zone, Goregaon East, Mumbai 400063. GSTIN 27AALCB4590L1Z4. Write to hello@easedesk.com.