Data Processing Agreement

This is Schedule 1 to the Merchant Agreement and carries its version; a change here is a change to that Agreement. Defined words have the meaning given there and in clause 1 of the Terms of Service. It applies under the Indian law in force today (the IT Act 2000 and the SPDI Rules 2011) and under the Digital Personal Data Protection Act 2023 once it commences, and, where another country's data-protection law applies to the processing, clause 13 adds the terms that law requires.

1. Scope

1.1 This Schedule applies to Customer Personal Data: personal data that Cuscato processes through the Platform about your Customers, the people you record as prospective customers (leads), and anyone else you record in the Platform. Where it conflicts with the Merchant Agreement on the processing of that data, this Schedule prevails.

1.2 Data Fiduciary and Data Processor have their DPDP Act meanings, and correspond to controller and processor. Personal Data Breach means any unauthorised processing, disclosure, alteration, loss or destruction of personal data. Sub-processor means a third party Cuscato engages to process Customer Personal Data.

2. Roles

2.1 For Customer Personal Data you are the Data Fiduciary and Cuscato is your Data Processor. For its own account, security, abuse-prevention, Finder and service records, and for the questions the assistant could not answer, which it keeps to improve the services it provides to Customers and Merchants (clause 3.2), Cuscato is the Data Fiduciary and this Schedule does not apply.

2.2 Roles follow what each party actually decides, not labels. Cuscato designs how the Platform stores and retains data, and designed the customer tier and value calculation, which the Platform runs daily for every business so your staff can see which Customers matter most to you. The tier and the estimate are part of your customer records: you are the Data Fiduciary for them, and Cuscato works them out on your behalf, as your Data Processor, and uses them for nothing of its own. Where Cuscato in fact decides the purpose of an activity, it is responsible for that activity as a Data Fiduciary. Neither party may rely on clause 2.1 to avoid a responsibility that follows from what it decided.

2.3 This Schedule allocates duties between the parties only. It does not transfer either party's legal obligations or bind a regulator.

3. Instructions

3.1 Cuscato processes Customer Personal Data only on your documented instructions: the Merchant Agreement, this Schedule, your use and configuration of the Platform, and any further written instruction agreed, including as to transfers outside the country where the data was collected. Where a law Cuscato is subject to requires other processing, Cuscato will tell you before it processes, unless that law forbids telling you. Cuscato will tell you if it believes an instruction is unlawful and may decline to follow it.

3.2 Cuscato will not sell Customer Personal Data, share it with another Merchant or use it for its own marketing. It does not use Customer Personal Data to train any model today, except the questions a Customer types in your Storefront's Ask box that the assistant could not answer (only those; an answered question, or the answered part of a message, is not kept): Cuscato keeps them for 90 days with contact details and ID numbers removed, as section 4.2D of the Privacy Policy lists, and uses them, without who asked, for a purpose of its own - to improve the services it provides to Customers and Merchants, such as the assistant itself. For that use Cuscato is the Data Fiduciary (clause 2.1). Answering a Customer's question from your Storefront and their own Orders and Bookings is processing for you (Annex A). Any other use for training will come only after new versions of this Agreement and the Privacy Policy say so, and only with what identifies a Customer removed or on a lawful basis of its own, such as the Customer's consent. Public pictures are checked automatically as clause 8.2 of the Merchant Agreement describes. A photo the Merchant submits for product suggestions (Merchant Agreement clause 2.4I), which may show a person, is processed by AI only to produce suggestions for that request and is not kept unless the Merchant adds it to a product, where it is kept as a product photo. An outside artificial intelligence service is used only as section 4.3 of the Privacy Policy describes. Aggregate operational and security data that identifies no individual may be used to run and improve the Platform.

4. Security and confidentiality

4.1 Cuscato maintains reasonable security safeguards appropriate to the data and the risk, described in Annex B. It may improve them but will not materially weaken them during the Term.

4.2 Access to Customer Personal Data is limited to people who need it to run, secure or support the Platform, bound by confidentiality. This Schedule is the contract referred to in section 72A of the IT Act.

5. Sub-processors

5.1 You authorise the Sub-processors in Annex C. Before disclosing Customer Personal Data to any Sub-processor, Cuscato will bind it in writing to protections no weaker than this Schedule (for Meta, the WhatsApp Business data processing terms Meta sets for every business using WhatsApp, which Cuscato and its messaging providers accept and cannot negotiate), and remains responsible to you for each of them.

5.2 Cuscato gives at least 30 days' notice before adding or replacing a Sub-processor, including any payment provider, messaging gateway or artificial intelligence service. If you object on reasonable data-protection grounds and we cannot resolve it, you may end the Merchant Agreement and receive a refund of the unused part of the current billing period.

5.3 An AI assistant you connect to your business (Merchant Agreement clause 9.4) is not a Sub-processor: you choose it and its provider, and Cuscato makes Customer Personal Data available to it only on your instruction, given when your owner or an administrator approves it, and only while it stays connected. Your terms with that provider govern what it does with the data.

6. Payments

No payment passes through the Platform and no payment provider receives Customer Personal Data from Cuscato; your Customers pay you through your own arrangements. For each payment recorded for you the Platform keeps the amount, method, time and payment references (for a card payment, its last four digits, issuer and authorisation code), whether it was taken as an advance, and any note your staff add, for reconciliation only, and never stores a full card number, card expiry date, CVV, UPI PIN, or a payer's UPI ID or bank account number: under the Reserve Bank of India's card-on-file rules (effective 1 October 2022) only the last four digits and the issuer's name may be kept. A payment provider you connect in Settings > Payment Setup is engaged by you under your own contract and is not Cuscato's Sub-processor, and the provider pays you directly. The API keys you give Cuscato for it are stored encrypted, never shown again, and used only to: make payment links on your account for your Orders, each with the Order's number, the amount owed and your business's or outlet's name, and, where the provider requires a phone number, your outlet's phone, never a Customer's details; where you switch it on, make a UPI QR code for one Order (Razorpay, PhonePe) or a link that offers UPI only (Cashfree) with the same details; ask the provider whether a link or QR code was paid; cancel an Order's other open links once one of them is paid, its open links when your team changes the Order's price or the Order is cancelled, and those asking more than is still owed when your team records a payment for it, where the provider allows it; and check the keys when you ask. A payment the provider reports for a link may be recorded on the Order as above; the Platform does not promise that every payment is recorded, or when, so check your provider's dashboard and record any payment that is missing. Switching the connection off stops new links; removing it deletes its keys and its links, and closing your business deletes its keys and all its links. A payment provider engaged by Cuscato itself will not be enabled until it is listed in Annex C, a data processing contract with it is in place, and the Merchant Agreement is re-published under a new version. Your own and your outlets' UPI IDs, payment links and payment notes are stored and shown to your Customers; a UPI QR code is made in the Customer's browser. A payment link your team attaches to an Order is shown to that Order's Customer and your team and sent in that Customer's order emails; it may carry Customer details your provider puts in it, and it is cleared when the Customer deletes their account or the business closes. A pay page link your team shares for an Order shows your or your outlet's name, the Order number, the amount owed and your UPI ID, and nothing about the Customer; the Platform keeps only whether it is live, who shared it and when. The payment details a Customer sends for an Order - a UPI reference, and when signed in a screenshot kept as an Order picture - are kept with the Order with your team's decision on them (or that they closed unchecked: 7 days without a decision, or the Order cancelled), for you to check against your own UPI app or bank; the Platform checks nothing with any bank. A recorded payment keeps its reference as above.

7. Assistance

7.1 A request from a Customer to access, correct or erase their data is passed to you to answer, and Cuscato helps you answer it using the Platform. The one exception is a Customer deleting their own account on the Platform, which you instruct Cuscato to carry out as clause 9.3 describes.

7.2 You are responsible for the notices you give your Customers and any consent you rely on. That includes people you record as leads or who were referred to you, who may never have used the Platform: you tell them what you hold and why as the law requires, and contact them only where you lawfully may.

7.3 Taking into account what the Platform does and the information available to it, Cuscato gives you reasonable help, on request, with your duties on security, Personal Data Breaches, data protection impact assessments and consulting a regulator.

8. Personal Data Breach

8.1 Cuscato will notify you after becoming aware of a Personal Data Breach affecting Customer Personal Data, with the information you reasonably need for your own notifications. You make the notifications the law requires of you as Data Fiduciary.

8.2 Cuscato's own duties - reporting cyber incidents to CERT-In and keeping logs in India for 180 days - are its own. A notification is not an admission of fault.

9. Retention and deletion

9.1 Subject to 9.3 to 9.6 and 9.8, Customer Personal Data is kept while your subscription is active. When your business is closed it is deleted, except the Order and Invoice records kept read-only under clauses 12.4 and 12.5 of the Merchant Agreement, which are deleted automatically eight years after closure.

9.2 Apart from 9.1, 9.3 to 9.6 and 9.8 the Platform does not delete data on its own. Cuscato will act on your written erasure instruction. An Order keeps a snapshot of what was ordered, the billing and delivery details, its Invoice (if the Platform generated one), its payments and its history of changes, so an erasure instruction must cover Orders as well as Customer records. You decide what tax law requires you to keep.

9.3 A Customer deleting their own account. This applies when a Customer deletes their account on your Storefront, and to every Storefront they are linked to when they delete their whole Cuscato account. Their login is deleted, and in the records linked to that account their name, email address, phone number, saved addresses, notes and marketing consent, the contact details and notes on their Orders and Bookings, the pictures and notes they added to their Orders and the payment details they sent for them while signed in (and any note on those Orders that names them, which is replaced by a line saying so), their custom order requests that did not become Orders (and the description, needed-by date and budget of those that did), the delivery photos and signatures for their Orders, any location they shared at checkout, and the files they uploaded. Each Order's items, amounts, taxes and Invoice stay exactly as issued, and so does the Order's history of changes without their network address, device or location. A record your staff made of the same person that was never linked to their account, such as a lead, is yours: they ask you to change or delete it.

9.4 Delivery records. The delivery photos and signatures your delivery staff capture are kept until you delete them. From Settings, an owner may delete those older than a number of months you choose, for example to free storage on your plan; they cannot be recovered afterwards, and keeping the evidence you need is your responsibility.

9.5 Customers' pictures. A picture a Customer attaches to an Order is deleted automatically one year after the later of the day it was added and the day the Order ends (completed, delivered or cancelled; for an Order that never ends, the day it was placed), and kept while a complaint to Cuscato about the Order is open. It does not count towards your storage. The payment details Customers sent for the Order are deleted at the same time.

9.6 Custom order requests. A request that does not become an Order is deleted automatically, with its pictures and notes, 90 days after it is declined, withdrawn or expires. One that becomes an Order follows that Order.

9.7 Product counts. To avoid counting a Storefront visitor more than once a day per product, the network address of a visitor is held only in the server's memory, as a keyed hash, for at most two days; a restart forgets it, so the counts are close but not exact. Only counts per product, outlet and day are stored, with nothing that identifies a visitor, and they are kept 90 days.

9.8 Demo businesses. On a demo business (Merchant Agreement clause 12.7) the Platform deletes Customer Personal Data when the demo is reset - every day at 00:00 UTC unless Cuscato has switched that off for it, and whenever Cuscato chooses - and when Cuscato deletes a kind of content from it. A record that a person accepted the terms stays with that person's account.

10. Location and transfers

Customer Personal Data is held on servers and a database run for Cuscato by its hosting providers (Annex C), in locations Cuscato chooses and tells you on request; today they are in the European Union, and Cuscato's team reaches them from India (Privacy Policy, section 13). Any transfer of Customer Personal Data outside India will meet the SPDI Rules (the recipient must give the same level of protection, and the transfer must be necessary for the contract or consented to) and, once in force, section 16 of the DPDP Act. Where the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection governs a transfer, clause 13 applies.

11. Information and audit

Cuscato will give you the information reasonably needed to show compliance with this Schedule and answer one reasonable security questionnaire a year. It holds no ISO 27001 certificate or SOC 2 report. Any on-site audit your regulator requires will be agreed in advance, at your cost, under confidentiality and without access to other Merchants' data.

12. Liability and term

Liability under this Schedule is governed by clause 11 of the Merchant Agreement; this Schedule creates no separate cap. This Schedule lasts as long as Cuscato processes Customer Personal Data, and clauses 4, 8, 9, 10 and 13 survive to the extent processing or an obligation survives.

13. Other countries' data-protection law

This clause applies where the law it names applies to the processing of Customer Personal Data, for example because you offer goods or services to people in the European Economic Area, or because your business is established outside India (clause 18 of the Merchant Agreement). Where it conflicts with the rest of this Schedule, this clause prevails for that processing.

13.1 GDPR, UK GDPR and Swiss law: processor terms. Cuscato, as your processor: processes only on your documented instructions (clause 3.1); ensures that the people authorised to process are bound by confidentiality (clause 4.2); takes the measures Article 32 GDPR requires (clause 4.1 and Annex B); engages Sub-processors only as clause 5 says, under a written contract imposing the same data-protection obligations, and stays liable for them; helps you answer requests from individuals exercising their rights (clause 7.1), and with your duties under Articles 32 to 36 (clause 7.3); notifies you of a Personal Data Breach without undue delay after becoming aware of it, as Article 33(2) requires (clause 8.1); at the end of the services, returns the data through the export in clause 12.4 of the Merchant Agreement or deletes it, as you choose, except what the law requires to be kept (clause 9); and makes available the information needed to show compliance with Article 28 and allows for and contributes to audits, including inspections, by you or an auditor you mandate, on reasonable notice, at your cost, under confidentiality and without access to other Merchants' data (clause 11). Cuscato will tell you if, in its opinion, an instruction infringes data-protection law. Annex A sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of individuals.

13.2 Transfers from the European Economic Area. Where you, as controller, transfer Customer Personal Data to Cuscato, or Cuscato transfers it to a Sub-processor, and the transfer is to a country without an adequacy decision and is restricted under Chapter V GDPR, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated into this Schedule: Module Two (controller to processor) between you as data exporter and Cuscato as data importer, and Module Three (processor to processor) where Cuscato is the exporter. For them: the optional docking clause is not used; under Clause 9(a), Option 2 applies, with the notice period in clause 5.2; the optional wording in Clause 11(a) is not used; under Clause 13, the supervisory authority is the one Clause 13(a) designates; under Clause 17, Option 2 applies, and where the law of the Member State in which the data exporter is established does not allow third-party beneficiary rights, the law of Ireland governs; under Clause 18(b), disputes go to the courts of the Member State whose law governs. Annex I to the clauses is completed by the parties as identified in the Merchant Agreement (you, as the business that accepted it; Cuscato, as data importer, contact support@cuscato.com; ) and by Annex A, Annex II by Annex B, and Annex III by Annex C. If the clauses conflict with this Schedule, the clauses prevail.

13.3 Transfers from the United Kingdom. For a restricted transfer under the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018 is incorporated: its Part 1 tables are completed by 13.2 and the Annexes (in Table 4, either party may end it if the approved addendum changes), and its Part 2 mandatory clauses apply.

13.4 Transfers from Switzerland. For a transfer subject to the Swiss Federal Act on Data Protection, the clauses in 13.2 apply with these changes: references to the GDPR include that Act; the competent supervisory authority is the Federal Data Protection and Information Commissioner; and the term "Member State" is not read so as to stop individuals in Switzerland from suing for their rights where they habitually reside, as Clause 18(c) allows.

13.5 United States state privacy laws. Where the California Consumer Privacy Act, as amended, or a similar state law applies, Cuscato is your service provider (or processor) and processes the personal information you disclose to it only for the business purpose of providing the Platform as this Schedule describes (Annex A). Cuscato will not sell or share it; will not keep, use or disclose it for any other purpose, including any commercial purpose of its own, or outside the direct business relationship with you; will not combine it with personal information it receives from or on behalf of anyone else or collects from its own dealings with the individual, except as those laws allow; will comply with those laws and give the same level of privacy protection they require; will tell you if it can no longer meet these obligations; lets you take reasonable and appropriate steps to make sure it uses the information in line with them, and to stop and remedy any use that is not; and binds any Sub-processor to the same terms.

13.6 United Arab Emirates. Where Federal Decree-Law No. 45 of 2021 applies, Cuscato processes Customer Personal Data only on your instructions and for the purposes and period this Schedule sets, keeps it secure as clause 4 says, keeps the records of processing that law requires of a processor, does not disclose it except as this Schedule allows or the law requires, and deletes it as clause 9 says.

Annex A - the processing

Annex B - security measures

• Separation between Merchants is enforced by the database itself: a record cannot reference another Merchant's record even if application code is wrong.
• No passwords are stored. Sign-in codes are stored only as a keyed hash, expire, can be used once, and have a hard limit on wrong attempts.
• No payment credential is stored (clause 6).
• Session tokens travel in a request header rather than a cookie and are checked against the Merchant on every request.
• Each change to an Order is recorded with the account that made it and when.
• Requests for and attempts at sign-in codes are rate-limited.
• Uploaded images are held in the Platform's own database.

Annex C - Sub-processors

The name and location of each Sub-processor are available on request. No payment provider, advertising or artificial intelligence service receives Customer Personal Data; the analytics service above sees how pages are used with the text of Customer Personal Data hidden, and the messaging providers above receive only a mobile number and the text of a message sent to it. Map links in the Platform open a delivery address, the location a Customer shared at checkout, or a recorded delivery position in Google Maps only when a user follows one, and following it sends that address or position to Google. A map shown during a delivery is fetched by the viewer's own browser from OpenFreeMap, which then receives the viewer's network address, the address of the Merchant's site and the map area on screen (around the delivery address, the outlet and the rider, moving with the rider), never a name, an Order or an exact position. Requests: support@cuscato.com with "Privacy" in the subject.