Data Processing Terms

1. What these terms are

These Data Processing Terms ("DP Terms") are part of the agreement between the turf owner ("you") and TurfWise ("TurfWise", "we"). They apply to personal data that you or your customers enter into the Service for your turf ("Customer Data"). In the words of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), you are the data fiduciary and we are your data processor for Customer Data.

For personal data about you and your staff, and for our own billing and security, we decide the purposes and means ourselves. That is covered in our Privacy Policy, not here.

2. What we process

• Purpose: running your bookings, invoices, payment records, credit, messages to your customers, reports and your public booking page.
• Data subjects: your customers and, where entered, people named in your notes.
• Data: customer name, phone, email, optional billing name, address and GSTIN, booking, payment, refund and credit records, notes you add, and the marketing consent flag.
• Duration: while your account is active, then as set out in section 9.

3. Your instructions

We process Customer Data only on your documented instructions. These DP Terms, your use of the Service and the settings you choose are your instructions. We will not use Customer Data for our own purposes, sell it, or use it to build profiles for advertising.

If we think an instruction breaks the law, we will tell you and may stop processing it. We may process Customer Data when the law requires, and will tell you first where we can.

4. Your duties as the data fiduciary

You are responsible for having a lawful basis to collect the data, for giving your customers the notice the law requires, for getting and recording consent where needed (including for marketing), for keeping the data correct, for dealing with customers' requests and complaints, and for informing them of any breach where the law needs it.

Do not put into the Service data you have no right to use, or data of a kind the Service is not meant to hold (see our Terms).

5. Confidentiality and our staff

We allow access to Customer Data only to people who need it to run, support and secure the Service, and who are bound to keep it confidential.

6. Security

We use reasonable security measures suitable for the risk. These include separation between turfs' data, role-based access, encryption of payment keys with separate keys, an audit log, secured connections, and a bot check on public booking. See our Security page and Privacy Policy, section 8. We review these from time to time. We do not promise that no breach will ever happen.

7. Sub-processors

You agree that we may use these sub-processors: Supabase (database, sign-in, storage), Vercel (hosting), Resend (email delivery), Cloudflare (bot check), and Razorpay (only for payments made to your own Razorpay account, which are between you and Razorpay).

If you switch on marketing tools (Google Analytics, Meta Pixel and the server-side purchase event), you choose those providers. They act for you, not for us.

We have a written contract with each sub-processor that requires them to protect the data at least as much as these DP Terms. We stay responsible for their work on our part.

We will tell you by email or in the app at least [14] days before we add or replace a sub-processor. If you object on reasonable grounds, we will try to find a solution, and if we cannot, you may close your account.

8. Helping you with requests, and breaches

If one of your customers writes to us about their data, we will pass the request to you and not answer it ourselves, unless the law says we must. Within the Service you can view and correct customer records. For anything you cannot do yourself, such as erasing a customer's details, write to support@turfwise.in and we will help within a reasonable time.

If we become aware of a personal data breach affecting Customer Data, we will tell you without undue delay and in any case within [48 hours], with what we know about what happened, what data is involved and what we are doing. You decide whether and how to notify the Data Protection Board and your customers, and we will give reasonable help. [Lawyer: the Rules put the 72-hour report duty on the fiduciary; confirm the processor period.]

We will also help you, on reasonable request, with any data protection assessment or regulator enquiry that concerns Customer Data.

9. Ending, return and deletion

When your account ends, we will for [30] days let you ask for a copy of Customer Data in a common format. After that we will delete or anonymise Customer Data, except records the law makes us keep. Tax records (bills, credit notes, payments, refunds and the customer details printed on them) are kept for 72 months from the due date of the annual GST return (section 36 of the CGST Act). During that time we use them only for that purpose.

Copies in backups expire on the normal schedule. We do not manually alter backups.

10. Information and audits

On reasonable written request, we will give you the information needed to show we follow these DP Terms. We do not allow on-site audits of our providers' premises. If a regulator requires an audit, we will co-operate.

11. Transfers outside India

Some sub-processors may handle Customer Data outside India. We will not transfer it to a country the Government of India has restricted. See the Privacy Policy, section 5. [Lawyer: confirm after hosting region is verified.]

12. Liability and order of documents

The limits on liability in the Terms of Service apply to these DP Terms, except where the law does not allow them. If these DP Terms conflict with the Terms of Service about Customer Data, these DP Terms win.

Questions: support@turfwise.in.