Data processing agreement

This agreement is between the association that has signed up to Tuskerly (the "Association", the Data Fiduciary) and XES Event Management, Thrissur, Kerala (the "Operator", the Data Processor). It forms part of the service agreement between them. It is written against India's Digital Personal Data Protection Act, 2023.

1. What the Operator does with personal data

• Subject matter. Providing the Tuskerly association management service: member records, memberships, documents, communications and reports.
• Duration. For as long as the Association uses the service, plus the retention period in clause 9.
• Nature and purpose. Storing, organising, retrieving, displaying, exporting and deleting personal data on the Association's instructions, solely to provide the service.
• Data principals. The Association's members, office-bearers and other individuals the Association records.
• Categories of personal data. Name, date of birth, gender, email, phone, address, Membership ID, membership history, documents the Association chooses to upload (for example identity or address proof), custom fields the Association defines, consent and rights-request records, and audit records of actions taken in the platform. Payment and insurance details only if the Association enables those modules.

2. Roles and instructions

The Association decides why and how personal data is processed and is responsible for having a lawful basis and a privacy notice for its members. The Operator processes personal data only on the Association's documented instructions, which are this agreement and the Association's use of the platform's features. If the Operator believes an instruction breaches the law it will say so.

3. Security

The Operator maintains security measures appropriate to the risk, including:

• Separation of each association's data by database row-level security that is enforced for every query, with the application role never being the table owner.
• Application-level encryption of sensitive fields and documents with a key held per association, wrapped by a cloud key management service.
• Role-based access scoped to the part of the association a person serves, term-limited office-bearer access, multi-factor authentication for administrators, and re-confirmation for sensitive actions.
• A tamper-evident, append-only audit log that the Association can view and export.
• No standing access by Operator staff to the Association's member data: access is only through a time-limited support session that the Association approves and that is recorded in an access log the Association can see. Emergency access is notified to the Association immediately.
• Scanning of uploaded documents for malware before they can be opened.

4. Confidentiality

The Operator ensures that people authorised to process personal data are bound by confidentiality and receive appropriate training.

5. Sub-processors

The Association authorises the sub-processors listed on the sub-processors page. The Operator remains responsible for them, binds them to data protection terms no less protective than these, and gives notice of changes as set out on that page.

6. Transfers outside India

Personal data is stored in the regions stated on the sub-processors page. Documents and exports are held outside the European Economic Area, in the United States, only in encrypted form that the storage provider cannot read. The Association accepts these locations by using the service. The Operator will not move personal data to another country without notice.

7. Helping the Association meet its duties

• Rights requests. The platform lets the Association record and track requests for access, correction, erasure and grievances with due dates, and export or correct member records. The Operator will give reasonable further help on request.
• Personal data breach. The Operator will tell the Association without undue delay and in any case within 72 hours of becoming aware of a breach affecting its personal data, with what is then known, and will support the Association's notification to the Data Protection Board and to affected individuals, and its own reporting to CERT-In where required.
• Assessments and consultations. Reasonable assistance, where the law requires the Association to carry out an assessment.

8. Audit

The Association can see its own audit log and the log of any Operator access at any time. On reasonable notice, and not more than once a year unless a breach has occurred, the Operator will provide information necessary to show compliance with this agreement, such as its current security documentation and test summaries.

9. Ending the service and retention

• When an association leaves, its account is archived and locked and its data is retained, so that it can be restored or exported, for 12 months. The Association may ask for a full export of its data, in common formats, at any time during the service and during that period.
• After that period, or earlier on the Association's written request, the Operator will permanently destroy the association's data by destroying the keys that protect it, and will confirm in writing. Backup copies age out and are overwritten within 12 months of that destruction.
• The Operator may keep what the law requires it to keep, such as invoices and security logs, for as long as it requires.

10. Liability, term and law

• Liability. The Operator's total liability to the Association under or in connection with this agreement is limited to the fees the Association has paid to the Operator for the service in the 12 months before the event that gave rise to the claim. Neither party is liable for indirect or consequential loss. This cap does not limit liability that the law does not allow to be limited.
• Term and termination. This agreement starts when the Association signs up and continues for as long as the Operator processes personal data for it, including the retention period in clause 9. Either party may end it if the other materially breaches it and does not put the breach right within 30 days of written notice.
• Order of precedence. If this agreement and the service agreement conflict on the protection of personal data, this agreement prevails.
• Governing law and courts. Indian law governs this agreement. The courts at Thrissur, Kerala have exclusive jurisdiction.

11. Contacts

Operator: XES Event Management, hello@tuskerly.com. The Association's contact is the one given when it signs up.