Data Processing Terms

Personal data that you or your staff enter or upload in UdyogPortal about people other than yourself, such as your customers, patients, staff, suppliers and visitors: names, phone numbers, addresses, bills and payments, bookings, attendance and salary, notes, prescriptions and health readings, photos and documents.

• Collecting the data lawfully: giving people the notice the Act requires and getting their consent, or relying on another use the law allows.
• Collecting only what your business needs, and keeping it accurate.
• Not processing a child’s data without verifiable consent from a parent or guardian, and never tracking or targeting advertising at children.
• Answering the people whose data you hold when they ask to see, correct or erase it, or withdraw consent. UdyogPortal gives you the tools to export, correct and delete records.
• Telling the Data Protection Board of India and the affected people about a personal data breach when the Act requires it, with the information we give you.
• Taking particular care with health data and with documents such as ID proofs.

• We process the data only to run UdyogPortal for you and on your instructions, which are given by how you use the service. We do not sell it, and we do not use it to advertise to anyone.
• Only people at Mahaparv Technologies LLP who need to, to run or support the service, can reach the data, and they are bound to keep it confidential.
• We protect it with reasonable security safeguards, as section 8(5) of the Act requires: encryption in transit, access control by role, separation of each business’s records, private file storage with expiring links, and logs. The Security and data breach policy describes them.
• If we confirm a personal data breach that affects your data, we tell you without delay and in any case within 24 hours, with what we know, so that you can meet your own duties.
• We help you answer requests from the people whose data you hold.
• We give you the information you reasonably need to show that these terms are kept.

We use the following service providers. Each receives only what it needs for its task and is bound to protect it:

• Hosting provider: our servers and databases.
• Cloudflare R2: storage of uploaded photos and files.
• MSG91: sending one-time passwords by SMS.
• Google Firebase: app notifications, crash reports and app usage counts (Google Analytics for Firebase).
• Google Fonts and cdnjs by Cloudflare: lettering and page tools, which receive the visitor’s IP address.
• goQR.me: QR code pictures on business websites.
• OpenStreetMap: the map pictures on the owner’s staff map, which receive the viewer’s IP address.
• Cashfree Payments: payment for UdyogPortal plans bought on the website.
• Google (Gemini) and Anthropic (Claude): AI answers, only when you use Myra and only for what you send to it.

We will update this list before we add a provider that handles your records.

Your records are kept in our database and uploaded files in Cloudflare R2 storage. Some of the providers above may process data outside India. We transfer personal data outside India only as section 16 of the Act allows, and never to a country the Government of India restricts.

When you close your business or ask for your account to be deleted, you can download your bills and reports from the app before you ask, or write to us within 30 days for a copy of your records. We then delete the personal data in them within 30 days of the confirmed request, and it is gone from backups within 90 days, except what the law requires us to keep, such as bills and payment records for 8 years.

These terms form part of the Terms of use and the Terms for businesses, and the limits of responsibility in the Terms of use apply. If these terms and another document differ about personal data you hold, these terms apply.