This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between Ellibo, 16V-1, Mangammal Street, Tenkasi – 627851, Tamil Nadu, India ("Processor", "we", "our", or "us") and the customer ("Controller", "you") using the Ellibo cloud-based SaaS platform available at www.ellibo.com. It applies whenever we process personal data on your behalf, and is written to meet Article 28 of the EU and UK General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023. It takes effect when you accept the Terms; no signature is needed.

1. Purpose and Scope

Ellibo processes personal data only as necessary to provide and maintain the services requested by the customer, for as long as the customer uses them.

• Nature and purpose: storing, showing, sending and reporting on business records in the POS, Accounting, Inventory, CRM and Subscriptions apps.
• People concerned: your customers, leads, contacts, guests, suppliers, staff and users.
• Kinds of data: names, email addresses, phone numbers, postal addresses, tax numbers, purchase and invoice history, notes, emails, messages, call logs and recordings, bookings and reservations, and consent preferences. Ellibo is not designed for special categories of data (such as health data); please do not store them.

2. Customer Data

The customer retains ownership of all data uploaded to the Ellibo platform, including customer, employee, supplier, inventory, sales, and business information.

3. Our Responsibilities

Ellibo will:

• Process data only to provide the services and on your documented instructions (these Terms, this DPA and your use of the apps), unless the law requires otherwise; we will tell you if we believe an instruction breaks the law.
• Implement reasonable technical and organizational security measures (section 5).
• Restrict access to authorized personnel only, who are bound by confidentiality.
• Maintain the confidentiality of customer data.
• Help you answer requests from the people whose data you hold (access, copy, correction, erasure, objection) - mainly through the Personal data page (Organization Profile > Personal data), which finds a person in every app, downloads their data, erases them and keeps their consent history.
• Help you, where reasonable, with security, breach notices, data protection impact assessments and consultations with authorities.
• Make available the information needed to show we meet this DPA, and allow reasonable audits (normally by written questions, at most once a year, with 30 days' notice).

4. Customer Responsibilities

The customer is responsible for:

• Ensuring they have the legal right to collect and upload personal data.
• Providing any required privacy notices to their customers or employees.
• Getting and recording consent for marketing where the law requires it.
• Complying with applicable data protection and privacy laws.

5. Security

Ellibo uses commercially reasonable security measures to protect customer data from unauthorized access, alteration, disclosure, or destruction, including: encrypted connections (HTTPS); hashed passwords and optional two-step sign-in; every business's data kept separate; roles, permissions and hidden fields; audit logs; and regular backups. While we take reasonable precautions, no internet-based service can guarantee absolute security.

6. Personal Data Breaches

If we become aware of a breach affecting your personal data, we will tell you without undue delay - and in any case within 72 hours where we can - with what we know about it and what we are doing, so that you can meet your own reporting duties.

7. Subprocessors

You give us general authorization to use subprocessors. Ellibo uses trusted third-party service providers to deliver the services, and requires them by contract to protect customer data at least as well as this DPA does:

Services you connect with your own account - such as Razorpay or Stripe for online payments, WhatsApp, SMS and calling providers, or Google and Microsoft calendars and mailboxes - are chosen by you and work under your own agreement with them; they are not our subprocessors. We will announce new subprocessors on this page at least 30 days before they start; you may object for a good data protection reason, and if we cannot meet the objection you may end the affected service.

8. International Transfers

Ellibo is run from India and customer data is stored on servers in the United States. Where data protection law restricts such transfers (for example from the European Economic Area, the United Kingdom or Switzerland), the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) apply to them and are made part of this DPA.

9. Data Retention and Deletion

Customer data will be retained while the account remains active and for a reasonable period thereafter where required for operational, legal, or security purposes. Upon account termination, customer data may be permanently deleted after the applicable retention period, and copies in backups are overwritten as backups roll over. Customers are encouraged to export their data before closing their account (each app offers Excel / CSV downloads, and the CRM a full backup).

10. Confidentiality

Ellibo will not disclose customer data to third parties except:

• With the customer's authorization.
• To trusted service providers as necessary to operate the platform.
• Where required by applicable law or legal process (we will tell you first unless the law forbids it).

11. Limitation of Liability

This DPA is subject to the liability limitations set out in the Ellibo Terms and Conditions.

12. Governing Law

This DPA shall be governed by the laws of India, and any disputes shall be subject to the jurisdiction of the competent courts in Tenkasi, Tamil Nadu, India, unless otherwise required by applicable law (including the Standard Contractual Clauses, where they apply).

13. Contact

Questions about this DPA, or a signed copy for your records: support@ellibo.com.