How data is processed on your behalf.

For the business data you place into Kesarpro - customer records, invoices, ledger entries, inventory movements, payroll data - you act as the data controller. Kesarpro acts as the data processor and processes that data only on your documented instructions, which are expressed by how you configure and use the product.

The permitted purposes for which we process your business data include:

• Operating the modules you have subscribed to.
• Meeting statutory and regulatory reporting obligations in India.
• Providing support, incident response, and reasonable operational monitoring.
• Backing up, restoring and migrating your data during the term of your subscription.

We rely on a small number of sub-processors - primarily for cloud hosting, email delivery, and analytics. A current sub-processor list, along with each provider's role and processing region, is made available on request and updated when it materially changes.

By default, business data is processed within Indian data centre regions. Any cross-border processing performed by a sub-processor is covered by contractual safeguards that we can share on request.

Our technical and organisational safeguards include:

• Per-tenant isolation at the database and connection level.
• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access control with least-privilege internal operations.
• Immutable audit trails for every business-critical action.
• Regular backup, restore drills and business continuity planning.

Where you are required to respond to a request from a data subject or a regulator, we will provide reasonable technical assistance - for example by helping to locate, export, correct or delete a specific person's data - within the practical limits of the product's design.

At the end of your subscription, you can export your data through the standard export tools. Following a grace period, and subject to statutory retention obligations, your data is deleted from active systems and, over the backup rotation window, from backups.

Data processing enquiries can be raised through the contact page with the subject line "Data processing". A signed data processing agreement is available on request and can be produced quickly for Growth and Enterprise arrangements.