SachDesk

Data Processing Addendum

Last updated on October 8, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between SachDesk Technology Services Private Limited (“SachDesk”, “we”, “us”) and the customer that subscribes to Samvaads (“Customer”, “you”) under our Terms and Conditions or a signed Service Agreement (together, the “Agreement”). It applies whenever we process Customer Personal Data on your behalf while providing Samvaads (the “Service”). Accepting the Agreement accepts this DPA. If you need a signed copy, contact contact@sachdesk.com.

1. Definitions

  • Customer Personal Data means personal data that you, your users, or your customers put into a Samvaads workspace, or that the Service receives from channels, stores and apps you connect to it, and that we process on your behalf.

  • Data Protection Laws means the laws that apply to that processing, including India’s Digital Personal Data Protection Act, 2023 and its rules, the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and similar laws.

  • Controller, processor, data subject, processing and personal data breach have the meanings given in the GDPR. Under India’s law, you are the Data Fiduciary and we are your Data Processor.

  • Subprocessor means a third party we engage to process Customer Personal Data, as listed on our Subprocessors page.

2. Roles and instructions

You are the controller of Customer Personal Data and we are your processor. We process it only to provide the Service, on your documented instructions. The Agreement, this DPA, and the way you configure and use the Service are your instructions. If we believe an instruction breaks Data Protection Laws, we will tell you. We may also process data where the law requires us to; in that case we will tell you first unless the law forbids it.

You are responsible for having a lawful basis for the data you put into the Service, for the notices you give your customers, and for the consents you collect, including consent to marketing messages sent through the Service.

3. Details of the processing

Subject matter and purpose Providing Samvaads: shared inbox and tickets across messaging, email, voice and web channels; contacts and accounts; knowledge base and customer portal; campaigns and customer journeys; AI features (Copilot and AI agents); connected stores, apps and integrations; reporting; support.
Duration The term of the Agreement, plus the deletion periods in section 10.
Data subjects Your users (agents and administrators); your customers, leads and other people who contact you or whom you contact through the Service; people whose data you import.
Categories of personal data Names, email addresses, phone numbers and channel identifiers; message, email, call and chat content, attachments and recordings; ticket, conversation and activity history; order, checkout and product data from connected stores; consent and communication preferences; user account, sign-in and audit data; any other data you choose to store in the Service.
Special categories None are required. If your customers send special category data in their messages, you are responsible for having a lawful basis to process it.

4. Confidentiality

We give access to Customer Personal Data only to staff who need it to provide, support or secure the Service, and they are bound by confidentiality. Our staff do not read your workspace data unless you ask us to for support, it is needed for security, or the law requires it.

5. Security

We maintain the technical and organisational measures in Annex 1 and review them regularly. We may improve them over time, but we will not reduce the overall level of protection.

6. Subprocessors

You authorise us to use the subprocessors listed on our Subprocessors page. We impose data protection terms on each of them that are no less protective than this DPA, and we remain responsible for their work.

Before a new subprocessor starts processing Customer Personal Data, we will update that page and email the workspace owners at least 15 days in advance, unless an urgent change is needed to keep the Service running or secure, in which case we will tell you as soon as we can. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may end the affected Service and we will refund any prepaid fees for the unused period.

Channels, stores and apps you connect with your own accounts (for example your WhatsApp Business account, your Shopify or WooCommerce store, or your own email domain) are not our subprocessors. Your relationship with those providers is governed by your agreements with them.

7. Helping you respond to requests

The Service lets you find, export, correct and delete personal data, for example by exporting your workspace data or deleting a contact. Where you cannot do something yourself, we will help you respond to data subject requests, taking into account the nature of the processing. If a data subject contacts us directly about data in your workspace, we will direct them to you and will not respond to the request ourselves unless you ask us to or the law requires it.

For stores connected through our Shopify app, we process Shopify’s customer data requests, customer erasure requests and store erasure requests automatically, as described in our Privacy Policy.

We will also give you reasonable help with data protection impact assessments and consultations with regulators that relate to the Service.

8. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify the workspace owners by email without undue delay, and in any event within 72 hours. We will tell you what happened, what data and how many people are likely to be affected, what we have done and are doing to contain it, and who you can contact, and we will send updates as we learn more. We will take reasonable steps to contain the breach and reduce its effects, and help you meet your own obligations to notify regulators and affected people. Notifying you is not an admission of fault.

9. International transfers

We host Customer Personal Data in the hosting region of your workspace. Today every workspace is hosted in India (AWS and MongoDB Atlas, Mumbai region). As we add hosting regions in the European Union, the United States and Asia-Pacific, we will list them on the Subprocessors page; a workspace’s data stays in its hosting region except as shown on that page, and we will not move an existing workspace to another region without your agreement. Some subprocessors may process data in other countries, as shown on the Subprocessors page.

Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA, with you as data exporter and us as data importer. For those Clauses: the optional docking clause (Clause 7) applies; under Clause 9 the general written authorisation and notice period in section 6 apply; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by the laws of, and disputes resolved by the courts of, Ireland; and Annexes I and II are completed by section 3 and Annex 1 of this DPA. For UK personal data, the UK International Data Transfer Addendum to those Clauses applies. If these Clauses conflict with this DPA, the Clauses prevail.

10. Deletion and return

During the Agreement you can export your workspace data at any time. When a workspace closes, it stays available read-only for 30 days so you can download a copy, and we then keep its data for a further 30 days in case you ask us to reopen it. After that we permanently delete it from our active systems, and backup copies expire within our backup retention period. We keep only what the law requires us to keep (for example billing records) and records that the workspace existed and was deleted. See “Closing a Samvaads workspace” in our Terms and Conditions.

11. Information and audits

We will make available the information reasonably needed to show that we meet this DPA, including answers to a reasonable security questionnaire once a year. If that information is not enough, or a regulator requires it, you may audit our compliance with this DPA on at least 30 days’ notice, during business hours, no more than once a year (unless after a personal data breach), under confidentiality, and at your own cost. Audits of our subprocessors are carried out through their own audit reports and certifications.

12. General

This DPA is subject to the limitations of liability in the Agreement. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. It lasts as long as we process Customer Personal Data for you. We may update it to reflect changes in the law or the Service; we will not reduce the protection it gives you without your agreement, and we will post the updated version on this page. Except as stated in section 9, this DPA is governed by the governing law of the Agreement.

Annex 1: Technical and organisational security measures

  • Hosting: Amazon Web Services and a dedicated MongoDB Atlas cluster in the workspace’s hosting region (today Mumbai, India).

  • Workspace isolation: each workspace has its own database and its own file storage bucket; workspace data is not pooled with other customers’ data.

  • Encryption: all connections to the Service use TLS. Databases, file storage and backups are encrypted at rest. Credentials for channels, stores and apps you connect are also encrypted inside our database with AES-256-GCM.

  • Backups: production databases are backed up every hour, and backups are kept for 7 days and encrypted.

  • Access control: production access is limited to named staff on a need-to-know basis. Staff use company accounts with multi-factor authentication. Our internal operations console requires multi-factor authentication, uses role-based permissions and records staff actions in an audit log.

  • Your controls: role-based permissions for your users, multi-factor authentication, single sign-on, and an activity log of Copilot actions in your workspace.

  • Application security: sign-in rate limiting and bot protection, signed and verified webhooks, malware scanning of uploaded files, and checks that stop the Service from calling internal network addresses.

  • Monitoring and response: application, access and security logs kept for at least 180 days in the hosting region, alerting on failures, and a written security incident response policy (see section 8).

  • Separation of environments: development and test use separate environments, and production customer data is not used for testing.

  • AI features: customer data is not used to train AI models, by us or by our AI subprocessors.

  • Deletion: as described in section 10.

Contact

Questions about this DPA, a signed copy, or a data protection request: contact@sachdesk.com, or our contact form.