数据处理协议

This agreement sets out how OkBell handles payers' personal data for a business that uses the OkBell Business space. The business decides why and how its payers' data is used; OkBell processes it only on the business's instructions.

It forms part of the terms of use. The business accepts it when it signs up, and we record which version it accepted and when.

1. The parties

• The business: the business that holds a OkBell Business account (for example a tuition class, gym, hostel, housing society or club). The business is the data fiduciary under India's Digital Personal Data Protection Act 2023 (DPDP), the controller under the UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021) and, where they apply, the controller under the EU GDPR and UK GDPR (or, where the business itself processes for someone else, a processor).
• OkBell: the company that serves the business's billing country. In India, Newtact Lab Private Limited (OPC), 12th Floor, Manjeera Trinity Corporate, Geek Space Business Centre, Near Lulu Mall, KPHB Phase 3, Hyderabad, Telangana 500072, India, CIN U72200TG2015OPC097632. Everywhere else, Thaja FZE LLC, Business Center, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates, licence number 10019022008971. OkBell is the business's data processor.

Words such as "personal data", "processing", "controller", "processor" and "data principal" have the meaning the applicable law gives them.

2. What OkBell processes

OkBell never sees payers' card, UPI or bank details. Payers enter those on the payment provider's own page.

3. The business's instructions

• These terms, the business's settings in OkBell and its actions in the app or dashboard are the business's instructions.
• OkBell processes payers' data only on those instructions, unless a law requires otherwise. If so, OkBell tells the business first, unless the law forbids it.
• If OkBell believes an instruction breaks the law, it tells the business and may refuse it.
• OkBell never uses payers' data for its own purposes: no marketing to payers, no profiles across businesses, no selling, no ads and no training of AI models. A payer who appears in two businesses is two separate records.

4. The business's duties

The business confirms that:

• it has a lawful basis to collect each payer's data and to send them reminders, and it gives them any notice the law requires;
• payers are adults; a child is listed only as a dependant, and the business marks a dependant who is under 18, so that OkBell can ask the parent for consent through its consent link;
• it does not ask OkBell to message a second contact who has not opted in; OkBell's own flow asks the second contact for their consent;
• it is not a lender, a non-bank finance company, a microfinance firm, a recovery agent, a debt buyer, a chit fund or a money lender, and does not use OkBell for debt collection;
• it handles its payers' requests (to see, correct or delete their data) as the responsible party, with OkBell's help.

OkBell adds its own limits on top of the business's settings: caps on messages, quiet hours, holidays and STOP keywords. The business cannot switch these off.

5. Confidentiality and staff

• OkBell staff may look at a business's data only when needed to support the business, keep the service safe, or meet the law.
• Everyone at OkBell who can reach payers' data is bound to keep it confidential.
• Staff see phone numbers masked. Seeing a full number needs a reason, lasts an hour, and the business can see that it happened.

6. Security

OkBell keeps payers' data safe with measures that fit the risk, including:

• encryption of payment provider tokens and keys, which are never shown in full;
• phone numbers stored with a keyed code for look-ups and never written to logs;
• pay links with long random codes that expire, and pay pages that show only a first name and amounts;
• access to production data limited to the people who need it, with every admin action written to an audit log;
• encrypted backups, kept apart from the live data; real data is never copied to test systems;
• security and audit logs kept for 1 year.

7. Sub-processors

• The business allows OkBell to use the sub-processors on our public list at okbell.app/legal/sub-processors.
• OkBell gives 30 days' notice before adding or replacing a sub-processor, by email to the business's owner and on that page.
• The business may object, with reasons, within those 30 days. We will then try to find a fix. If we cannot, the business may end its plan and we will refund any amount paid for the period after the change.
• OkBell puts data protection terms in place with each sub-processor that are at least as protective as this agreement, and remains responsible for their work.

The business's own payment provider (for example Razorpay, Cashfree, Stripe, Ziina, Mamo, Telr or GoCardless) is the business's provider, not OkBell's sub-processor. The business has its own contract with it. OkBell sends it only what is needed to make each payment, on the business's instructions.

8. Helping the business

OkBell helps the business meet its duties:

• People's requests. The business can export, correct or erase a payer in one action. If a payer's request reaches OkBell, we pass it to the business and do not answer it ourselves unless the business asks us to.
• Stopping reminders. Every message lets the payer stop. A STOP is honoured at once, across every channel for that business, and the business is told.
• Consent records. OkBell keeps each consent and opt-out record with its time, channel and wording, so the business can show it.
• Assessments. OkBell gives reasonable information for the business's data protection impact assessments and for any talks the business has with a data protection authority.

9. Personal data breaches

• OkBell tells each affected business within 24 hours of becoming aware of a personal data breach that affects its payers' data.
• The notice says what happened, which data and people may be affected, what OkBell has done and what the business may need to do. If some facts are not known yet, OkBell sends them as soon as they are.
• OkBell reports to India's CERT-In as the law requires.
• The business decides on and makes any notice to its payers and to the data protection authority, for example the Data Protection Board of India. OkBell helps with the facts.

10. Deletion and return at the end

• The business can export its records at any time.
• When the business deletes its account, all reminders stop at once, and the owner gets an export of payers, dues and receipts by email. After 30 days, OkBell erases the business's data, including its payers.
• Backups age out within 30 days after that.
• OkBell keeps only what the law requires: our own invoices to the business, and security and audit logs for 1 year. These logs hold no message content. The duty to keep them overrides deletion at the end of this agreement, for that year only.
• On request, OkBell confirms in writing that deletion is done.

11. Audits and information

• OkBell gives the business the information needed to show that it meets this agreement.
• The business can see and download its own audit log, with phone numbers masked, when that feature is available.
• Once a year, or after a breach, the business may ask for an audit. It can be done by an independent auditor bound to confidentiality, on 30 days' written notice, in working hours, at the business's cost, without access to other customers' data. OkBell may first offer a recent independent report or written answers instead.

12. Where data is stored, and transfers

• Today, payers' data for businesses in India, the UAE and the Gulf is stored in the Asia-Pacific region.
• For a business in the EU, EEA or UK (when we serve them), payers' records, dues, payments, receipts and reminder clocks are stored in the EU. The region is fixed when the business signs up and is written on its order. Requests may be processed wherever our hosting provider runs, so we say "stored in the EU", not "processed only in the EU".
• Some data is still processed outside that region: the business's own account and team data, and our message log, which holds keyed codes of phone numbers and emails, not the numbers, names or message text.
• When OkBell staff in India support a business in the EU, EEA or UK, that is a transfer. Each such access is recorded in the business's audit log, and is covered by the terms in section 13.3.

13. Country terms

13.1 India (DPDP Act 2023 and Rules)

• OkBell is the business's Data Processor under section 8(2) of the DPDP Act, and processes payers' data only under this contract.
• OkBell helps the business with notices, consent records (including a parent's consent for a dependant under 18) and the rights of data principals.
• OkBell keeps the security measures and breach notice in sections 6 and 9.
• OkBell keeps logs for 1 year, as Rule 8(3) requires, even after the business leaves.

13.2 United Arab Emirates (PDPL)

• OkBell processes payers' data only on the business's documented instructions, keeps it confidential and secure, and tells the business of a breach as in section 9.
• Businesses in the DIFC or ADGM free zones may need extra terms under those zones' own data laws. Ask us before you sign up.

13.3 EU GDPR and UK GDPR (when we serve businesses there)

These clauses apply to a business established in the EU, EEA or UK, or whose processing is otherwise under the GDPR or UK GDPR.

• This agreement contains the terms required by Article 28(3) GDPR (and the same article of the UK GDPR): processing only on documented instructions; confidentiality of staff; security under Article 32; the sub-processor rules in section 7; help with data subjects' rights; help with Articles 32 to 36; deletion or return at the end; and information and audits.
• For any transfer of personal data out of the EU or EEA to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module 2, controller to processor, where the business is the controller; Module 3, processor to processor, where the business itself acts as a processor), which are part of this agreement. For the UK, the UK International Data Transfer Addendum applies too.
• Before OkBell serves a business in the EU or the UK, it names a representative there where Article 27 requires one, and publishes the representative's details on this page.

13.4 United States (when we serve businesses there)

OkBell acts as a "service provider" under the California Consumer Privacy Act. It does not sell or share payers' personal information, and does not keep, use or disclose it for any purpose other than providing the service to the business, or outside the direct business relationship with the business.

14. Features the business controls

When these features are available, the business controls them and this agreement covers them:

• The business's own WhatsApp number. If the business connects its own WhatsApp account, reminders go from its number. Meta is then the business's own provider for those messages, under the business's own contract with Meta. OkBell keeps the access the business granted encrypted, and deletes it when the business disconnects.
• Successors (Just in case for your business (key-person continuity)). The business's owner may name people who get owner access to the business's OkBell account if the owner stops checking in. They see what an owner sees. This is access the business chooses and controls; OkBell sends payers no message about it.
• Franchises. A franchisee may agree to share monthly totals with its franchisor. The franchisor never sees a payer's name, number or record.

15. Liability and order

• Each party's liability under this agreement is subject to the limits in the terms of use, unless a law says otherwise.
• If this agreement and the terms of use disagree about personal data, this agreement wins. If the Standard Contractual Clauses apply and disagree with this agreement, the clauses win.
• This agreement lasts as long as OkBell processes payers' data for the business.

16. Contact

Data protection questions: hello@okbell.app. Security reports: security@okbell.app.