Data processing agreement
How we handle the personal data your business keeps in Pixelvile, under India’s DPDP Act and GDPR-style rules.
1. Who does what
You decide why and how your customers’ and staff’s personal data is used. Under India’s Digital Personal Data Protection Act, 2023 you are the data fiduciary. For clients outside India, you are the controller. Pixelvile processes that data only on your behalf, as your data processor.
2. What we process, and why
We process the data you or your customers put into the platform: names, phone numbers, email addresses, bookings, orders, invoices, enquiries, messages, email, staff accounts and activity records. We use it only to run the services you’ve chosen: your website and booking page, your dashboard, reminders and messages, invoices, email, reports, backups and support. We never sell it, never use it for our own advertising, and never use it to train software.
3. Your instructions
We act on your documented instructions: this agreement, your settings in the dashboard and what you ask us in writing. If we think an instruction breaks the law, we tell you. If the law requires us to disclose data, we tell you first unless the law forbids it.
4. Our people
Only Pixelvile people who need access for their work have it, and they are bound to confidentiality. Pixelvile staff cannot read your email: an owner of your business has to grant time-limited access, and everything opened under it is recorded for you to see.
5. Security
We protect your data with measures that fit the risk, including:
- Encryption in transit everywhere (HTTPS with HSTS), and strict security headers on every page.
- Passwords stored only as salted PBKDF2 hashes, optional or required two-factor sign-in, and sign-out of every device when a password changes.
- Roles and permissions for your team (Owner, Manager, Staff), private personal mailboxes and an activity log you can download.
- Sensitive keys, such as connected WhatsApp tokens, stored encrypted.
- A weekly encrypted backup (RSA-4096 and AES-256), kept for 90 days, with restore drills.
- Bot checks and rate limits on public forms and sign-in, and automatic alerts when something fails.
- Your website running in your own hosting account where possible, with its own keys.
More detail is on our security page.
6. Sub-processors
You allow us to use the sub-processors on our sub-processor list. We give each the same data protection duties we have here, and we remain responsible for them. We tell you by email at least 14 days before adding a new one, so you can object. If we can’t resolve a reasonable objection, you may end the affected service.
7. Transfers outside India
Some sub-processors process data outside India, as the list shows. We use them only where the law allows, and for clients under GDPR-style rules we rely on the safeguards those providers offer, such as standard contractual clauses.
8. Helping you
We help you respond when your customers or staff use their rights (to access, correct or erase their data, or to withdraw consent), mostly through the dashboard’s own tools: profiles, exports and deletion. We also help with security, breach notices and any impact assessment you need, as far as it concerns our services.
9. Personal data breaches
If we become aware of a breach affecting your data, we tell you without undue delay, and in any case within 48 hours, with what we know: what happened, what data and people are affected, and what we’re doing about it. We keep you updated and help you meet your own duty to inform the Data Protection Board of India, other authorities and the people affected.
10. When our work ends
You can download your data at any time from Settings › Download your data (spreadsheets and everything in one file). When the service ends, we keep your data for 30 days so you can take it, then delete it from the platform. Encrypted backups expire on their own within 90 days after that. We keep only what the law requires us to keep, such as our own invoices to you.
11. Audits
On reasonable written notice, and not more than once a year unless there has been a breach or a regulator requires it, we answer your security questions and show you how we meet this agreement. Where an inspection is needed, we agree a time, scope and confidentiality first.
12. Liability and changes
Each party’s liability under this agreement follows the limits in our terms or your written agreement with us. We may update this agreement to reflect the law or our services, and we’ll email you about any material change before it applies.
Contact
For anything about this agreement or your data: support@pixelvile.com, Pixelvile Studio LLP, 5/103 Jadavgarh, Haltu, Kolkata 700078.