Data processing agreement

Parties and roles

This agreement is between the banquet hall business that uses Banqetly (“the hall”) and Banqetly (“we”). It forms part of the Terms of service and applies while the hall uses Banqetly and until its data is deleted.

For the personal data of the hall's customers, guests, vendors and staff that the hall puts into Banqetly, the hall is the Data Fiduciary and we are its Data Processor under the Digital Personal Data Protection Act, 2023 (the DPDP Act).

What we process and why

Data: names, phone numbers, email and postal addresses, GSTINs, event details, payments, invoices, notes, and staff login details.

Purpose: only to provide Banqetly to the hall, as the hall directs through its use of the app, and to keep it secure. We do not use the hall's data for our own purposes, sell it, or combine it with other businesses' data.

The hall's responsibilities

The hall decides what data to collect, gives its customers any notice the DPDP Act requires, obtains consent where needed, and answers its customers' requests to access, correct or erase their data. Banqetly provides the tools: export, edit, and “Erase personal details” for a customer.

Confidentiality

Only Banqetly staff who need to support or run the service can access the hall's data, and they are bound to keep it confidential. We access a workspace's contents only to provide support the hall asks for, to fix a problem, or when the law requires.

Security measures

Encrypted connections (HTTPS) for all traffic. Each hall's workspace is separated from every other at the application level, and every request is checked against the signed-in user's workspace.

Role-based permissions enforced on the server. Passwords stored as one-way hashes, a minimum length, temporary passwords that must be changed, and sign-out of other devices on a password change. Two-step login on our owner console.

An audit trail of changes in each workspace, security logs kept for 180 days, and alerts for repeated failed sign-ins and unusual errors.

Regular updates of the software we depend on, and backups of the database.

Sub-processors

We use these providers to run Banqetly: a cloud hosting provider (application servers and database); Google (email delivery); and MSG91 (text messages the hall chooses to send to its customers). We tell halls before adding or replacing a sub-processor, and require each to protect the data to the same standard.

Personal data breaches

If we become aware of a breach affecting the hall's data, we tell the hall without undue delay and in any case within 24 hours, with what we know: what happened, what data and how many people are affected, and what we are doing about it. We help the hall inform the Data Protection Board and affected people, and we report cyber security incidents to CERT-In within 6 hours as the CERT-In directions require.

Help with requests and audits

We help the hall answer its customers' rights requests and any inquiry from the Data Protection Board, and give the hall reasonable information to show we meet this agreement.

Return and deletion

The hall can download all its data at any time from Settings → Data & privacy. When the hall's plan ends, it can ask for a full export within 30 days; after that we delete the workspace and all its data, except where the law requires us to keep something, which we then keep only for that purpose. Security logs are deleted after 180 days.

Contact

Questions about this agreement or data protection: support@banqetly.com (Grievance Officer).