Data Processing Agreement

This agreement is between the firm that uses VakilBox (“the firm”) and [legal name of the company] (“VakilBox”). It forms part of the Terms of Service and applies whenever VakilBox processes personal data contained in firm data.

Under the Digital Personal Data Protection Act, 2023 (“the Act”) and the rules made under it, the firm is the Data Fiduciary: it decides why and how its clients’ and other people’s personal data is processed. VakilBox is the Data Processor: it processes that data only on the firm’s behalf and only as this agreement allows.

For personal data VakilBox collects to run its own business (for example, members’ sign-in details and billing contacts), VakilBox is the Data Fiduciary, as the Privacy notice explains.

VakilBox processes firm data only to provide the service and as the firm instructs. The firm gives its instructions through these documents, its settings in the service, and what its members do in it. VakilBox will tell the firm if it believes an instruction breaks the law.

VakilBox does not sell firm data, use it for advertising, or use it to train artificial-intelligence models.

• Give the notices and obtain the consents the Act requires before personal data is entered, unless a lawful exemption or legitimate use applies (for example, processing needed to enforce a legal right or claim).
• Get verifiable consent from a parent or lawful guardian where the Act requires it for a child’s data, or rely on the exemption that applies.
• Decide who among its members may see which matters, and keep that up to date.
• Answer requests from people about their data, with VakilBox’s help where needed.
• Notify the Data Protection Board and affected people of a personal data breach as the Act requires, with VakilBox’s help.

Everyone at VakilBox who could reach firm data is bound by confidentiality. Staff cannot read case data in normal operation. A support person can see named cases only during a support session that the firm’s administrator grants, which is time-limited, read-only, recorded, and can be ended by the firm at any time.

VakilBox keeps reasonable security safeguards, including:

• encryption of data in transit (TLS) between apps, browsers and servers, and encryption at rest of stored documents and backups by the storage provider;
• separation of every firm’s data enforced inside the database, so one firm cannot reach another’s records;
• role-based access inside each firm, ethical walls and restricted matters, with masking of sensitive fields;
• passwords stored only as strong one-way hashes; sign-in attempts limited; bot protection on public forms;
• a tamper-evident activity log of who saw and changed what;
• on Android: sign-in tokens in the phone’s secure keystore, an optional fingerprint or PIN lock, screenshots blocked, and remote sign-out and wipe of a lost phone;
• payment keys stored sealed so no one can read them back; card details never reach VakilBox;
• daily backups, restore procedures, monitoring and alerts, and timely security updates.

VakilBox may improve these safeguards over time but will not reduce the overall level of protection during the firm’s subscription.

The firm agrees that VakilBox may use the providers below. Each is bound by written terms that protect the data at least as well as this agreement.

VakilBox will tell the managing partner at least 30 days before adding or replacing a provider. If the firm objects on reasonable data-protection grounds and the parties cannot agree a solution, the firm may cancel and receive a refund of fees paid for the period after the change.

Some providers above process data outside India. The Act allows this except to countries the Central Government restricts. VakilBox will not transfer firm data to a restricted country and will follow any further conditions the Government sets.

The service lets the firm find, correct, export and delete a person’s data. Where the firm needs more, VakilBox will help, without undue delay, to answer requests to access, correct or erase data, grievances, and nominations under the Act. If a person contacts VakilBox directly about firm data, VakilBox will pass the request to the firm and will not answer it itself unless the firm asks.

1. VakilBox will tell the firm without undue delay, and in any case within 24 hours, after becoming aware of a breach affecting firm data.
2. The notice will say, as far as then known: what happened and when, what data and how many people are affected, the likely consequences, what VakilBox has done and will do, and a contact person. VakilBox will add details as it learns them.
3. VakilBox will help the firm notify the Data Protection Board and affected people within the time the law sets, and will keep records of the breach.
4. VakilBox reports cyber security incidents affecting its own systems to CERT-In within 6 hours of noticing them, as the CERT-In directions of April 2022 require, and keeps its system logs for 180 days.

VakilBox recognises that firm data contains communications protected by professional privilege under the Bharatiya Sakshya Adhiniyam, 2023 and the advocate’s duty of confidence. If a court, authority or anyone else asks VakilBox for firm data, VakilBox will, where the law allows, tell the firm at once, refer the request to the firm, and disclose only what it is legally compelled to disclose.

1. The firm can export all its data at any time, in any account state.
2. After the firm closes its account, VakilBox keeps firm data for 90 days so the firm can take a final export or reopen. It then deletes firm data from the live systems, including stored documents, and issues a certificate listing what was deleted.
3. Copies in backups are deleted as the backups expire, within 30 days after that. Until then they stay encrypted and are not used.
4. VakilBox keeps only what the law requires it to keep (for example, its own invoices and tax records, and the security logs the law requires), and only for as long as required.

VakilBox will give the firm the information reasonably needed to show it meets this agreement, including a description of its safeguards and sub-processors. Where that is not enough, a firm on an annual plan may, once a year, at its own cost and with 30 days’ notice, have an independent auditor bound by confidentiality review the relevant records, in a way that does not reveal other firms’ data.

Each party’s liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow a limit. Each party is responsible for penalties imposed on it for its own breach of the Act.

This agreement lasts as long as VakilBox processes firm data. If it conflicts with the Terms of Service on the protection of personal data, this agreement wins.

Data protection questions and breach contacts: grievance@vakilbox.com. Grievance officer: [name of grievance officer].