Data Processing Addendum

When this addendum applies

This addendum is offered by Gayatri Joshi, operating Avkash at 1923, Sadashiv Peth, Pune - 411030, Maharashtra, India, to customer organisations. It forms part of the customer agreement when accepted by an authorised representative or incorporated into a written agreement. Publishing or reading this page alone is not a signed contract.

It covers personal data processed on the customer’s behalf to provide Avkash. It does not replace the Privacy Policy for our own account administration, enquiries or website analytics. Applicable law determines whether the parties are described as controller/processor, Data Fiduciary/Data Processor or another equivalent role.

Processing details

Subject matter and purpose: hosting and operating leave, holiday, entitlement and work-location records, reporting, authorised migrations, support and customer-enabled integrations.

Data subjects: the customer’s employees, administrators, managers and other authorised workspace users. Data categories: identity and contact details, employment dates and reporting relationships, work arrangements, leave requests and reasons, decisions, balances, grants, holidays and related records. Avoid unnecessary sensitive data; tell us before instructing processing that needs additional safeguards.

Operations: collecting on instruction, recording, organising, storing, displaying to authorised users, calculating, updating, exporting, transmitting through selected integrations and deleting. Duration: while the service is provided and during the agreed offboarding and lawful-retention periods.

Customer instructions and responsibilities

The customer decides the purposes of employee-record processing and is responsible for lawful instructions, employee notices, permissions and the accuracy of supplied data. Workspace configuration, authorised requests and enabled integrations constitute instructions within the agreed service scope.

Avkash will process customer personal data only for these instructions and the agreed service, unless applicable law requires otherwise. We will inform the customer of such a legal requirement where permitted, and flag an instruction we believe would breach applicable data-protection law. Additional instructions outside the service may require a separate agreement.

Confidentiality and safeguards

Access is limited to authorised people who need it for service delivery, support, maintenance or security and who are subject to appropriate confidentiality duties. Current safeguards include HTTPS, application roles, tenant-scoped access controls, encrypted integration credentials, recorded in-app support actions and restricted infrastructure administration.

We maintain backups for recovery. Current controls should not be read as a certification or guarantee of zero risk. We will make information reasonably necessary to assess the agreed safeguards available to the customer, subject to confidentiality and protection of other customers.

Providers and customer integrations

The customer authorises Fly.io for infrastructure hosting and Google Workspace/email where used to handle authorised support correspondence. The current primary application/database deployment is in Singapore. Providers must be subject to appropriate data-protection obligations for their relevant processing. Avkash remains responsible for its processor obligations under the agreement.

Google Sign-In supports user authentication. Google Calendar, Google Sheets and Discord are customer-selected integrations: enabling them instructs us to disclose selected data to the customer’s chosen service/account. The customer manages those accounts and their provider terms. Google Analytics is used for our own service analytics, not to process the customer’s employee records.

We will notify customers before adding or replacing a provider that processes their employee data on our behalf, allowing a reasonable opportunity to raise a substantiated data-protection objection. We will work to resolve the objection or discuss an alternative or termination of the affected service.

Assistance and incidents

Taking account of the processing and information available to us, we will reasonably assist the customer with individual rights requests, security obligations, required assessments and regulator enquiries. We will route employee-record requests to the customer unless law requires us to respond directly.

We will notify the customer without undue delay after becoming aware of a personal-data breach affecting its data, provide information available about the nature and likely consequences, and describe mitigation and follow-up. The customer remains responsible for its own notifications unless law or a separate agreement assigns them differently.

International transfers

Processing may occur outside the customer’s country. Where applicable law requires a transfer mechanism, additional clauses or safeguards must be agreed before the relevant transfer. This addendum does not itself incorporate EU Standard Contractual Clauses or claim that every international transfer has an adequacy basis. Contact support@avkash.co before onboarding data that requires additional transfer arrangements.

Return, deletion and review

At the end of service, an authorised customer representative may arrange an Excel export by email and deletion by contacting support@avkash.co. We verify the administrator and recipient before sending workspace data. Our target is removal of customer workspace data and credentials within 30 days of confirmed closure, subject to narrowly applicable legal-retention requirements.

Closure currently requires operator assistance. Backups and migration copies require separate cleanup; not every copy has automatic time-based expiry. We will confirm the deletion scope, backup timing and completion with the customer. Backup data is restricted, and deletion instructions must be reapplied if a backup is restored. We do not control copies retained in the customer’s connected services.

The customer may request reasonable evidence of compliance and, where required by applicable law, an audit under arrangements that protect security, confidentiality and other customers. We will cooperate in good faith to agree a proportionate method.

If this addendum conflicts with general service terms about processing customer personal data, this addendum controls for that processing. Non-waivable statutory duties remain unaffected.