Data Processing Addendum

1. About this Addendum

1.1 This Data Processing Addendum (the Addendum) forms part of our Terms of Use. It applies when we process Customer Personal Data to provide the Service.

1.2 The parties are:

the Customer (you): the business that uses Auditer through a workspace, acting through the Owner of that workspace. You are the Data Fiduciary.
Alcodes Mobility Private Limited (Alcodes, we, us or our). We are your Data Processor.

1.3 You accept this Addendum when you accept the Terms. No separate signature is needed.

1.4 This Addendum is published in English. If it is translated, the English version governs if there is any difference.

2. Definitions

2.1 In this Addendum:

DPDP Act means the Digital Personal Data Protection Act, 2023, and DPDP Rules means the Digital Personal Data Protection Rules, 2025.
Data Protection Law means the DPDP Act, the DPDP Rules and any other law in India that applies to the processing of personal data.
Customer Personal Data means personal data within your Customer Data (as defined in the Terms) that we process on your behalf.
Personal data breach has the meaning given in the DPDP Act: any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.
Sub-processor means a third party that we engage to process Customer Personal Data.
Board means the Data Protection Board of India.

2.2 Other words, such as Data Principal and processing, have the meanings given in the DPDP Act. Words defined in the Terms have the same meanings here.

3. Roles of the parties

3.1 You decide why and how Customer Personal Data is processed. We process it on your behalf, only to provide the Service to you.

3.2 If you process the data for another Data Fiduciary, for example as an accountant for a client, you confirm that you are authorised to use Auditer for that data. You are responsible for passing on that Data Fiduciary’s instructions to us.

3.3 This Addendum does not cover the account data of the Owner and members, such as name, mobile number, email address, device, usage and billing details. For that data, Alcodes is the Data Fiduciary, and our Privacy Policy applies.

4. Details of the processing

Item	Details
Subject matter	Providing the Service under the Terms
Duration	While you use the Service, and until the data is deleted under section 13
Nature of processing	Collecting data through the Auditer Agent, storing, organising, displaying, analysing, transmitting, writing entries back into TallyPrime, sending messages, exchanging data with government systems, backing up and deleting
Purpose	Showing your books on the web portal and mobile apps; reports, dashboards and AI insights; creating entries and writing them into TallyPrime; payment reminders and alerts that you set up; GST, e-invoice and e-way bill features that you use; and support
Categories of Data Principals	Your parties (customers, suppliers and other contacts); your employees and other individuals named in your books; members of your workspace; transporters named in e-way bills
Categories of personal data	Names; contact details such as phone number, email address and postal address; GSTINs and other tax details; transaction details such as invoices, amounts, balances, dates and narrations; other details recorded in your ledgers and vouchers; messages sent to your parties and their delivery status; e-invoice and e-way bill details, including vehicle numbers and transporter details; the GST portal, e-invoice and e-way bill credentials you connect; members’ roles, data limits and the audit trail of their entries

5. Your instructions

5.1 We process Customer Personal Data only on your documented instructions. Your instructions are:

the Terms and this Addendum;
your settings and use of the Service, such as selecting the Tally companies to sync, setting roles and data limits, setting reminder rules, creating entries, and choosing to save, file or generate documents on government systems; and
any other written instructions that we agree to.

5.2 If we believe an instruction breaks Data Protection Law, we will tell you and may decline to follow it.

5.3 If a law requires us to process Customer Personal Data in another way, we will tell you before we do so, unless the law forbids it.

5.4 We will not use Customer Personal Data for our own purposes, except as needed to keep the Service secure and to comply with law.

6. Your responsibilities as Data Fiduciary

You are responsible for:

having a lawful basis to collect Customer Personal Data, to share it with us and to have it processed as described in the Terms, including giving any notices and obtaining any consents the law requires;
having a lawful basis for the messages you set up for your parties;
the accuracy and completeness of the data in your books;
responding to requests and grievances from Data Principals, and publishing your own contact details as the law requires;
informing the Board and affected Data Principals of personal data breaches, as the law requires;
setting members’ roles and data limits appropriately; and
obtaining any consent the law requires before your books include the personal data of children.

7. Confidentiality of personnel

We ensure that the people we authorise to process Customer Personal Data are bound by confidentiality obligations. They may access it only as needed to provide or support the Service, or to comply with law.

8. Security measures

8.1 We maintain reasonable security safeguards to protect Customer Personal Data, including:

hosting the application servers, database and backups on Amazon Web Services in the Mumbai region (India);
encrypting data in transit with TLS;
encrypting backups;
encrypting the GST portal, e-invoice and e-way bill credentials you connect, using AES-256-GCM;
role-based access, so that the Owner decides which companies, financial years, ledgers, godowns and cost centres each member can see;
an audit trail of entries made in Auditer; and
keeping each workspace’s data separate from other workspaces.

8.2 We may update these measures as risks and technology change, but we will not reduce the overall level of protection.

8.3 Our security page describes our safeguards in more detail.

9. Sub-processors

9.1 You authorise us to use the sub-processors listed on our Sub-processors page.

9.2 We engage sub-processors under contracts that require them to protect Customer Personal Data in line with Data Protection Law, to the extent relevant to their service.

9.3 When we change our sub-processors, we will update the Sub-processors page and show the date of the change.

9.4 If you object to a new sub-processor on reasonable data protection grounds, write to [email protected]. If we cannot resolve your concern, you may stop using the affected feature, or close your workspace and account.

9.5 We remain responsible to you for our sub-processors’ performance of their data protection obligations, subject to section 15.

10. Transfers outside India

10.1 We store Customer Personal Data in India, on Amazon Web Services in the Mumbai region.

10.2 Some features involve processing outside India:

AI features. When you or your members use AI insights or Ask Auditer, we send the question and the summarised figures or help-article text needed for the answer to Groq, Inc. in the USA.
Push notifications. Notification content is sent through 650 Industries, Inc. (Expo) in the USA, and delivered through Google Firebase Cloud Messaging and Apple Push Notification service.
Crash reports. Mobile app crash and error reports, which may include limited technical context about what the app was doing at the time of the error, are sent to Functional Software, Inc. (Sentry) in the USA.
WhatsApp messages. These are sent by our messaging provider on Meta’s WhatsApp platform, which may process data outside India.

10.3 By using these features, you instruct us to make these transfers. We transfer personal data outside India only to countries that the Government of India has not restricted under the DPDP Act, and on any conditions the law sets.

11. Help with Data Principal requests

11.1 If a Data Principal contacts us about Customer Personal Data, we will refer them to you and, unless the law forbids it, tell you about the request. We will not respond to the request ourselves, except on your instructions or where the law requires.

11.2 Many requests can be handled with the tools you already have. For example, you can correct a party’s details in TallyPrime and sync, download reports, change members’ access, or reset or close a workspace.

11.3 If you need our help with a request that you cannot handle with these tools, write to [email protected]. We will give reasonable help.

12. Personal data breaches

12.1 We will notify you without undue delay after we become aware of a personal data breach affecting Customer Personal Data.

12.2 Our notice will include, as far as we know at the time:

the nature, extent, timing and location of the breach;
its likely consequences;
the measures we have taken or plan to take;
steps that affected Data Principals can take to protect themselves; and
a contact person who can answer your questions.

We will update you as we learn more.

12.3 We will take reasonable steps to contain the breach, investigate it and reduce its effects.

12.4 As the Data Fiduciary, you are responsible for informing the Board and the affected Data Principals as the DPDP Act and DPDP Rules require. We will give you the information you reasonably need to do so.

12.5 We will report cyber security incidents to CERT-In where its directions require.

12.6 Notifying you of a breach is not an admission of fault or liability.

13. Deletion or return at the end

13.1 While you use the Service, you can download reports and PDFs. Your master copy of the books stays in your own TallyPrime, so there is normally no need for us to return data.

13.2 When the Owner resets or closes a workspace, or deletes the account that holds it, we delete the Customer Personal Data concerned from our active systems within a reasonable period. Copies in encrypted backups are removed as those backups are replaced in our normal backup cycle. Until then, this Addendum continues to protect them.

13.3 We may keep Customer Personal Data for longer only where the law requires it.

13.4 On your written request, we will confirm that deletion has been completed.

14. Audits and information

14.1 On your request, we will give you the information reasonably needed to show that we comply with this Addendum, such as written answers to a security questionnaire.

14.2 If that information is not enough, or a regulator requires it, you may audit our compliance with this Addendum, yourself or through an independent third party bound by confidentiality. Any audit must:

be on reasonable advance written notice;
take place during business hours, without disrupting our operations;
be at your cost; and
not give access to other customers’ data or to our confidential information unrelated to this Addendum.

14.3 We will cooperate with the Board as Data Protection Law requires.

15. Liability

Our liability under this Addendum is subject to the limitations and exclusions of liability in our Terms of Use.

16. Order of precedence

16.1 If this Addendum conflicts with the Terms on the processing of Customer Personal Data, this Addendum prevails. On all other matters, the Terms prevail.

16.2 If any part of this Addendum conflicts with Data Protection Law, the law prevails.

17. Duration and changes

17.1 This Addendum applies for as long as we process Customer Personal Data for you.

17.2 We may update this Addendum to reflect changes in the law or in the Service. We will give notice of material changes in the way set out in the Terms.

18. Contact

For questions about this Addendum, write to [email protected]. For complaints, write to our Grievance Officer at [email protected]. Our registered office is at 208, Kesar Nagar, Sanganer, Jaipur, Rajasthan 302029, India.