Data Processing Addendum

1. Scope and privacy roles

This DPA applies when HISABOOKS PRIVATE LIMITED processes personal data in Customer Data on behalf of the Customer to provide, secure, support, and maintain HisaBooks. For that data, the Customer normally acts as the controller, organisation, Data Fiduciary, or equivalent responsible party, and HISABOOKS PRIVATE LIMITED acts as processor, service provider, data intermediary, Data Processor, or equivalent.

This DPA does not apply to data for which HISABOOKS PRIVATE LIMITED determines its own purposes, including account administration, company-code administration, legal-policy acceptance, billing, fraud prevention, service security, product reliability, support administration, and its own legal records. Those activities are described in the Privacy Policy.

2. Processing details

3. Customer instructions

HISABOOKS PRIVATE LIMITED will process Customer Data only to provide HisaBooks, follow the Customer's documented instructions, comply with the Terms, keep the service secure, support the Customer, comply with law, or as otherwise described in this DPA. The Terms, order form, workspace configuration, administrator actions, user actions, API calls, support requests, and documented privacy or deletion requests are Customer instructions.

If HISABOOKS PRIVATE LIMITED believes an instruction is unlawful or creates material risk, it may notify the Customer, pause the relevant processing where reasonable, or decline the instruction unless legally required to proceed.

4. Confidentiality and access

HISABOOKS PRIVATE LIMITED will limit access to Customer Data to personnel, contractors, and providers who need access to operate, secure, support, or maintain HisaBooks. Those people must be subject to confidentiality obligations or equivalent professional duties. Customer support access should be limited to the information needed to resolve the request or operate the service.

5. Security measures

HISABOOKS PRIVATE LIMITED will maintain administrative, technical, and organisational safeguards appropriate to the nature of the service and the risk of processing. Current measures include HTTPS transport, tenant-scoped access controls, role and permission checks, password hashing, session protections, CSRF controls, security headers, optional two-factor authentication, email verification, audit and security events, restricted desktop API origins, mobile secure storage, backup controls, and privacy-request execution evidence.

The Security Overview describes current controls and customer responsibilities. Security measures may evolve over time if the overall protection is not materially reduced.

6. Subprocessors

The Customer authorises HISABOOKS PRIVATE LIMITED to engage subprocessors needed to provide, secure, bill, support, host, back up, notify, or maintain HisaBooks. Current provider categories are listed in the Subprocessor Register.

HISABOOKS PRIVATE LIMITED must require subprocessors that process Customer Data for it to protect that data under written terms appropriate to the service they provide. HISABOOKS PRIVATE LIMITED remains responsible to the Customer for subprocessors it engages, subject to the Terms and applicable law.

Material provider changes should be reflected in the Subprocessor Register before or promptly after the change, depending on urgency. Customers may raise a good-faith data-protection objection, and HISABOOKS PRIVATE LIMITED will review whether the concern can be resolved through information, alternative configuration, suspension of the affected feature, or another commercially reasonable path.

Customer-selected recipients, exports, public links, email recipients, and future Customer-selected integrations are not general HisaBooks subprocessors; they process data at the Customer's direction.

7. International transfers

HISABOOKS PRIVATE LIMITED is based in Singapore. HisaBooks and its providers may process data in Singapore and other countries where infrastructure, payment, email, notification, support, app-store, security, or backup providers operate. The Customer authorises these transfers for service delivery, subject to applicable law and any written order terms.

Where required, the parties must use appropriate transfer safeguards, such as contractual protections, provider due diligence, access controls, encryption in transit, or standard contractual clauses. This DPA does not itself complete every country-specific transfer assessment; Customers with EU/UK, India, Singapore, or other regulated transfer requirements should obtain appropriate legal review.

8. Assistance and data-subject requests

Taking into account the nature of processing and information available to HISABOOKS PRIVATE LIMITED, it will provide reasonable assistance for Customer obligations relating to access, correction, export, deletion, restriction, objection, consent withdrawal, security, breach assessment, impact assessments, and regulator enquiries. Assistance may be provided through product features, exports, support, logs, documentation, or the Data and Account Requests page.

If HISABOOKS PRIVATE LIMITED receives a request about Customer-controlled workspace data, it may direct the requester to the Customer or coordinate with the Customer unless law requires a different response.

9. Security incidents

HISABOOKS PRIVATE LIMITED will assess suspected unauthorised access, loss, disclosure, alteration, or destruction of Customer Data. If it confirms a personal-data incident affecting Customer Data, it will notify affected Customers without undue delay after confirmation and provide information reasonably available to help the Customer meet its own duties.

Notice may be delayed where law enforcement, containment, investigation integrity, or legal restrictions require it. Unsuccessful attacks, spam, scanning, blocked attempts, or events that do not compromise Customer Data are not automatically notifiable incidents.

10. Return, deletion, and retention

During the subscription, authorised users may export available records through product features. After verified closure, HISABOOKS PRIVATE LIMITED will handle deletion, anonymisation, retention, backup expiry, and provider actions according to the Privacy Policy, retention schedule, deletion runbook, legal holds, statutory duties, disputes, and documented Customer instructions.

Deletion does not automatically remove business, tax, payroll, accounting, payment, refund, legal acceptance, support, security, audit, privacy-request, or backup records that must be retained. Removing an app from a device does not delete server records or cancel a subscription.

11. Audit and information

HISABOOKS PRIVATE LIMITED will provide reasonable information needed to demonstrate compliance with this DPA, usually through the Privacy Policy, Security Overview, Subprocessor Register, support responses, audit summaries, or written questionnaires. Customer audits must be reasonable, scheduled in advance, protect other customers and HISABOOKS PRIVATE LIMITED's confidential information, avoid service disruption, and be limited to the Customer's own environment and relevant controls.

12. Conflicts, changes, and contact

If this DPA conflicts with the Terms for Customer-controlled personal data processing, this DPA controls only for that processing. The Terms continue to control commercial, liability, payment, suspension, support, and general service matters unless a signed order form states otherwise.

Material changes to this DPA should receive a new version. Contact support@hisabooks.com with the subject "DPA Request" for data-processing questions.