Data Processing Addendum
This addendum forms part of the Terms of Service between BharatNexs (“Processor”) and the Customer (“Fiduciary”). It covers personal data the Customer puts into BharatNexs in the course of its customs work, which BharatNexs processes on the Customer's behalf under the Digital Personal Data Protection Act, 2023.
1. What is processed
- People concerned: the Customer's clients (importers, exporters) and their staff, overseas suppliers and buyers, transporters, and other people named in shipping and customs documents; the Customer's clients answering checklist approval links.
- Data: names, addresses, phone numbers and emails, IEC, PAN, GSTIN, bank AD codes and account details as they appear in documents, signatures and stamps on uploaded documents, and transaction details of shipments.
- Purpose: reading documents, preparing bills, checklists, IGM / EGM and flat files, keeping masters, client approvals, customs query records, and supporting the Customer.
- Duration: while the Customer uses BharatNexs, and 30 days after the account is closed.
2. BharatNexs will
- process the data only on the Customer's documented instructions (using BharatNexs as designed is such an instruction), and not for any purpose of its own except anonymised statistics about how the service is used;
- make sure staff with access are bound by confidentiality and only access data when needed (for example, support the Customer asks for);
- keep reasonable security safeguards in place, including encryption in transit and at rest, access control with two-step sign-in for administrators, logging of access and downloads, and limits against bulk copying;
- tell the Customer without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting its data, with the information it needs to meet its own obligations to the Data Protection Board and the people affected;
- help the Customer respond to requests from people exercising their rights (access, correction, erasure, grievance);
- at the end of the service, let the Customer download its data and then delete it as set out above, unless the law requires keeping it;
- give the Customer information reasonably needed to show compliance with this addendum.
3. Sub-processors
The Customer agrees to BharatNexs using these sub-processors, each bound to protect the data at least as well as this addendum requires:
| Sub-processor | What for | Where |
|---|---|---|
| Cloud hosting provider | Hosting the application, database and stored files | India |
| Anthropic, PBC | Reading documents that BharatNexs's own rules cannot read (AI model API) | United States |
BharatNexs will tell the Customer before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds; if the parties cannot agree, the Customer may end the service and receive a pro-rata refund of prepaid fees for the unused period.
4. The Customer will
- have a lawful basis for the personal data it uploads, give the notices the law requires, and only upload what its work needs;
- handle requests and grievances from its own clients and their contacts, with BharatNexs's help;
- manage its users, keep their accounts secure, and remove access for people who leave.
5. Transfers outside India
Data is stored in India. Documents sent for AI reading are processed by Anthropic in the United States, only to return the reading result. No data is transferred to a country restricted by the Government of India under section 16 of the DPDP Act.
6. Contact
Data protection questions: Grievance Officer, BharatNexs. Write to BharatNexs support (Contact support, after signing in).