Data processing addendum

1. Roles

For customer personal data, you are the controller and we are your processor. Under India’s Digital Personal Data Protection Act, 2023, you are the Data Fiduciary and we are your Data Processor. If you are yourself a processor for someone else, we are your sub-processor, and you confirm that your controller has authorised this DPA.

For your own account and billing data, we are the controller, as our privacy policy explains. This DPA does not cover that data.

2. Your instructions

We process customer personal data only on your documented instructions. Those instructions are these terms, this DPA and what you do in the app. We do not process it for any other purpose, and never sell it or use it for our own marketing. If the law requires us to process it otherwise, we tell you first unless the law forbids that. If we believe an instruction breaks data protection law, we tell you.

On the Free plan we may show an advertisement on the links you share. It is chosen by your business’s country only. We do not use customer personal data to choose it, and we keep nothing about the person who sees it.

3. Confidentiality

Only people who need access to run or support the service can reach customer personal data, and each is bound to keep it confidential. The production servers and the database are reached by Amit Singh Rawat alone. Anyone we give access to our operator console has their own sign-in and a role that limits what they see, and what they do there is written to an audit log.

4. Security

We apply the technical and organisational measures in Annex II, and keep them at least as strong as they are today.

5. Sub-processors

• You authorise us to use the sub-processors listed on our sub-processors page.
• We give the owner of every account at least 15 days’ notice by email before adding or replacing a sub-processor that will process customer personal data.
• You may object on reasonable data protection grounds by writing to hello@theopenngroup.com within that period. We will try to find a solution. If we cannot, you may end your subscription before the change applies, and we refund the unused part of the period you paid for.
• Each sub-processor is bound by written terms that protect the data at least as well as this DPA. We remain responsible to you for their work.

6. Helping with people’s requests

The app lets you find, correct, export and delete customer personal data yourself. If someone contacts us about data in your records, we pass the request to you and do not answer it ourselves unless you ask us to. We give you any further reasonable help you need to answer it.

7. Helping with your obligations

We give you the information reasonably available to us to help with data protection impact assessments, consultations with a supervisory authority, and your own security obligations.

8. Personal data breaches

We tell you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting customer personal data. We tell you what happened, the kinds and approximate number of people and records affected, the likely consequences, what we have done or will do about it, and who to contact. If we do not know everything at once, we tell you in stages. We help you meet your own duty to notify an authority or the people affected.

9. Deletion and return

You can download customer personal data at any time, including after your plan ends: one ZIP file with your records and the files you uploaded. When you delete your account, we delete customer personal data from the live service at once and from our backups within 30 days, unless the law requires us to keep it. On request, we confirm the deletion in writing.

10. Audits

We make available the information needed to show that we meet this DPA. We answer a reasonable written security questionnaire once a year, or more often after a breach or when an authority asks. If that is not enough, you or an independent auditor bound by confidentiality may audit our processing remotely, by document review and video walkthrough, with at least 30 days’ notice, during business hours, at your cost, and no more than once a year unless a breach or an authority requires it.

11. International transfers

EU and EEA. Where customer personal data is transferred from the EEA to us in India, or onward to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 apply and are incorporated into this DPA by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. You are the data exporter and we are the data importer. Clause 7 (docking) applies. Under Clause 9, option 2 (general written authorisation) applies with the notice period in section 5. The optional wording in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is the one that is competent for you. Under Clauses 17 and 18, the clauses are governed by the law of Ireland and disputes go to the courts of Ireland. Annexes I and II of this DPA complete the clauses’ annexes, and our sub-processors page completes Annex III.

United Kingdom. For transfers from the UK, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner (version B1.0) applies and is incorporated by reference. Its tables are filled in with the parties and details in Annex I, the clauses selected above, and Annex II. Either party may end it as its section 19 allows.

Switzerland. For transfers from Switzerland, the same clauses apply with these changes: the Federal Data Protection and Information Commissioner is the competent authority, references to the GDPR include the Swiss Federal Act on Data Protection, and people in Switzerland may bring claims where they usually live.

If there is a conflict between these clauses and the rest of this DPA or our terms, the clauses prevail.

12. India

This DPA is the contract under section 8(2) of the Digital Personal Data Protection Act, 2023 by which you engage us as your Data Processor. You remain responsible for giving notice, having a lawful ground, and handling the rights of the people in your records, including any who are children. We process customer personal data only on your behalf and on your instructions, protect it with reasonable security safeguards, including those in Annex II, as rule 6 of the Digital Personal Data Protection Rules, 2025 requires, and keep the logs of access to it for at least one year. We tell you of a breach as set out in section 8, in time for you to inform the Data Protection Board of India within the 72 hours rule 7 allows and to tell the people affected without delay. We help you answer the requests of the people in your records in time for the 90 days the rules allow, as set out in section 6, and erase customer personal data when you delete it, when you ask us to, or as set out in section 9.

13. United States

Where US state privacy laws apply, such as the California Consumer Privacy Act, we act as your service provider or processor. We do not sell or share customer personal data, do not keep, use or disclose it outside our direct business relationship with you or for any purpose other than providing the service, and do not combine it with data from other sources except as those laws allow. We tell you if we can no longer meet these duties.

14. Order and liability

For data protection matters, this DPA prevails over the rest of our terms. The limits of liability in our terms apply to this DPA as far as the law allows. They do not limit the rights of people under the Standard Contractual Clauses.

Annex I: details of the processing

Data exporter (controller)

You, the customer that holds the Openn Invoice account, as named in your account’s business details. Contact: the account owner’s email.

Data importer (processor)

Amit Singh Rawat, sole proprietor trading as The Openn Group, B2908, Nikoo Homes 4, Bhartiya City, Thanisandra, Bengaluru 560064, Karnataka, India. Contact: Amit Singh Rawat, hello@theopenngroup.com.

People whose data is processed

Your customers and their contact people, your suppliers or payers named in bank statements, and the members of your team.

Kinds of personal data

Names, business names, email addresses, phone numbers, postal addresses, tax registration numbers, bank or UPI details printed on documents, invoice, quotation, credit note and payment details, payment proof files, bank statement lines, the messages, disputes and payment notices your customers send you through their page and the files they attach, the name typed and the browser used when a customer accepts or declines a quotation, and the times an invoice link was opened.

Sensitive data

None is intended. Do not upload health, biometric or other special category data.

How often

Continuously, for as long as you use the service.

Nature and purpose

Storing, organising, displaying and backing up your records, producing documents and reports, sharing documents through the links you create, running the page where each customer sees their invoices and writes to you, emailing a one-time code to your customer so that page stays private, recording when a link is opened and when a quotation is accepted or declined, and sending you account emails, only to provide the service to you.

How long

For as long as your account exists, then deleted as set out in section 9.

Sub-processors and the countries where they process data are listed on our sub-processors page. The competent supervisory authority is the one that is competent for you.

Annex II: security measures

• All connections use HTTPS, with HTTP Strict Transport Security.
• Passwords are hashed with scrypt and a unique salt. Two-step sign-in with an emailed code is available.
• Sessions use secure, http-only cookies; only a hash of each session token is stored.
• Every database query is scoped to the business it belongs to; the system is designed so that one business cannot read another’s records.
• Sign-in, code and other sensitive actions are rate limited. Each sign-in, sensitive account change and action in our operator console is logged, and the logs are kept for at least one year.
• Payment proof files are stored outside the public web folder and shown only to signed-in members of the business and, where you share a file with a customer, to that customer after they enter their one-time code.
• Shared document links use long random tokens and are hidden from search engines.
• The database and uploaded files are backed up every night, and backups are kept for 30 days.
• The service runs in a Google Cloud account. On our side, only Amit Singh Rawat has the sign-in to that account, the server and the database; Google’s staff can reach the machines as our hosting provider. Anyone given access to our operator console has their own sign-in, a role that limits what they see, and a duty of confidentiality. Sensitive account changes, and what is done in the console, are written to an audit log.

Our security page describes these measures in more detail.