Data Processing Terms

These terms apply where, as part of delivering or supporting a project, Purnavix processes personal data belonging to a client's own users or customers on that client's behalf and instructions — for example, personal data stored within a website, application, or database we have built or maintain for that client.

In that situation, the client is generally the party that determines the purpose and means of processing that personal data, and Purnavix processes it on the client's documented instructions in connection with the agreed project.

Purnavix will process personal data covered by these terms only in accordance with the client's reasonable, documented instructions relevant to the project, unless required to do otherwise by applicable law.

Personal data processed under these terms is used only for the purpose of delivering, maintaining, or supporting the relevant project — not for any unrelated purpose.

Purnavix treats personal data it processes on a client's behalf as confidential, and takes reasonable steps to ensure that anyone on our team who has access to it is subject to an appropriate duty of confidentiality.

We apply reasonable technical and organisational security measures appropriate to the nature of the data and the project, aimed at protecting it against unauthorised access, loss, alteration, or disclosure. Specific security requirements for a project can be agreed in that project's statement of work.

Access to personal data processed under these terms is limited to the individuals who reasonably need it to carry out the relevant project work.

Where delivering a project reasonably requires engaging a third-party sub-processor (for example, a hosting provider), we will only do so where appropriate for the project and will take reasonable steps to ensure that sub-processor maintains an appropriate standard of data protection. We do not name specific sub-processors on this general page, as they vary by project; details can be confirmed for a specific engagement on request.

If we become aware of a security incident that has resulted in unauthorised access to, or loss of, personal data we are processing on a client's behalf, we will notify the client without undue delay so they can assess and respond to it appropriately.

At the end of a project or on the client's reasonable request, we will work with the client to return or delete personal data processed under these terms, except where we are required by law to retain it, or where it is retained as part of standard backup cycles that will expire in the ordinary course.

Where reasonably necessary, we will cooperate with a client to help them meet their own legal obligations in respect of personal data we process on their behalf — for example, responding to a legitimate request from one of their users.

Purnavix is based in India, and personal data processed under these terms is generally processed from India unless a specific project's infrastructure (such as a particular hosting region chosen for that project) requires otherwise, in which case this will be discussed as part of that project.

Questions about how Purnavix handles data processing for a specific project can be sent to contact@purnavix.com.