Draft: under legal review. This text may change before the public launch.

Data Processing Agreement

Version 2026-11-03-draft · 3 November 2026

Parties and scope

This Data Processing Agreement ("DPA") is between the customer that holds an organisation in the hosted edition of NextWebX Accounting ("Customer", the Data Fiduciary) and NextWebX ("NextWebX", the Data Processor). It forms part of the Terms of Service and applies to personal data in the Customer's business records ("Customer Data") that NextWebX processes to provide the Service.

1. Subject, nature and duration

NextWebX stores, displays, computes on, backs up, exports and deletes Customer Data, only to provide the Service, for as long as the Customer's organisation exists and for the deletion period in section 9.

2. Categories of data and of people

  • People: the Customer's clients, suppliers, staff and members, and contact persons of those businesses.
  • Data: names, business names, GSTIN and PAN, postal addresses, phone numbers, email addresses, bank account and UPI details printed on documents, transaction details (what was bought or sold, amounts, dates), and anything the Customer types into notes or uploads as files.

The Customer must not upload sensitive data the Service does not need (for example health data or government identity numbers beyond those tax documents require).

3. Instructions

NextWebX processes Customer Data only on the Customer's documented instructions, which are: the Terms, this DPA and the Customer's use of the Service's features. NextWebX tells the Customer if it believes an instruction breaks the law.

4. Confidentiality and staff

Only staff who need it for operating or supporting the Service can reach Customer Data, under confidentiality duties. Support staff open an organisation only with the owner's 72-hour "Allow support access" permission or, in an emergency, through a logged break-glass procedure that emails every owner before access starts; every action is written to the organisation's audit log.

5. Security measures

  • Encryption in transit (HTTPS / TLS) and at rest (file storage encryption; per-organisation data keys for secrets, wrapped with a master key).
  • Strict separation of organisations at the application and database layers, covered by automated tests.
  • Password hashing (scrypt), optional and enforceable two-step sign-in, lockout after repeated failures.
  • A tamper-evident, hash-chained audit log per organisation.
  • Daily backups per organisation; platform database backups kept 35 days.
  • Hosting in India with a reputable cloud provider.

6. Sub-processors

The Customer authorises these sub-processors: Amazon Web Services (hosting, database, file storage, email; India), Razorpay (payments for the subscription; no Customer Data), Google (only for a Customer that connects Google Drive). NextWebX will give at least 30 days' notice of a new sub-processor by email or in the app; the Customer may object and, if no solution is found, end the agreement and export its data.

7. Helping with rights and requests

The Service gives the Customer the tools to answer its Data Principals: search, correction, export of the whole organisation, and deletion of records and of the organisation. NextWebX will help further on reasonable request.

8. Personal data breaches

NextWebX will tell the Customer without undue delay, and aim to do so within 72 hours of becoming aware, of a personal data breach affecting Customer Data, with what is known: the nature of the breach, the data and people likely affected, the likely consequences and the steps taken. NextWebX will help the Customer meet its own duties to inform the Data Protection Board of India and the people affected.

9. Return and deletion

The Customer can export Customer Data at any time. When the organisation is deleted, NextWebX deletes Customer Data 30 days after the request (the undo period), including files and encryption keys; copies in encrypted platform backups age out within 35 days. NextWebX keeps only its own records (its invoices to the Customer and payment records) as tax law requires.

10. Audits

NextWebX will answer reasonable written questions about its compliance with this DPA, and share summaries of its security measures, at most once a year unless a breach or a regulator requires more.

11. Liability and order

Liability under this DPA follows the Terms of Service. If this DPA and the Terms conflict on the protection of personal data, this DPA prevails.