What ToSure does with the client data your firm uploads.

Data Processing Agreement

Effective date: 19 September 2026 · Version 1.0

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Bhujbal Daily Solutions Private Limited ("Tosure", the Processor) and the CA firm that uses the Tosure platform ("Firm", the Data Fiduciary). It applies whenever Tosure processes personal data on the Firm's behalf. Where this DPA and the Terms conflict on data protection, this DPA prevails.

It is written for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Terms such as personal data, data principal, data fiduciary, processing and personal data breach have the meanings given in that Act.

A firm that needs a counter-signed copy can request one at [grievance email].

1. Roles

1.1 The Firm is the Data Fiduciary for the personal data of its clients and of the individuals connected with them. It decides why and how that data is processed.

1.2 Tosure is the Data Processor. It processes the data only for the Firm and only as this DPA and the Firm's use of the platform require.

1.3 For data about the Firm's own users and billing, Tosure is the Data Fiduciary and its Privacy Policy applies.

2. The Firm's responsibilities

The Firm will:

• give its clients a clear notice and obtain consent (or rely on another lawful basis) before uploading their data or messaging them, including telling them that WhatsApp is used to send requests and that Meta processes those messages;
• record consent in the platform, and withdraw it there when a client asks;
• upload only data it is entitled to hold for its professional engagement;
• keep client contact details accurate, manage its staff accounts and roles, and remove access promptly when someone leaves;
• set a retention period that suits its professional and statutory obligations;
• answer its clients' rights requests and grievances;
• comply with the WhatsApp Business Platform policies for the messages it sends.

3. Tosure's obligations as Processor

Tosure will:

3.1 Process only on instructions. Process personal data only to provide the platform, to follow the Firm's documented instructions (including the actions the Firm takes in the platform), and where a law of India requires otherwise — in which case, if lawful, Tosure tells the Firm first. Tosure will not sell personal data, use it for advertising, or use client documents to train machine-learning models.

3.2 Keep it confidential. Limit access to staff who need it, bind them to confidentiality that survives their employment, and train them on their duties.

3.3 Keep it secure. Maintain the technical and organisational measures in Annexure B, and not weaken them materially during the agreement.

3.4 Use sub-processors carefully. Use only the sub-processors listed in Annexure C, impose equivalent obligations on them, and remain responsible for their acts. Tosure gives at least 30 days' notice before adding or replacing a sub-processor; if the Firm reasonably objects on data protection grounds within that period and the parties cannot agree a solution, the Firm may terminate the affected service without penalty and receive a refund of fees paid for the unused period.

3.5 Help with data principals' rights. Provide the search, export, correction, erasure and consent-withdrawal features the Firm needs to answer requests, and give reasonable help if the Firm still cannot answer one. If a data principal contacts Tosure directly, Tosure will not answer on the Firm's behalf; it will pass the request to the Firm without undue delay.

3.6 Report breaches. Inform the Firm of a personal data breach affecting the Firm's data without undue delay and in any case within 48 hours of becoming aware of it, with the information the Firm needs to notify its data principals and the Data Protection Board — what happened, when, the categories and approximate number of principals and records affected, likely consequences, and the steps taken. Tosure will support the Firm's notification and investigation, and will not make a public statement naming the Firm without its consent unless the law requires it.

3.7 Keep records. Maintain a tamper-evident log of processing activities in the Firm's workspace and make it available to the Firm.

3.8 Allow verification. On reasonable written notice, and not more than once in any 12 months (unless a breach or a regulator requires more), provide the Firm with its security documentation, the most recent third-party assessment where one exists, and written answers to a reasonable security questionnaire. On-site or independent audits may be conducted where a regulator requires it, during business hours, with reasonable notice, without disrupting other customers and without access to another firm's data; the Firm bears the cost.

3.9 Return or delete. On termination, keep the data available for export for 30 days, then delete or irreversibly anonymise it within 60 days, except records Tosure must keep by law — tax invoices and accounting records, payment records, consent and withdrawal records, security and audit logs — and data under a legal hold, as listed on the Data Deletion page. Backups are deleted on their normal expiry cycle. Tosure confirms deletion in writing on request.

3.9A Act on erasure instructions. Where the Firm instructs erasure of a data principal's data (through the platform or in writing), Tosure erases it from live systems within 30 days of the instruction, subject only to the mandatory retentions above, and confirms completion to the Firm.

3.10 Keep data in India. Store and process the Firm's data in India, except that WhatsApp message delivery necessarily involves Meta's infrastructure outside India (Annexure C). Tosure will not transfer personal data to a country restricted by the Central Government.

4. Liability, term and law

4.1 Each party's liability under this DPA is subject to the limitations in the Terms of Service.

4.2 This DPA lasts as long as Tosure processes personal data for the Firm, and the obligations in clauses 3.2, 3.6 and 3.9 survive termination.

4.3 This DPA is governed by the laws of India, with the dispute resolution and jurisdiction clauses of the Terms of Service (arbitration seated at Mumbai; courts at Mumbai).

Annexure A — Details of processing

Subject matter: providing the Tosure document-collection and compliance-tracking platform.

Duration: the term of the Firm's subscription, plus the deletion periods in clause 3.9.

Nature and purpose: storing and organising client records and documents; sending document requests and reminders on WhatsApp; receiving uploads through a private link or WhatsApp; malware scanning and text recognition; review, export and secure deletion; audit logging; support.

Types of personal data: name, WhatsApp number, email address, PAN, GSTIN, bank account last four digits, the contents of documents the client uploads (which may contain financial and identity information), consent records, message delivery status, and log data.

Categories of data principals: the Firm's clients, the individuals connected with those clients (such as partners, directors and authorised signatories), and the Firm's own staff users.

Sensitive data: the platform is not designed for health, biometric or other special categories of data, and the Firm should not upload them.

Annexure B — Technical and organisational measures

1. Encryption. HTTPS for all traffic; encryption at rest for documents; field-level encryption for sensitive identifiers and provider tokens; passwords stored as salted hashes.
2. Tenant isolation. Each firm's records are separated by a tenant boundary enforced in the application and in the database, with cross-tenant reference checks at the database level.
3. Access control. Role-based access (Owner, Senior CA, Article Assistant and custom roles), least-privilege staff access, two-step verification for platform administrators, and session and API-token revocation when a user is deactivated.
4. Administrator limits. Tosure administrators can view account, subscription and billing information and WhatsApp connection health; they cannot open client documents and cannot sign in as a firm user.
5. File safety. Malware scanning of every upload, file type and size limits, password-protected-PDF detection, and private storage with short-lived, signed download links.
6. Audit trail. Append-only, hash-chained audit records of security and data events, available to the Firm.
7. Consent enforcement. Messages and inbound file collection are blocked when a client's consent is missing or withdrawn.
8. Retention and deletion. Firm-configured retention, scheduled secure deletion, legal holds, and deletion confirmation on request.
9. Resilience. Regular encrypted backups, monitored queues and scheduled jobs, and documented restore procedures.
10. Change management. Version-controlled code, testing before release, and staged deployment.
11. People. Confidentiality obligations for all staff and contractors, access reviews, and prompt revocation on exit.
12. Incident response. Documented procedure covering detection, containment, notification to the Firm within 48 hours, and post-incident review.

Annexure C — Approved sub-processors

| Sub-processor | Role | Data processed | Location | | --- | --- | --- | --- | | Meta Platforms, Inc. / WhatsApp | WhatsApp Business Platform messaging | Client WhatsApp number, template message content, delivery status, and files a client sends on WhatsApp | Outside India (Meta infrastructure) | | Razorpay Software Private Limited | Payments for subscriptions and wallet top-ups | Firm billing contact and payment references (no client data) | India | | [Hosting provider] | Hosting, storage and backups | All platform data | India ([region]) | | [Email provider] | Transactional email | Recipient email address and message content | [Location] |

Current list also published at tosure.in/dpa. Notice of changes is given under clause 3.4.

Contact: Bhujbal Daily Solutions Private Limited, B-11/14, Siddhivinayak Society, M G Complex, Sector 14, Vashi, Navi Mumbai, Maharashtra – 400703, India. Grievance Officer: [Grievance Officer name] · [grievance email]

Questions about this document? Write to grievance@tosure.in.