eCorpOS Data Processing Agreement

Version 1.4 · Last updated 23 Oct 2026

This agreement (“DPA”) governs eCorpIT’s processing of personal data on your behalf when you use eCorpOS. It forms part of the Terms of Service and applies automatically — you do not need to sign it separately. If your organisation requires a countersigned copy, write to legal@ecorpit.com and we will provide one.

You are the Data Fiduciary; we are the Processor. You decide what personal data goes into eCorpOS and why. We hold and process it to run the service for you, on your instructions, and for nothing else. Where you have signed a Master Services Agreement with different data terms, that agreement prevails.

1. Definitions and roles

“Personal data”, “processing”, “Data Fiduciary”, “Data Principal” and “Data Processor” carry the meanings given in the Indian Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Where the EU or UK GDPR applies to you or your staff, “Controller”, “Processor” and “Data Subject” carry their GDPR meanings and map to those terms respectively.

“Customer Personal Data” means personal data you or your users put into eCorpOS, and personal data eClock collects on devices you deploy it to.

2. Scope, duration and instructions

We process Customer Personal Data only to provide, secure and support eCorpOS, and only on your documented instructions — which include your use of the product’s own settings.
Configuring the service is an instruction. Choosing what eClock collects, setting a retention period, or connecting a mailbox are instructions given through the interface.
Processing lasts for the term of your subscription and the wind-down period in section 11.
If we believe an instruction breaches applicable data-protection law, we will tell you and may pause that processing rather than carry it out.
Where processing rests on a person’s own consent — monitoring under an earlier eClock notice, blocking, or allowing remote control of their computer without being asked — it stops when they withdraw that consent, from their device’s next check, and nothing more is collected under it.
Details of the processing are set out in Annex A.

3. What we will not do

We do not sell Customer Personal Data.
We do not use it to train machine-learning models, ours or anybody else’s.
We do not use it for our own marketing, analytics or product research.
We do not access it except to run the service, to fix a fault, or under a support grant your administrator has explicitly approved.

4. Confidentiality and our people

Everyone with access is bound by written confidentiality obligations, is granted access on a need-to-know basis, and loses it when their role no longer requires it. Support access to a customer organisation requires an approved, time-limited grant, and every action taken under one is recorded against it.

5. Sub-processors

You authorise the sub-processors listed in Annex B.
Each is bound by data-protection terms no less protective than these, and we remain liable to you for their performance.
We will give at least 30 days’ notice before adding or replacing one. If you reasonably object on data-protection grounds within that period, we will work with you to find an alternative; if none is workable, you may terminate the affected part of the service without penalty for the remainder of the term.

6. Security

We implement appropriate technical and organisational measures, set out in Annex C, taking account of the state of the art, the cost of implementation, and the risk to the people the data describes. We keep them under review and will not weaken them materially during your subscription.

7. Helping you answer people’s requests

eCorpOS gives you direct access to the Customer Personal Data it holds, so you can answer most access, correction, erasure and portability requests yourself.
Where you cannot, we will assist within a reasonable time and at no charge for a proportionate volume of requests.
If a person contacts us directly about data you control, we will not action it. We will tell them to contact you and, where we can identify you, tell you it happened. Altering or deleting your records on a third party’s say-so could destroy something you are legally required to keep.

8. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data.
The notice will describe what we know, the categories and approximate volume affected, the likely consequences, and what we are doing — updated as we learn more, rather than withheld until complete.
We will assist you in meeting your own notification duties to the Data Protection Board of India, a supervisory authority, or the people affected.
A notification is not an admission of fault by either of us.

9. Audits and information

We will provide the information reasonably needed to demonstrate compliance with this DPA, including answering a security questionnaire once in any twelve-month period.
You may audit, or appoint an independent auditor to audit, on 30 days’ written notice, no more than once a year unless a regulator requires otherwise or we have notified you of a breach.
Audits must be during business hours, must not unreasonably disrupt the service, must not access another customer’s data, and are subject to confidentiality.

10. International transfers

eCorpOS is operated from India on infrastructure with a global footprint, and email is sent through a provider in the United States — see Annex B. Where GDPR applies, transfers rely on Standard Contractual Clauses or another lawful mechanism maintained by the relevant provider. Where the DPDP Act applies, we will not transfer personal data to a territory the Central Government has restricted.

11. Return and deletion

You can export your data at any time during the subscription.
After termination we keep it for 30 days so you can export it, then delete it.
You may ask us to delete it sooner, and we will unless law requires otherwise.
Backups age out on their own cycle; data deleted from the live service is not restored into it.
Erasing an organisation’s monitoring data destroys the encryption key that data is held under. That is irreversible by design — a backup restore cannot undo it, because the backups deliberately exclude those keys.

12. Precedence

Where this DPA conflicts with the Terms of Service, this DPA prevails for data-protection matters. Where it conflicts with a Master Services Agreement or DPA you have signed with us, the signed document prevails.

Annex A — Details of the processing

Subject matter and purpose

Providing the eCorpOS platform and the eClock desktop application to you.

Categories of Data Principals

Your employees, contractors and other staff
Your customers, prospects and contacts
Your suppliers and their representatives
Candidates who apply to you for work
Dependants of your staff, where recorded for benefits

Categories of personal data

Module	Data
Account	Name, work email, role, session records including IP address and browser user-agent, audit log entries
CRM	Name, email, phone, company, job title, correspondence, first-touch attribution; mailbox content where a user connects one
Billing	Buyer name, billing address, GSTIN and other tax identifiers, payment references
HR and payroll	Name, contact details, photograph, date of birth, gender, marital status, blood group, nationality, employment history, salary, payslips, tax declarations, leave, appraisals; dependants’ names and dates of birth
Statutory identifiers	PAN, UAN, bank account and IFSC, and the last four digits of Aadhaar only — the full number is never stored
eClock attendance	Clock-in, break and clock-out times, and the device that recorded them
eClock monitoring (only where bought; the person is told under eCorpIT’s notice v4 or later, or consents individually under an earlier one)	Activity level, application name and (from eClock 0.2.0) how long it was in front, window title (encrypted), screenshots (encrypted), and web addresses where asked for — the site in plain text, the page encrypted, never anything after the “?”
eClock live view and remote control (only where bought; remote control only under notice v5 or later)	Who watched or controlled which computer, when, and how it ended; for remote control, whether the person was asked or had allowed it without asking, and each file moved — its name, size and direction, never its contents. The screen, pointer, keyboard and copied text pass encrypted end to end between the computer and the viewer’s browser and are not stored. Where you record remote-control sessions, the recording, encrypted under your organisation’s key and kept 90 days.
Marketing	Subscriber address, preferences, delivery outcome, opens and clicks, suppressions

Sensitive personal data

The HR module processes financial identifiers required by Indian payroll. We do not collect caste, religion, political opinion, trade-union membership, sexual orientation, or genetic or biometric identifiers.

Duration

For the subscription term plus the wind-down in section 11, except where a retention period you set is shorter — monitoring data leaves your reach on the deadline recorded at the moment it was captured, which a later settings change does not extend. We then hold a sealed copy — shown on no screen, with window titles, page addresses and screenshots still encrypted under your organisation’s own key — until at least 365 and at most 380 days from capture, when it is destroyed (Privacy Statement, retention; the storage service destroys each screenshot object 366 days after its upload).

Annex B — Authorised sub-processors

Sub-processor	Processing	Location
Cloudflare, Inc.	Application hosting, database, object storage, queues — all Customer Personal Data; and Cloudflare Realtime, which relays live views and remote-control sessions from eClock 0.6.0 as end-to-end encrypted traffic it cannot read	Global edge network
Cloudflare, Inc.	From 22 Nov 2026 (customers told on 23 Oct 2026): Cloudflare Workers AI, through Cloudflare AI Gateway, words each person’s eClock daily summary from that day’s figures, without their name, screenshots, window titles or page addresses — only in an organisation that has adopted eCorpIT’s notice v7; nothing is logged at Cloudflare and nothing is used to train a model	Global edge network
Amazon Web Services, Inc.	Outbound email delivery and bounce processing — recipient addresses and message content	United States
Razorpay Software Private Limited	Payment processing for subscriptions and invoices	India
Microsoft Corporation	Reading a connected Outlook mailbox — only where a user connects one	Provider’s region
Google LLC	Reading a connected Gmail mailbox; and resolving a watched video’s title through the YouTube Data API where address recording is enabled	United States
Zoho Corporation	Reading a connected Zoho mailbox — only where a user connects one	Provider’s region

The mailbox providers process data only for organisations that connect a mailbox, and the YouTube lookup happens only for organisations that enable address recording. Neither is used otherwise.

Annex C — Technical and organisational measures

Stated as things that are true and checkable rather than as intentions, because this is the annexe somebody produces after an incident.

Separation between customers

Every record carries the organisation that owns it, and every query is scoped to one organisation.
That scoping is enforced by automated checks that fail the build, not by convention — a database statement that touches a tenant-owned table without an organisation predicate cannot be merged unless it is explicitly marked and justified.

Encryption

All traffic is encrypted in transit.
eClock window titles, page addresses and screenshots are additionally encrypted at rest under a key held per organisation. Screenshot bytes are stored separately from the database and never enter it.
Live views from eClock 0.6.0 and remote-control sessions are encrypted end to end between the computer and the viewer’s browser, under keys the two agree for each session: the relay, and we, carry only ciphertext. A recorded session is encrypted at rest under your organisation’s key, as screenshots are.
Erasure destroys that key, after which the retained rows and files are unreadable — deletion that does not rely on trusting us to have deleted it.

Access control

Sign-in is by one-time code sent to a work email address; there are no passwords to reuse or leak.
Session cookies are __Host- prefixed, HttpOnly, Secure and SameSite=Lax.
Statutory identifiers (PAN, UAN, bank details) are held in a physically separate table, readable only through a route that records who read them and why. A person’s manager has no access by default.
Support access requires a time-limited grant approved by your administrator.
Devices running eClock can be revoked by an administrator and stop on their next request; suspending or exiting someone revokes their devices for that organisation only.

Accountability

Every change records who made it, to what, and when. Attribution comes from the authenticated session, never from a submitted field.
Each person’s reading of eCorpIT’s notice, and under an earlier notice their consent to each monitoring permission, is recorded with the version of the notice; a changed notice stops collection until they have read, or agreed to, the new one.
Every live view and remote-control session is recorded before it starts, with who opened it, and every playback of a recording is recorded against the person who played it.

Resilience

Encrypted backups are taken nightly and deliberately exclude the per-organisation encryption keys, so restoring a backup cannot resurrect data an organisation has erased.
Retention is enforced by a scheduled sweep against a deadline stored on each record when it was captured.
Object deletion is verified before the record naming it is removed, so a failed deletion is retried rather than leaving an orphaned file nothing remembers.

Development

Changes go through automated linting, type-checking and an automated test suite before release.
Security reports are accepted at security@ecorpit.com; we do not pursue good-faith research.

Contact

Data protection and this DPA: privacy@ecorpit.com
Countersigned copies and legal notices: legal@ecorpit.com
DPDP Grievance Officer: grievance@ecorpit.com
Security: security@ecorpit.com