This Data Processing Agreement ("DPA") is between Dentobees Innovations LLP, Hilite Business Park, Kozhikode, Kerala, India ("Dentobees", the "Processor"), and the business that uses salestrack CRM (the "Customer", the "Controller"). It forms part of the salestrack Terms of service and applies whenever Dentobees processes Customer Personal Data to provide salestrack. The Customer accepts it by accepting the Terms. To receive a signed copy, email harshad@dentobees.com.
Definitions
Data Protection Laws: India’s Digital Personal Data Protection Act, 2023 and its Rules; the EU GDPR and UK GDPR where they apply; and any other data protection law that applies.
Customer Personal Data: personal data the Customer, its users or its contacts put into salestrack, such as leads, contacts, WhatsApp chats, notes and files.
Controller / Data Fiduciary: the Customer. Processor / Data Processor: Dentobees. Sub-processor: a third party Dentobees engages to process Customer Personal Data.
Personal Data Breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
Roles and instructions
Dentobees processes Customer Personal Data only to provide, secure and support salestrack, and only on the Customer’s documented instructions: the Terms, this DPA and the Customer’s use of salestrack’s settings and features.
Dentobees will tell the Customer if it believes an instruction breaks Data Protection Laws. It will not sell Customer Personal Data, use it for its own marketing, or use it to train AI models.
The Customer is responsible for the lawfulness of the data it collects, including valid opt-in to contact people on WhatsApp, and for giving the notices the law requires.
Confidentiality and security
Only staff and contractors who need access can reach Customer Personal Data, and they are bound by written confidentiality duties.
Dentobees uses role-based access, phone-number masking for chosen roles, separate permissions for export, delete and revenue visibility, an activity log of every action, encryption in transit (HTTPS/TLS) and at rest, daily backups, and hosting on AWS in Mumbai, India. It reviews these measures at least once a year.
Personal data breaches
Dentobees will notify the Customer without undue delay, and within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
The notice will describe what happened, the data and people likely affected, the likely consequences and the steps taken. Dentobees will help the Customer meet its own duties to notify the Data Protection Board of India, other regulators and affected people.
Sub-processors
The Customer authorises these Sub-processors: Amazon Web Services (hosting, Mumbai, India); Meta Platforms (WhatsApp Business Platform, Facebook and Instagram); Gupshup (WhatsApp Business Solution Provider); Anthropic and Google Gemini API (AI models for the AI sales agent and AI summaries); Razorpay (payments in India); and Stripe (international payments).
Each is bound by a written contract with data protection duties no less protective than this DPA, and Dentobees stays responsible for them. AI providers receive only the chat text needed to generate replies and summaries.
Dentobees will give at least 30 days’ notice before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds. If the objection cannot be resolved, the Customer may end the affected service and receive a pro-rata refund of prepaid subscription fees for it.
International transfers
Customer Personal Data is hosted in India. Some Sub-processors may process it in other countries. For transfers of EU or UK personal data to countries without an adequacy decision, the parties agree to the EU Standard Contractual Clauses and the UK Addendum, incorporated by reference.
Data subject requests and assistance
If Dentobees receives a request from a Data Subject about Customer Personal Data, it will pass it to the Customer. salestrack lets the Customer find, export, correct and delete records, and Dentobees will give reasonable further help, including with impact assessments and regulator consultations.
Audits
Once a year on written request, Dentobees will answer a reasonable security questionnaire and share relevant policies. Where a regulator requires it, or after a Personal Data Breach, the Customer may audit on 30 days’ notice, during business hours, at its own cost and under confidentiality.
Return and deletion
After the Terms end, the Customer can export its data for 30 days. Dentobees then permanently deletes Customer Personal Data from live systems; backup copies are removed on their normal cycle, unless the law requires longer retention.
Details of processing
Subject and purpose: providing salestrack CRM, including lead capture, WhatsApp messaging, assignment, follow-ups, broadcasts, reporting and advertising attribution.
Data Subjects: the Customer’s leads, prospects and customers, and its staff and users. Data types: names, phone and WhatsApp numbers, email addresses, city, message content, notes, files, lead source and ad details, deal stage and value, and user log-in and activity data.
Duration: the term of the Terms plus the 30-day export period. The service does not require special-category or health data.
Liability, law and changes
Liability under this DPA is subject to the limits in the Terms. This DPA is governed by the laws of India and the courts at Kozhikode, Kerala, except where the Standard Contractual Clauses require otherwise. Dentobees may update this DPA without lowering the overall protection it gives the Customer.
Contact
Dentobees Innovations LLP, Hilite Business Park, Kozhikode, Kerala, India. Email: harshad@dentobees.com.
Questions? Contact us.