Skip to main content
Agency Cloud

Data processing agreement

Last updated

Version 2026-11-03. This agreement forms part of the Terms of Service between NILEDE TECHNOLOGIES PRIVATE LIMITED ("we", the "Processor") and the company or person that uses Agency Cloud (the "Customer"). It applies to personal data that the Customer puts into its workspace ("Customer Personal Data"), such as data about its employees, customers, vendors and leads. For that data the Customer decides why and how it is used (the "Controller" or "Data Fiduciary") and we process it on the Customer's behalf. Our own use of account data is described in the Privacy Policy.

1. What we do with the data

  • We process Customer Personal Data only to provide Agency Cloud to the Customer and only on the Customer's documented instructions. Using the product, and the settings the Customer chooses in it, are those instructions. If we think an instruction breaks the law, we will tell the Customer.
  • We do not sell Customer Personal Data, use it for advertising, or combine it with data from other customers.
  • The kinds of data and people involved are whatever the Customer enters: typically contact details, employment, attendance, leave and payroll data of its employees, and business contact details of its customers and vendors. The Customer is responsible for having a lawful basis to enter that data, for giving its employees and customers any notices the law requires, and for not entering data the service is not meant for.

2. Confidentiality

Everyone at the Processor with access to Customer Personal Data is bound by confidentiality. Access is limited to people who need it to run, secure and support the service. Support staff sign in to a workspace only through the recorded, time-limited process described in the Privacy Policy, and the person they sign in as is told by email when it happens.

3. Security

We protect Customer Personal Data with measures that include:

  • separation of each company's data, enforced on every request, and role-based access inside the workspace;
  • encryption in transit, encryption at rest for uploaded files, and field-level encryption of employee bank, routing, national ID and tax ID numbers;
  • two-factor authentication and passkeys for users, and required two-factor authentication for our administrators;
  • an audit trail of access to ID documents, role changes, exports, failed sign-ins and administrator actions;
  • rate limiting, secure headers, input sanitising, and regular dependency vulnerability checks;
  • limited retention of logs, notifications and technical copies of data, as set out in the Privacy Policy.

4. Sub-processors

The Customer allows us to use the sub-processors on our sub-processors page. We bind each of them to data protection terms no less protective than these. We will update that page before adding or replacing a sub-processor and email the account owner at least 30 days ahead. If the Customer objects on reasonable data protection grounds, we will work with it to find a solution, and if we cannot, the Customer may close its workspace as the Terms and the refund policy allow.

5. Helping the Customer with people's rights

The product lets people see and correct their own data, download a copy of it, and delete their account, and lets the Customer remove employees, customers and other records. If someone contacts us about Customer Personal Data, we pass the request to the Customer and do not answer it ourselves unless the law requires us to. We will give the Customer reasonable help with a request that the product cannot handle.

6. Personal data breaches

If we become aware of a breach of security that affects Customer Personal Data, we will tell the Customer's account owner without undue delay and in any event within 72 hours, with what we know about what happened, the data and people affected, what we are doing and what the Customer may need to do. We will keep the Customer informed and help it meet its own duty to notify regulators and the people affected.

7. Transfers

Files and outgoing email are processed in India (Mumbai). Some sub-processors process data elsewhere, as listed on the sub-processors page. Where the Customer's data is subject to GDPR or UK GDPR and goes to a country without an adequacy decision, the parties agree that the European Commission's standard contractual clauses (module 2, controller to processor, and module 3 where the Customer is itself a processor), and the UK International Data Transfer Addendum, are incorporated by reference, with the Customer as exporter and the Processor as importer, and the details in this agreement and the sub-processors page as their annexes.

8. Deletion and return

While the workspace is open, the workspace owner can download everything the workspace holds (Settings, Company, "Export company data") and the Customer can delete records one by one; deleted customers, vendors and leads are wiped after 30 days, except the name, address and tax number on accounting records. When the Customer closes its workspace or its account, we keep it for 30 days so it can be restored, then permanently erase it, including files. Removed employees' personal details are wiped 30 days after removal. Copies in backups expire on the backup schedule. We keep data longer only where the law requires us to, and then only for that purpose.

9. Audits

On request, and no more than once a year unless a breach has occurred or a regulator requires it, we will give the Customer the information it reasonably needs to check that we follow this agreement, such as answers to a security questionnaire. If that is not enough, the parties will agree a scope, time and confidentiality terms for an audit, and the Customer bears its own costs.

10. Liability and order of precedence

Each party's liability under this agreement is subject to the limits in the Terms of Service. If this agreement and the Terms conflict about the processing of Customer Personal Data, this agreement prevails.

11. Contact

Questions about this agreement: [email protected]. Grievance Officer: Swapnil Sargar, NILEDE TECHNOLOGIES PRIVATE LIMITED, 403/B, Annapurna Ashish, Opp. Manjunath College, Vishnunagar, Kalyan 421304, Maharashtra, India.