Roles
The business is the Data Fiduciary for its customers' and staff's personal data. Virtue Tailor India Private Limited is the Data Processor and processes that data only to provide VirtueTailor to the business, on its documented instructions (its use of the app).
The business's duties
- Give each customer the notice VirtueTailor provides (Privacy notice for customers) and record their consent in the app, before or when collecting data.
- For a customer under 18, record the consenting parent or guardian.
- Send WhatsApp or other messages only to customers who agreed to them.
- Act on customers' requests to access, correct or erase their data; VirtueTailor provides export and erase tools for this.
- Give staff only the access they need, using roles and permissions.
VirtueTailor's duties
- Process the data only to provide the service, never for its own marketing.
- Keep it secure with reasonable safeguards: encryption, access control, logging.
- Bind its own service providers (hosting, messaging, payments) to the same duties.
- Tell the business without delay about a personal data breach affecting its data, and help it inform the Board and the people affected.
- Help the business answer data principals' requests.
- When the business leaves, let it export its data, then erase it within 90 days, except records the law requires to be kept.
Logs and audits
VirtueTailor keeps logs of processing for at least one year and will give the business reasonable information to show it meets these terms.