Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between Best Review 99 (“Data Fiduciary”, “we”, “us”, “our”), founded and operated by Changthak Debbarma, and all registered vendors, sellers, service providers, and partners (“Data Processor”, “you”, “your”) who access, process, or handle personal data of customers through our platform.

This DPA ensures compliance with the Digital Personal Data Protection Act (DPDP) 2023 of India and establishes the legal obligations, security standards, and data protection measures that all processors must adhere to when handling personal data on behalf of Best Review 99.

Customer Data (Shared with Vendors for Order Fulfillment):

• ✓ Full Name — For delivery and communication
• ✓ Mobile Number — For delivery coordination and OTP
• ✓ Email Address — For order confirmations
• ✓ Delivery Address — Complete shipping address with pincode
• ● Order Details — Products purchased, quantity, price

Vendor Data (Collected during Registration):

• ● GSTIN — If applicable, for tax compliance
• ● Bank Account Details — For payout processing
• ● ID Proof — KYC verification (PAN, Aadhaar)
• ● Business Address — Vendor’s registered address
• ● Contact Information — Vendor email and phone

We engage the following sub-processors for operational needs. All sub-processors are contractually bound to comply with this DPA and DPDP Act 2023:

• ● cCloud — Cloud Infrastructure Provider (Server hosting, data storage, ISO 27001 & SOC 2 Type II certified)
• ● Shiprocket — Logistics & Delivery Partner (Order fulfillment, shipping, tracking)
• ● RBI-Approved Payment Gateway — Secure payment processing (Card, UPI, Net Banking transactions)
• ● Google Analytics — Website traffic analysis and performance monitoring (anonymous data)
• ● Google AdSense — Advertisement serving on blog posts (anonymous browsing data)
• ● Monetag — Additional ad network for content monetization
• ● Meta (Facebook/Instagram) — Ad tracking and retargeting
• ● GTranslate — Language translation services

• ✕ Use Data ONLY for Order Fulfillment: Customer data must be used exclusively for processing, packing, and delivering the specific order. No other use is permitted.
• ✕ No Marketing Use: Vendors must NOT use customer data for marketing, promotions, upselling, or any commercial communication without explicit consent.
• ✕ No Data Sharing: Vendors must NOT share, sell, rent, or transfer customer data to any third party.
• ✕ No Data Retention: Vendors must delete all customer data within 30 days of order completion/return closure.
• ✓ Secure Storage: Any temporary storage of customer data must be encrypted and access-controlled.
• ✓ Breach Notification: Report any data breach to Best Review 99 within 24 hours.
• ✓ Staff Training: Ensure all staff handling customer data are aware of DPDP Act obligations.

Infrastructure Security:

• ✓ cCloud Hosting: Our multi-vendor marketplace is hosted on cCloud, which complies with world-class security standards including ISO 27001 and SOC 2 Type II. This ensures industry-grade physical and logical security for all stored data.
• ✓ SSL/TLS Encryption: All data in transit is protected using SSL/TLS encryption.
• ✓ Data at Rest: Sensitive data such as passwords and payment tokens is hashed and encrypted.

Access Control & Management:

• ✓ RBAC: Strict Role-Based Access Control (RBAC) enforced on the cCloud panel. Only authorized administrators have backend access.
• ✓ Limited Vendor Access: Vendors can only access order data relevant to their own orders, not platform-wide data.
• ✓ Audit Logs: All data access and modifications are logged for compliance review.

Patch Management & Updates:

• ✓ Regular Patches: Security patches and updates are deployed regularly on the Cloud Panel to remediate vulnerabilities.
• ✓ Vulnerability Scanning: Periodic security assessments to identify and fix potential risks.

As a Data Principal under Indian law, customers have the following rights. Vendors must respect and facilitate these rights:

• ✓ Right to Access: Request a copy of their personal data processed by us or vendors
• ✓ Right to Correction: Update or correct inaccurate personal data
• ✓ Right to Erasure: Request deletion of their account and associated data
• ✓ Right to Withdraw Consent: Opt-out of cookies, ads, and marketing anytime
• ✓ Right to Grievance Redressal: File complaints with our Grievance Officer
• ✓ Right to Nominate: Nominate another individual to exercise rights on their behalf

• ✕ Immediate Reporting: Any suspected or confirmed data breach must be reported to Best Review 99 within 24 hours of discovery.
• ✕ No Independent Disclosure: Vendors must NOT inform customers, media, or authorities about a breach without our written approval.
• ● Investigation Support: Vendors must cooperate fully with breach investigations and provide all requested logs and evidence.
• ● Remediation: Vendors must take immediate steps to contain the breach and prevent further unauthorized access.

• ● Immediate Data Deletion: Upon termination of vendor account or this DPA, vendor must delete ALL customer data within 7 days.
• ● Data Return: If requested, vendor must return all customer data to Best Review 99 in a structured format before deletion.
• ● Certificate of Deletion: Vendor must provide a written confirmation that all data has been permanently deleted.
• ● Audit Rights: Best Review 99 reserves the right to audit vendor’s data deletion compliance.