Back to Home

Data Protection & Security Policy

This Data Protection & Security Policy ("Policy") forms part of the contractual framework between:

BillionBiz, a company incorporated under the Companies Act, 2013, having its registered office at: No.22/122B, North Sourashtrapuram, Nagal Nagar, Dindugal, Tamil Nadu, India — 624001 ("BillionBiz", "Company", "We", "Us", or "Our")

AND

The Merchant ("Merchant", "You", or "Your") using the Platform.

This Policy governs the processing, storage, transmission, and protection of personal data in compliance with applicable Indian law.

1. Legal Framework

This Policy is framed in accordance with:

  • Information Technology Act, 2000
  • IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
  • IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
  • Consumer Protection Act, 2019
  • Digital Personal Data Protection Act, 2023 ("DPDP Act")
  • CERT-In Directions (as applicable)

Where cross-border processing occurs, applicable foreign laws may also apply. The Merchant bears responsibility for ensuring compliance where required.

2. Definitions

For the purposes of this Policy:

  • "Personal Data" means any data about an identifiable individual.
  • "Sensitive Personal Data" shall have the meaning assigned under applicable law.
  • "Data Principal" means the individual to whom personal data relates.
  • "Data Fiduciary" means the entity determining the purpose and means of processing.
  • "Data Processor" means the entity processing data on behalf of the Data Fiduciary.
  • "Processing" includes collection, storage, use, sharing, transfer, or deletion.
  • "Security Incident" means unauthorized access, disclosure, alteration, or destruction of data.

3. Role Allocation Under DPDP Act

3.1 Merchant as Data Fiduciary

The Merchant determines:

  • Purpose of data collection
  • Nature of data collected
  • Retention period
  • Disclosure to third parties

The Merchant bears primary statutory obligations toward Data Principals.

3.2 BillionBiz as Data Processor

BillionBiz processes data solely on documented instructions of the Merchant and does not determine the independent purpose of processing (except for limited operational or legal compliance purposes).

Nothing herein creates a joint fiduciary relationship.

4. Categories of Data Processed

The Platform may process:

4.1 Merchant Data

  • Business name
  • GST details
  • PAN
  • Bank details
  • Contact information

4.2 End Customer Data (Uploaded by Merchant)

  • Name
  • Address
  • Email
  • Phone number
  • Order history
  • Payment status

4.3 Technical Data

  • IP addresses
  • Device information
  • Log files
  • Usage analytics

BillionBiz does not intentionally collect sensitive personal data unless provided by the Merchant.

5. Lawful Basis of Processing

The Merchant warrants that:

  • Valid consent has been obtained from End Customers.
  • Privacy notices comply with the DPDP Act.
  • Processing is lawful, necessary, and proportionate.

BillionBiz relies on the Merchant's representations regarding lawful basis.

6. Purpose Limitation

BillionBiz processes data only for:

  • Hosting Merchant Store
  • Facilitating transactions
  • Platform functionality
  • Technical support
  • Regulatory compliance
  • Fraud prevention

No independent commercial exploitation of Merchant customer data shall occur.

7. Data Security Measures

BillionBiz implements commercially reasonable security practices including:

7.1 Administrative Safeguards

  • Access control policies
  • Employee confidentiality agreements
  • Role-based access controls

7.2 Technical Safeguards

  • Encryption in transit (HTTPS/SSL)
  • Secure cloud hosting
  • Firewall protections
  • Intrusion detection mechanisms
  • Regular patch management

7.3 Organizational Safeguards

  • Incident response framework
  • Access logs
  • Vendor risk assessments

Security measures are commercially reasonable but not absolute.

8. Data Breach & Incident Response

In the event of a Security Incident affecting Merchant data:

  • BillionBiz shall notify the Merchant without undue delay.
  • The Merchant remains responsible for notifying Data Principals and authorities unless otherwise required by law.
  • BillionBiz shall investigate the incident, mitigate risks, and cooperate in regulatory inquiries.

BillionBiz shall not be liable for breaches caused by Merchant negligence.

9. Data Retention

  • The Merchant determines retention policies.
  • BillionBiz retains data for the duration of subscription and as required for legal compliance, backup, and disaster recovery.
  • Upon termination, data may be deleted after a reasonable retrieval period.

10. Cross-Border Data Transfers

  • The Merchant may sell internationally.
  • BillionBiz may use cloud infrastructure that stores data outside India.
  • The Merchant warrants compliance with DPDP cross-border provisions, export restrictions, and foreign data protection laws.
  • The Merchant indemnifies BillionBiz for violations.

11. Sub-Processors

BillionBiz may engage third-party vendors, including:

  • Cloud hosting providers
  • Payment gateway integrations
  • Analytics providers

BillionBiz ensures contractual confidentiality and security obligations with such vendors.

12. Data Principal Rights

The Merchant shall enable:

  • Right to access
  • Right to correction
  • Right to erasure
  • Grievance redressal

The Merchant bears responsibility for responding within statutory timelines.

13. Audit & Inspection Rights

  • BillionBiz may audit Merchant privacy compliance.
  • The Merchant shall provide privacy policies, consent records, and processing documentation.
  • Failure may result in suspension.

14. Confidentiality

All personal data shall be treated as confidential information. This obligation survives termination.

15. Liability Allocation

The Merchant bears liability for:

  • Unlawful data collection
  • Invalid consent
  • Misleading privacy policies
  • Unauthorized data disclosures

BillionBiz's liability shall be limited as per the Master SaaS Agreement.

16. Indemnification

The Merchant shall indemnify BillionBiz against:

  • Data breach penalties
  • DPDP fines
  • Class action claims
  • Regulatory enforcement actions
  • Third-party lawsuits

This indemnity survives termination.

17. CERT-In & Regulatory Cooperation

In the event of a cybersecurity incident, BillionBiz may cooperate with CERT-In. The Merchant shall provide cooperation for investigation.

18. Child Data

The Merchant must obtain verifiable parental consent where required by applicable law.

19. Security Disclaimer

No system is completely secure. The Merchant acknowledges residual cybersecurity risk.

20. Governing Law

This Policy is governed by the laws of India. Jurisdiction: Chennai, Tamil Nadu.

21. Dispute Resolution

Subject to the arbitration clause under the Master SaaS Agreement.

22. Amendments

BillionBiz may update this Policy to reflect regulatory changes.

23. Survival

Clauses relating to Indemnity, Confidentiality, Liability, and Regulatory cooperation shall survive termination.

24. Contact

BillionBiz
No.22/122B, North Sourashtrapuram
Nagal Nagar, Dindugal, Tamil Nadu — 624001
Email: contact@billionbiz.in