Data Processing Agreement

i.Roles

You are the controller: you decide why and how your customers’ personal data is used. Graymat (Private) Limited is your processor: we act on your instructions and for no other purpose.

Data about you and your team — account, billing, support — is different: there we are the controller, and /privacy governs it. This agreement is only about your customers.

ii.What we may do with it

Only what is needed to provide the service, and only as your Terms, your configuration and your written instructions require. Using it to improve our own product, to train a model, to build a marketing audience or to enrich anything of ours is outside the permission you are giving here.

If we believe an instruction of yours breaks the law, we will tell you and may pause it rather than carry it out.

iii.Annex A — what is processed

Subject matter: operating your commerce business inside Graymat. Duration: while your account is open, plus the deletion windows in clause viii. Data subjects: your customers, people who abandoned a cart, visitors to your store if you install the pixel, and your own staff.

Name, phone number, email — from your checkout, or typed by your agent for a phone order
Delivery address, area, city — from your checkout or your agent
Order contents, prices, the cash-on-delivery amount — from your store
Delivery status, attempts, return reason, cash settled — from your couriers
WhatsApp message content, delivery and read state — conversations between your team and your customer
Page views, referring advertisement, session identifier — only if you install the pixel
Your staff’s names, work emails and actions taken — your own account administration

Written from the live schema rather than a template: 66 tables hold personal data across 112 columns. No special-category data is intended or required — there is no field for health, religion, ethnicity, biometrics, government identity numbers or card numbers. A free-text note could be misused to record one; that is outside the intended use, and we ask you not to.

iv.Annex B — how it is protected

Separation by database first. Every merchant has their own Postgres database — not a shared table with a merchant column, which is the design that leaks when one query forgets its filter. Records also carry a tenant identifier as a second layer, but the database boundary is the one being relied on.
Automated isolation checks on every deployment. The build refuses to ship if a code path could serve one merchant’s data to another. Not a policy someone remembers — a gate the release cannot pass.
Access control role-scoped per person and per module; credentials stored apart from ordinary data and not readable through the ordinary interface.
Encryption in transit by TLS, at rest by the storage provider, including backups.
Backups daily and encrypted, plus an independent copy in separate object storage.

What we do not have, stated plainly. No ISO 27001. No SOC 2. No independent penetration test report. No formal 24/7 on-call rotation. If your procurement requires any of those, we do not meet it today — and we would rather you learned that here than three weeks into a process.

v.Sub-processors

You give general authorisation for us to use sub-processors. The current list is at /subprocessors, which describes each sub-processor by function and location. The named list is provided to you on request and forms part of this agreement.

30 days’ email notice before we add or replace one. Object on data-protection grounds within those 30 days and we will find another way — and if there is none, you may terminate the affected service without penalty, pro rata refunded. Every sub-processor is bound to terms no weaker than these, and we remain fully responsible to you for what they do.

vi.International transfers

Your data is stored outside your country. Databases sit on cloud infrastructure in the Asia Pacific (Tokyo) region. Application hosting, AI processing and messaging providers are largely United States companies.

This is in a box because it is the clause most often buried. If your regulator, your own policy or a customer contract requires the data to stay in-country, Graymat cannot meet that today. Tell us before you onboard rather than after. Where a transfer mechanism is required by law, we will enter into the appropriate standard contractual terms on request.

vii.Helping you meet your obligations

Requests from individuals. The interface finds everything held about one person by phone number, exports it, and deletes it. If a request needs more, we do it for you at no charge. If someone contacts us directly we will not answer for you — we tell you within 5 working days.
Breaches. We tell you within 72 hours of becoming aware, with what we know at that point rather than waiting for a complete picture.
Assessments. We give you what you reasonably need for an impact assessment or a regulator’s enquiry.

viii.Deletion and return

Export any time while the account is open. On termination your data stays available for 30 days; after that we delete it from live systems and it ages out of backups within a further 90 days. We confirm in writing when it is gone, if you ask.

We keep only what the law requires — invoices, tax records, and a minimal access log. None of it contains your customers’ contact details.

ix.Audit

Once a year, or after a breach affecting you, ask us to demonstrate compliance. We will answer a reasonable security questionnaire and walk your team through how isolation and access control actually work — including showing the automated checks run.

An on-site inspection or third-party audit is at your cost, on 30 days’ notice, no more than once a year, and must not disturb another merchant’s data.

x.Liability and precedence

Liability here is subject to the cap in your Terms. Where this agreement and the Terms conflict on the handling of personal data, this agreement wins.