Processor agreement

The business is the Data Fiduciary (s.2(i)). Zazer Ventures LLP (LLPIN ABZ-5865), India (registered office: fohrkast.com/company-information#contact), operating Fohrkast, is its Data Processor (s.2(k)) for the personal data the business brings to Fohrkast or collects through it: consent records, rights requests and grievances, incident records and the data map.

Fohrkast processes this personal data only to provide the service, on the business's instructions given through its settings and actions in the app, and as Indian law requires. Fohrkast does not sell it, use it for its own purposes or combine it with another business's data.

• » Personal details are encrypted with a key per person, wrapped by AWS KMS. Destroying that key makes them unreadable. Audit records carry references, never the details.
• » Access is by seat. Seats that open sealed details or approve steps sign in with an authenticator app. Each opening of sealed details is logged.
• » Every event sits on a hash-chained audit trail in the published format hash_v1 (fohrkast.com/law/hash-v1).
• » Database backups are taken daily and kept 7 days; an encrypted copy is kept 35 days.
• » Application, system and web server logs are kept one year (Rule 6(1)(e)).

Fohrkast staff do not open a business's records in the normal course. Emergency access needs a recorded reason and a time limit, is human only, and shows in the business's own log.

Fohrkast tells the business of a personal data breach affecting its data without delay and within 24 hours of detection.

Fohrkast drafts the intimations to the Data Protection Board and to each affected person (s.8(6), Rule 7). The business decides and sends them.

Fohrkast reports cyber incidents on its own systems to CERT-In as its Directions of 28 April 2022 require.

The current list, with locations, is at fohrkast.com/sub-processors. Fohrkast gives the business notice before a new sub-processor receives personal data, and holds each sub-processor to obligations no less protective than these.

The business may object to a new sub-processor by writing to support@fohrkast.com before it receives personal data. If the objection cannot be met, the business may close its account before that date, after exporting its records.

• » Fohrkast uses no AI model to process the records it holds for a business.
• » Fohrkast never sends records it holds for a business (sealed details, consent records, request threads, uploaded files) to any AI model, and never uses them to train one.
• » AI coding and rule-drafting tools used to build Fohrkast never hold production credentials or customer data. Emergency access stays human only.
• » Any later AI feature is added under the processor agreement's sub-processor notice, can be switched off per workspace, and states plainly that names cannot be reliably detected.

On the business's instruction, and when the business closes its account after the chance to export its records, Fohrkast erases the personal data it holds for the business (s.8(7)). Erased data is gone from backups within 35 days.

Records a business holds in Fohrkast, and Fohrkast's servers, backups and logs, are in India: in Mumbai, with backup and audit copies in Hyderabad.

Each sub-processor's location is at fohrkast.com/sub-processors.

Fohrkast gives the business the information it needs to show this agreement is met: the evidence pack, the audit trail and the version history of this agreement.

This agreement applies while the business uses Fohrkast and for any personal data Fohrkast still holds for it afterwards.

The owner accepts it in the app. The acceptance, the versions accepted and a SHA-256 hash of the texts are recorded on the business's own audit trail.