नेपाली

Legal

Data processing addendum

Last updated:

This addendum is being reviewed by our lawyer. If your business needs a signed copy, write to jkuldevllc@gmail.com.

1. What this is and when it applies

This addendum is part of the Terms of service between jKulDev LLC (“we”, the processor) and the shop (“you”, the controller). It applies whenever we process personal data on your behalf — the personal data inside your shop's records (“customer personal data”). It needs no signature; if you want a signed copy, write to jkuldevllc@gmail.com.

If this addendum and the Terms differ on personal data, this addendum wins.

2. Details of the processing

  • Subject matter and purpose: providing Accura to you — storing, organising and showing your books by role and branch, printing and exporting them, keeping offline counter copies in sync, publishing your website if you switch it on, and (when your people ask) answering Sahayak questions from them.
  • Duration: for the term of the agreement, then until deletion under “Deletion and return”.
  • People concerned: your owners and staff; your customers and suppliers and their contact people; buyers named on bills.
  • Types of data: names, phone numbers, email and postal addresses, PAN; roles and branches; bills, purchases, returns, receipts, payments, outstanding balances and credit limits; who entered, cancelled or printed what and when; day-close cash counts; website content and photos; questions and voice recordings passed to Sahayak (not stored).
  • Special categories: none intended.

3. Our duties as processor

We will:

  1. process customer personal data only on your documented instructions — these terms, your settings and your users' actions in Accura — unless the law requires otherwise (we will tell you first unless the law forbids it), and tell you if we think an instruction breaks data-protection law;
  2. make sure everyone who can access it is bound to confidentiality;
  3. keep the security measures in Annex 2;
  4. use sub-processors only as “Sub-processors” below allows;
  5. help you, as far as we reasonably can, answer requests from people exercising their rights;
  6. help you with security and breach notification;
  7. delete or return the data at the end;
  8. give you the information needed to show these duties are met.

4. Sub-processors

You authorise the sub-processors listed in our Privacy policy (“Who we share it with”). We have a contract with each that protects the data, and we remain responsible for them.

We will tell you at least 30 days before adding or replacing a sub-processor, by email to your owners or in the app. If you object on reasonable data-protection grounds, we will try to find a solution; if we cannot, you may stop using the affected service.

5. Security

We keep appropriate technical and organisational measures for the risk, described in Annex 2, and may improve them over time without lowering the overall protection. You are responsible for your own settings and users — roles, who has a login, counter PCs and their keys — and for the computers and phones your people use.

6. Personal data breaches

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to customer personal data, we will tell you without undue delay (and aim to within 48 hours), with what we know, what we are doing, and who to contact — and keep you updated, so you can meet any duty of your own to notify.

7. Helping with people's requests

Accura lets you find, correct and download the personal data in your books yourself. Bills cannot be changed or deleted, because Nepal's billing rules require them to be kept. If a person asks us directly about your records, we will send the request to you and not answer it ourselves unless you ask us to.

8. International transfers

Customer personal data is processed in Singapore and, through some sub-processors, in the United States and other countries. Where the law requires a safeguard for such a transfer, we rely on our sub-processors' contractual commitments, and we will sign further standard terms where the law requires them.

9. Deletion and return

You can download your books at any time while you use Accura. When the agreement ends, we will, at your written choice, delete customer personal data or give you a download of it and then delete it, within 90 days of your request — except what the law requires to be kept (such as bills), which we keep confidential and use for nothing else. Backups are overwritten on their normal cycle.

10. Information and audits

We will answer reasonable questions about how we protect customer personal data and provide the information needed to show we meet this addendum. If that is not enough, or a regulator requires it, you may audit us once a year with 30 days' notice, at your cost, during working hours, by an auditor bound to confidentiality, in a way that does not reveal other customers' data.

11. Liability and order of precedence

Each side's liability under this addendum is subject to the limits in the Terms, except where the law does not allow a limit.

12. Annex 1 — the parties

  • Controller: the shop, as named in its Accura account; contact: its owners.
  • Processor: jKulDev LLC; contact: jkuldevllc@gmail.com. Activities: providing Accura as described in “Details of the processing”.

13. Annex 2 — security measures

  • Encryption in transit (TLS) everywhere; data stored with providers that encrypt at rest.
  • Passwords stored as scrypt hashes; session tokens, invite codes and counter-PC keys stored as SHA-256 hashes. Session cookies are HttpOnly, secure and limited to the address they were issued for.
  • Access control enforced in the data layer for every request, by the person's roles in the shop and branch; one shop's records are never reachable from another shop. The whole API is tested against signed-out, other-shop and low-role access.
  • Limits on password guessing and invite codes, recording only the network part of the IP address; a temporary password must be changed before anything else works.
  • Bills and vouchers cannot be edited once posted; the activity log and the bill print log are append-only, enforced by the database.
  • Uploaded photos checked against their real type; shop websites served with a strict content security policy and per-visitor request limits.
  • The desktop app runs the page sandboxed, with no access to the computer beyond printing and, for Sahayak, the microphone.
  • AI: content passed to providers only when a user asks Sahayak; it can only read, within the user's permissions; no training on it by us; questions, recordings and answers are not stored.
  • Backups and point-in-time recovery by our database provider; separate development and production databases.

14. Annex 3 — sub-processors

The current list, with what each does and where, is in our Privacy policy under “Who we share it with”.