Data Processing Agreement

Draft — This agreement is pending legal review. Highlighted items in [brackets] will be completed before launch.

This Data Processing Agreement ("DPA") explains how GRID processes personal data contained in the accounting information you work with in GRID, and the commitments each of us makes to protect it. It forms part of the GRID Terms of Service (the "Terms").

1. Parties and acceptance

1. This DPA is entered into between [Legal entity name], having its registered office at [Registered office address] ("GRID"), and the person or entity that holds a GRID account and accepts this DPA (the "Customer").
2. If you accept this DPA on behalf of a firm, company or other organisation, you confirm that you are authorised to bind that organisation. In that case "Customer" means that organisation.
3. The Customer accepts this DPA by ticking the box "I have read and accept the Data Processing Agreement and Privacy Notice" at sign-in. Acceptance is required at every sign-in. The Service cannot be accessed without it. Each acceptance applies to the version of this DPA shown at that time.
4. GRID keeps a record of each acceptance: account, DPA version, date and time, IP address and device type. This record is evidence of the agreement between the parties.

2. Definitions

In this DPA, the following terms have these meanings. Terms not defined here have the meanings given in the DPDP Act.

• "DPDP Act" means the Digital Personal Data Protection Act, 2023. "DPDP Rules" means the Digital Personal Data Protection Rules, 2025, in each case as amended from time to time.
• "Applicable Data Protection Law" means the DPDP Act, the DPDP Rules, the Information Technology Act, 2000 and rules made under it (to the extent applicable), the CERT-In Directions dated 28 April 2022, and any other law in India relating to the protection of personal data that applies to the processing under this DPA.
• "Board" means the Data Protection Board of India established under the DPDP Act.
• "Customer Data" means all data that the Customer or its Authorised Users submit to the Service for processing, including trial balances, ledgers, groups, vouchers, stock data, bills outstanding, data read from Tally Prime or other accounting software, mappings, adjustments, notes and generated financial statements. "Customer Personal Data" means any personal data contained in Customer Data.
• "Authorised User" means an individual whom the Customer permits to use the Service under its account, such as partners, employees and article assistants.
• "Companion App" means the GRID software installed on the Customer's device that connects to Tally, stores Customer Data locally and communicates with the Service.
• "Local Workspace" means the folder or storage location on the Customer's device, or on storage controlled by the Customer, where the Companion App saves Customer Data.
• "Processing Engine" means GRID's server-side software that converts Customer Data into financial statements, notes, ratios and exports.
• "Personal Data Breach" has the meaning given in section 2(u) of the DPDP Act: any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.
• "Service" means the GRID web application, Processing Engine, Companion App and related services provided under the Terms.
• "Sub-processor" means any third party engaged by GRID that may process Customer Personal Data on GRID's behalf.

3. Roles of the parties

1. Customer as Data Fiduciary. For Customer Personal Data, the Customer (alone or with its own clients) determines the purpose and means of processing and is the Data Fiduciary under the DPDP Act.
2. GRID as Data Processor. GRID processes Customer Personal Data only on behalf of the Customer, as its Data Processor within the meaning of section 2(k) of the DPDP Act, and under section 8(2), which allows a Data Fiduciary to engage a Data Processor under a valid contract.
3. Professionals acting for clients. Where the Customer is a chartered accountant, accounting firm or other professional preparing statements for its own clients, the Customer is responsible for having the necessary engagement, authority and, where relevant, consent from those clients. The Customer's instructions to GRID are given on its own behalf and on behalf of those clients.
4. GRID as Data Fiduciary for account data. For personal data of Authorised Users that GRID collects to operate accounts, licences, billing and security, GRID acts as an independent Data Fiduciary. That data is governed by the GRID Privacy Notice, not by this DPA.

4. Details of the processing

5. Customer obligations

1. Lawful basis. The Customer shall ensure that it has a valid ground under the DPDP Act (consent or a legitimate use under section 7) for all Customer Personal Data it submits, and that it has given any notices required under section 5 to the relevant Data Principals.
2. Lawful instructions. The Customer's instructions shall comply with Applicable Data Protection Law. The Customer's use of the Service, and the settings it chooses, are its documented instructions to GRID.
3. Accuracy. The Customer is responsible for the accuracy, completeness and consistency of Customer Data, as required of a Data Fiduciary by section 8(3) of the DPDP Act, and for reviewing all outputs before use. GRID's outputs are an aid to preparation and do not replace professional judgement or audit.
4. Data minimisation. The Customer shall submit only data necessary to prepare financial statements. Where practical, the Customer should avoid including unnecessary personal identifiers (such as PAN, Aadhaar, phone numbers or addresses) in ledger names or narrations, and shall never submit Aadhaar numbers, passwords, card or bank credentials, or sensitive personal data.
5. Local Workspace security. Because Customer Data is stored on the Customer's own devices, the Customer is responsible for:
   • securing those devices with up-to-date operating systems, anti-malware and screen locks;
   • controlling who can access the Local Workspace;
   • enabling the Companion App's local encryption where offered;
   • maintaining regular backups;
   • securely deleting Customer Data when no longer needed, in line with its own retention obligations.
   GRID has no access to, and no responsibility for, the Local Workspace.
6. Authorised Users. The Customer shall ensure that only Authorised Users access the Service, that credentials are kept confidential, that access is promptly revoked for users who leave, and that Authorised Users comply with this DPA.
7. Data Principal requests. The Customer is responsible for responding to requests from Data Principals relating to Customer Personal Data. GRID will assist as described in clause 9.
8. Customer's own breach duties. Where a Personal Data Breach occurs within the Customer's systems or Local Workspace, the Customer is responsible for notifying the Board and affected Data Principals as required by the DPDP Act and Rules.

6. GRID's obligations

1. Processing only on instructions. GRID shall process Customer Personal Data only on the Customer's documented instructions and only to provide the Service. If GRID believes an instruction infringes Applicable Data Protection Law, it will inform the Customer and may suspend that processing.
2. No secondary use. GRID shall not use Customer Data for its own purposes. In particular, it shall not use it for analytics, benchmarking, profiling, marketing, product research, or training or improving any machine-learning or artificial-intelligence model. GRID shall not sell, rent, share or disclose Customer Data except as permitted by this DPA.
3. Confidentiality of personnel. GRID shall ensure that everyone authorised to operate the Processing Engine is bound by written confidentiality obligations, is trained in data protection, and has access only to what their role requires. Under GRID's architecture, personnel have no routine means of viewing Customer Data.
4. Security. GRID shall implement and maintain the reasonable security safeguards described in clause 8 and Schedule 2.
5. Compliance. GRID shall comply with the obligations that Applicable Data Protection Law places on a Data Processor, and shall help the Customer comply with its obligations as Data Fiduciary as set out in this DPA.
6. Records. GRID shall maintain records of its processing activities, security measures, Sub-processors and incidents, sufficient to show compliance with this DPA.

7. Zero-retention processing

GRID's central commitment is that Customer Data is not retained on GRID's infrastructure. Specifically:

1. Transit. Customer Data travels between the Customer's device and the Processing Engine only over connections encrypted with TLS 1.2 or higher.
2. In-memory only. The Processing Engine holds Customer Data in volatile memory only for the duration of a processing request. It does not write Customer Data to any database, disk, file store, cache, queue, backup or snapshot.
3. Discard. On completion or failure of a request, all references to Customer Data are released and the memory is returned to the operating system. Output files are streamed directly to the Customer's device and are not kept on the server.
4. No payload logging. Application logs, access logs, error reports, crash dumps and monitoring tools are configured to exclude request and response bodies. Logs contain only technical metadata, such as time stamp, account identifier, endpoint, response code, size and duration. If, despite these controls, Customer Data is ever found in a log or other persistent store, GRID shall treat it as a security incident under clause 10, delete it promptly and inform the Customer.
5. Consequences. The Customer acknowledges that, because of this design, GRID cannot recover, restore, re-send or produce Customer Data. The Customer is solely responsible for keeping copies in its Local Workspace and backups.
6. Changes. GRID shall not change this zero-retention model for Customer Data without at least 60 days' prior written notice and the Customer's express opt-in. Any optional feature that stores Customer Data (for example, a future cloud backup) will be disabled by default and subject to separate terms.

8. Security safeguards

1. GRID shall take reasonable security safeguards to protect Customer Personal Data in its possession or under its control, including in the Processing Engine and in transit, against Personal Data Breach, as required by section 8(5) of the DPDP Act and the DPDP Rules.
2. These safeguards include, at a minimum:
   • encryption;
   • access control;
   • visibility over access through logs and monitoring;
   • measures for continued processing in the event of compromise;
   • contractual safeguards with Sub-processors.
   They are described in detail in Schedule 2.
3. GRID shall review its safeguards at least once a year, and after any significant incident or change to the Service, and may update them provided the overall level of protection is not reduced.
4. The Companion App shall be distributed only through GRID's official channels, digitally signed, and updated to fix security vulnerabilities promptly.

9. Assistance with Data Principal rights

1. Because GRID does not retain Customer Data, it is generally not able to locate, access, correct or erase Customer Personal Data. Those actions are carried out by the Customer in its Local Workspace, for example by editing or deleting records.
2. If GRID receives a request from a Data Principal relating to Customer Personal Data, it shall not respond to it directly (except to acknowledge it and redirect the requester). Where it can identify the relevant Customer, it shall forward the request to that Customer without undue delay, and in any event within 5 working days.
3. GRID shall provide reasonable information and assistance to help the Customer respond to Data Principal requests, grievances and enquiries from the Board, taking into account the nature of the processing.

10. Personal Data Breach

1. Notification to Customer. GRID shall notify the Customer without undue delay, and in any event within 24 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data processed by GRID. This allows the Customer to meet its own obligation to inform the Board and affected Data Principals.
2. Content. The notification shall, to the extent then known, describe:
   • the nature, extent, timing and location of the breach;
   • the categories and approximate number of Data Principals and records affected;
   • the likely consequences;
   • the measures taken or proposed to contain it and mitigate its effects;
   • safety measures the Customer or Data Principals may take;
   • a contact point at GRID.
   GRID shall supplement the notification as further information becomes available.
3. Support for Board reporting. GRID shall give the Customer the information it reasonably needs to prepare the detailed report to the Board required by the DPDP Rules within 72 hours of becoming aware of the breach. This includes the broad facts, circumstances and reasons, the mitigation measures, any findings about the person responsible, the remedial measures to prevent recurrence, and a report on intimations given to affected Data Principals.
4. CERT-In. GRID shall report cyber-security incidents affecting its infrastructure to CERT-In within the period required by the CERT-In Directions, currently six hours from noticing the incident.
5. Containment and cooperation. GRID shall promptly take reasonable steps to contain, investigate and remedy the breach, preserve relevant evidence, and cooperate with the Customer, the Board and other competent authorities.
6. No admission. Notification of a breach is not an acknowledgement of fault or liability by GRID.
7. Communications. GRID shall not notify Data Principals of a breach of Customer Personal Data directly without first consulting the Customer, unless required by law.
8. GRID's end-to-end breach response process is summarised in Schedule 4.

11. Sub-processors

1. The Customer gives GRID general authorisation to engage the Sub-processors listed in Schedule 3.
2. GRID shall enter into a written contract with each Sub-processor imposing data-protection obligations no less protective than those in this DPA. GRID remains responsible to the Customer for its Sub-processors' performance.
3. GRID shall give at least 30 days' notice of any new or replacement Sub-processor that may process Customer Personal Data, by updating Schedule 3 and notifying Customers by email or in-app message. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees for the unused period.

12. Location and cross-border transfers

1. The Processing Engine is hosted in India. GRID shall not process Customer Personal Data outside India without the Customer's prior consent.
2. AI reading of PDF statements. When the Customer uploads last year's financial statements as a PDF, GRID sends that PDF to its AI provider to read the statements and draft last year's head-wise trial balance. The AI provider is OpenAI, L.L.C. (ChatGPT) or, where GRID has configured it instead, Anthropic, PBC (Claude), both listed in Schedule 3; only one provider receives a given PDF. By accepting this Agreement the Customer consents to this processing. The PDF is processed outside India solely for that purpose and the result is returned to the Customer's session. The PDF is not stored by GRID. Neither provider uses data received through its commercial API to train its models, and each retains it only for the limited period set out in its commercial terms. If AI reading is unavailable, GRID's own reader processes the PDF on GRID's server and nothing is sent to an AI provider. A Customer that does not want AI reading may upload last year's head-wise trial balance in Excel instead, which is read without AI.
3. In any event, GRID shall not transfer Customer Personal Data to any country or territory restricted by the Central Government under section 16 of the DPDP Act, and shall comply with any conditions prescribed under the DPDP Rules.

13. Requests from authorities

1. If GRID receives a legally binding request from a government authority, court or regulator to disclose Customer Personal Data, it shall, unless legally prohibited:
   • promptly notify the Customer;
   • disclose only the minimum required;
   • seek to redirect the authority to the Customer.
2. Because GRID does not retain Customer Data, GRID will ordinarily be unable to produce it. The Customer acknowledges that GRID may state this fact to the requesting authority.

14. Information and audits

1. On written request, and not more than once in any 12-month period, GRID shall provide the Customer with information reasonably necessary to show compliance with this DPA. This includes a summary of Schedule 2 controls, the latest independent security-testing summary, and any certifications GRID holds.
2. Where that information is reasonably insufficient, or where required by the Board or by law, the Customer (or an independent auditor bound by confidentiality) may conduct an audit, subject to all of the following conditions:
   • at least 30 days' written notice;
   • during normal business hours;
   • in a way that does not compromise the security or confidentiality of other customers;
   • at the Customer's cost, unless the audit reveals a material breach of this DPA by GRID.

15. Deletion and return

1. Because Customer Data is discarded after each request, no Customer Data remains with GRID to return or delete when the Service ends.
2. On request after termination, GRID shall confirm in writing that it holds no Customer Data.
3. Customer Data in the Local Workspace remains the Customer's property and under its control after termination. The Companion App will continue to allow read-only access to previously generated files for at least 90 days after termination.
4. Account data is handled as described in the Privacy Notice.

16. Liability and indemnity

1. Each party is liable for breach of its own obligations under this DPA and Applicable Data Protection Law, subject to the limitations and exclusions of liability in the Terms. Those limitations do not apply to liability that cannot lawfully be limited.
2. The Customer shall indemnify GRID against penalties, claims and losses arising from:
   • Customer Data submitted without a lawful basis or notice;
   • unlawful instructions;
   • breaches within the Customer's systems or Local Workspace.
3. GRID shall indemnify the Customer against penalties imposed by the Board, and against third-party claims, to the extent they result directly from GRID's breach of this DPA. This is subject to the limitations in the Terms.

17. Term, changes and precedence

1. Term. This DPA takes effect on acceptance and continues for as long as the Customer has access to the Service. Clauses that by their nature should survive termination, including confidentiality, liability, audit and clause 15, shall survive.
2. Changes. GRID may update this DPA to reflect changes in law, guidance from the Board, or changes to the Service. Material changes will be notified by email at least 15 days before they take effect, unless a shorter period is required by law. Because acceptance is required at every sign-in, the Customer will be shown the current version before each session.
3. Precedence. If there is any conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails.
4. Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force.

18. Governing law and disputes

1. This DPA is governed by the laws of India.
2. The parties shall first try to resolve any dispute in good faith within 30 days. Failing that, the dispute shall be referred to arbitration by a sole arbitrator under the Arbitration and Conciliation Act, 1996, seated at [City] and conducted in English.
3. Subject to clause 18.2, the courts at [City] have exclusive jurisdiction.
4. Nothing in this clause limits any person's right to approach the Board under the DPDP Act.

Schedule 1: Customer instructions

The Customer instructs GRID to process Customer Data in order to:

1. receive Customer Data uploaded by the Customer (Excel or CSV trial balances) or read by the Companion App from Tally Prime at the Customer's direction;
2. validate the data, for example by checking that the trial balance tallies and flagging unmapped or unusual balances;
3. suggest and apply mappings of ledgers to Schedule III line items, which the Customer may review and override;
4. prepare the Balance Sheet, Statement of Profit and Loss, Cash Flow Statement (indirect method), notes to accounts, ratio analysis and comparatives;
5. produce output files in the format the Customer selects (Excel, Word or PDF) and return them to the Customer's device;
6. discard all Customer Data after each request, in line with clause 7.

Schedule 2: Security safeguards

Schedule 3: Authorised Sub-processors

Providers that process only GRID account data, such as the payment gateway and email provider, are listed in the Privacy Notice.

Schedule 4: Breach response summary

1. Detect and report. Alerts, staff reports and external reports are routed to the on-call security lead 24×7.
2. Triage (within 1 hour). Confirm whether an incident has occurred, classify its severity, and open an incident record with time stamps.
3. Contain. Isolate affected systems, revoke compromised credentials, block malicious traffic and preserve evidence.
4. Notify authorities. Report to CERT-In within 6 hours of noticing a reportable cyber-security incident.
5. Notify Customers. Inform affected Customers within 24 hours of becoming aware of a Personal Data Breach, with the details in clause 10.2.
6. Support Board reporting. Provide information for the Customer's report to the Board within 72 hours. Where GRID is itself the Data Fiduciary (for account data), GRID notifies the Board and affected individuals directly.
7. Eradicate and recover. Remove the root cause, restore services from known-good state, and monitor closely.
8. Review. Hold a post-incident review within 14 days, identify corrective actions with owners and deadlines, and share a summary with affected Customers.

By ticking "I have read and accept the Data Processing Agreement and Privacy Notice" at sign-in, the Customer agrees to this Data Processing Agreement.