Follow us on:
INCUSPAZE SOLUTIONS PRIVATE LIMITED
PRIVACY POLICY
This Privacy Policy was most recently updated on 7th September 2026.
1. introduction
1.1 Incuspaze Solutions Private Limited (hereinafter referred to as the, “Incuspaze”, “Company”, “It” “We”, “Us” or “Our”) is inter-alia engaged in the business of developing and providing managed office solutions, co-working space solutions and serviced offices services (“Services”) that provide office spaces along with value added services for the incremental productivity of the employees of our clients
1.2 Incuspaze respects your privacy of any information that you may provide to Incuspaze while utilizing our Services and is fully committed to protect it through its compliance with this Privacy Policy, the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (“the DPDP Act”), and the rules made thereunder (including, to the extent applicable during the phased commencement of the DPDP Act, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), each as amended from time to time (hereinafter referred to as the “Policy”). This Policy applies to various platforms provided by Incuspaze including but not limited to the website (www.incuspaze.com) and the mobile application available on the Play Store (Android) and the Appstore (iOS) (hereinafter collectively referred to the “Platform(s)”). The terms which are not specifically defined under this Policy, but are used as capitalised terms and defined terms, shall have the same meaning ascribed to them under the "Terms of Use" of Incuspaze, available at [●] and are inserted by reference.
1.3 Please read this Policy carefully to understand how Incuspaze collects the personal information on our Platforms and through our Services, in email and other communication shared electronically sent through or in connection with our Services and uses personal information and under circumstances, Incuspaze shares the information collected from you (hereinafter referred to as “You” or the “User”) with any third party.
1.4 This Policy describes:
• the type of information that Incuspaze may collect from you when you access or use the Platform, including but not limited to the personal information shared by you;
• the practices and policies adopted by Incuspaze in relation to your personal information;
• purposes of and our practices for collecting, using, maintaining, protecting and disclosing the information followed by Incuspaze; and
• security practices and procedures for protecting privacy of your personal information.
1.5 By using or accessing the Platform, you are agreeing with and consenting to the practices described in this Policy. You also expressly consent to our use and disclosure of your Information (as defined below) in any manner as described in this Privacy Policy. If you do not agree with this Policy or the terms contained herein, you should immediately cease accessing our Platforms. By accessing our Platform and/or using our Services, you evince your acceptance to this Policy.
1.6 This Policy applies only to the Personal Information (defined herein below) collected by Incuspaze during your use of the Website, through e-mail and through other electronic communications sent through the Website. This Policy does not apply to the information that you provide to, or that is collected by, any third party, such as social media networks, property consultants, job portals, etc. Incuspaze encourages you to consult directly with such third parties regarding their privacy practices. Your Personal Information shall be processed and stored subject to your explicit consent, which shall be obtained at the time, when Incuspaze collects your Personal Information.
1.7 By accessing or using the Website, you agree to this Policy and you consent to the collection, use, retention and disclosure of your Personal Information by Incuspaze in accordance with this Policy.
1.8 In the event that you do not provide the Personal Information required by Incuspaze, Incuspaze may not be able to provide the complete use or access to the Website or the Services provided thereto.
1.9 This Policy is also applicable to you irrespective of (i) if you access the Platform outside India; (ii) if you are a national of European Union/ European Economic Area. The rights and obligation of the users residing in the European Union shall be governed in accordance with the European Union's General Data Protection Regulation (EU GDPR) and users residing in countries falling outside European Union shall accrue rights and obligations as have been provided by the law of their country of their residence.
2. definitions
2.1 “Account” refers to the password-protected authorised account you use to access and use the Platform and the Services.
2.2 “Information” means any information or set of information provided to Incuspaze by you or directly collected by us from the Platform.
2.3 “Non-personal Identification Information” refers to any non-personal information collected from you pursuant to your access/use of the Platform, including but not limited to the browser name, the type of computer, and technical information about your means of connection to the Platform such as the operating system, the internet service providers utilized and other similar information.
2.4 “Personal Information” means the information, including but not limited to your name, email address, mobile number, designation, department, the name of your employer that can be associated with a specific person and could be used to identify that specific person whether from the data, or from the data and other information that Incuspaze has, or is likely to have access to. Incuspaze collects Personal Information about you in order to understand your requirement for the Services, address your enquiries regarding the Services and customer support. The Services and customer support rendered by Incuspaze are provided through any Platform interchangeably including but not limited to the Website, e-mail and Mobile. For avoidance of any doubt, it is clarified that Personal Information does not include any information that has been anonymized or aggregated in such a manner that it can no longer be used to identify a specific person, whether in combination with other information or otherwise, and is therefore, not covered under this Privacy Policy. However, when such anonymized or aggregated non-personal information, is in conjunction or is linked with existing Personal Information, then in this form it will be treated as Personal Information. As such, this Policy will list both types of information for the sake of transparency. Notwithstanding the foregoing, no information which is freely available and accessible in the public domain or is furnished to any authority, organization, department or public at large through no act or default by Incuspaze under any law for the time being in force shall be considered as Personal Information or “Sensitive Personal Information”, as the case may be.
2.5 “Third Party” refers to any person or entity other than you or us.
3. what information does incuspaze collect?
3.1 Incuspaze respects your privacy and are committed to protecting it in all respects from any unlawful disclosure. In order to enrich and facilitate your access and use of the Platform, Incuspaze collects the following information from and about you including:
• Information about your internet connection, the equipment you use to access the Website and your usage details; and
• Your Personal Information.
If you have any queries or concerns regarding this Policy, you may contact us at dpo@incuspaze.com.
4. how incuspaze collects information
4.1 Incuspaze collects information from you in the following manner:
• Directly from you or your employer when you/they provide it to Incuspaze; and/or
• Automatically, as you navigate through the Platform or use our Service (information collected automatically may include usage details, IP addresses and information collected through cookies, web beacons and other tracking technologies).
• Through our various automatic data collection processes that collect public information about users/ potential users from the internet.
4.2 Information that you provide to Incuspaze directly: The type of Information we collect from you depends upon your use of the Platform and/or the Service. Generally speaking, however, the Information which we may collect can be divided into the following broad categories:
Personal Identification Information
• Information you provide to us: The information we collect on or through our Platform may include:• Your account information: Your full name, email address, and other information you may provide while registering your account whether directly or through your employer or when prompted through the Platform, such as your mobile phone number.• For Service Enquiries: In case you make an enquiry in respect of the Services rendered by Incuspaze, Incuspaze collects the following personal information: your full name, email address, mobile number, name of your employer and other personal information.
• For avoidance of any doubt, it is clarified that Incuspaze does not request or require Sensitive Personal Information regarding religion, health, sexual orientation or political affiliation.
4.3 Information that Incuspaze collects through Data Collection Technologies: Incuspaze may automatically collect certain information about the computer or devices (including mobile devices) you use to access the Platform, and about your use of the Platform, even if you use the Platform without registering or logging in.
• Usage Information: Details of your use of the Platform, including traffic data, location data, logs and other communication data and the resources that you access on or through the Platform.• Computer Device Information: Information about your computer, internet connection and mobile devices, including your IP address, operating systems, platforms, browser type, other browsing information (connection, speed, connection type, etc.), device type, device's unique identifier, mobile network information and device's telephone number.• Mobile device IDs: Unique mobile device identifier (e.g. IDFA or other device IDs on Apple devices like the iPhone or iPad), if you are using the Platform on a mobile device. Incuspaze may use mobile device IDs (the unique identifier assigned to a device by the manufacturer), instead of cookies to recognize you. Incuspaze may do this to store your preferences and track your use of the Platform. Unlike cookies, mobile device IDs cannot be deleted. Advertising companies may use device IDs to track your use of the Platform, track the number of advertisements displayed, and measure advertising performance and display advertisements that are more relevant to you. Analytics companies may use mobile device IDs to track your usage of our Website.• Your preferences: Your preferences and settings such as time zone and language.• Your activity on the Platform: Information about your activity on the Platform, such as your search queries, comments, domain names, search results selected, number of clicks, pages viewed and the order of those pages, how long you visited the Platform, the date and time you used the Platform, error logs, and other similar information.• Your searches and other activities: The search terms you have looked up and results that you selected.• Your browsing information: How long you used the Platform and which features you used.• Last URL visited: Incuspaze may collect information relating to the URL of the last web page you visited before visiting our website.• Your activity on the Services: We may collect information about your activity on the Platform, such as your search queries, comments, domain names, search results selected, number of clicks, pages viewed and the order of those pages, how long you visited our Platforms, the date and time you used the Services, error logs, and other similar information.
5. cookies
5.1 As a general rule, Incuspaze uses cookies, pixel tags, web beacons, mobile device IDs, "flash cookies" and similar files or technologies to collect and store information in respect to your use of the Platform.
5.2 A cookie is a small text file that is stored on your computer that enables us to recognize you (for example, as a registered user) when you visit our website, store your preferences and settings, enhance your experience by delivering content and advertising specific to your interests, perform research and analytics, track your use of the Platform, and assist with security and administrative functions. Cookies may be persistent or stored only during an individual session.
5.3 A pixel tag (also called a web beacon or clear GIF) is a tiny graphic with a unique identifier, embedded invisibly on a webpage (or an online ad or email), and is used to count or track things like activity on a webpage or ad impressions or clicks, as well as to access cookies stored on users' computers. Incuspaze uses pixel tags to measure the popularity of our various pages, features and services. Incuspaze may also include web beacons in e-mail messages or newsletters to determine whether the message has been opened and for other analytics.
5.4 Flash cookies operate differently than browser cookies and cannot be removed or blocked via web browser settings.
5.5 A cookie is not used to gather your Personal Information without your knowledge but instead to record information on site browsing which can be read directly by Incuspaze on your subsequent visits and searches on the Platform. All cookies have expiration dates in them that determine how long they stay in your browser.
5.6 Your activity on the Website: Information about your activity on the Website, such as your search queries, domain names, search results, number of clicks, pages viewed and the order of those pages, how long you visited the Platform, the date and time you used the Platform, error logs, and other similar information. Most browsers are set to automatically allow cookies. Please note that it may be possible to disable some (but not all) cookies through your device or browser settings, but doing so may interfere with certain functionality on the Platform. Major browsers provide users with various options when it comes to cookies. Users can usually set their browsers to block all third-party cookies (which are those set by third-party companies collecting information on websites operated by other companies), block all cookies (including first-party cookies such as the ones Incuspaze uses to collect search activity information about its users), or block specific cookies. You will need to opt out on each browser and each device you use to access the Platform. By using the Platform with your browser set to accept cookies, you are consenting to our use of cookies in the manner described in this section.
5.7 Third parties whose products or services are accessible or advertised through the Platform, including social media services, may also use cookies or similar tools, and we advise you to check their privacy policies for information about their cookies and other practices. We do not control the practices of such partners and their privacy policies govern their interactions with you.
5.8 By default, cookies are not installed automatically (with the exception of those cookies needed to run the Platform, and you are informed of their installation by a notification). Incuspaze will require your authorization before implanting any other kind of cookies on your hard drive. To avoid being bothered by these routine requests for authorization and to enjoy uninterrupted browsing, you can configure your computer to accept our cookies automatically.
6. anonymous data
6.1 Information is used for service enquiries, customer support, demonstrations, communications, legal compliance, audits, newsletters, promotions and any other purpose with your consent.
7. how incuspaze stores, processes and share information
7.1 Incuspaze collects the above Information from you only to provide better and efficient services through the Platform. The Information furnished by you enables Incuspaze to improve the Platform and provide you the most User-friendly experience while you transact with Incuspaze for getting newly developed and/or customized written content as per your specifications and requirements. The Services and the Platform depend on the information sought and Incuspaze may use the above said information to maintain, protect, and improve the Services (including advertising services). However, the Platform shall retain the data uploaded by you on the Platform for record keeping purposes.
7.2 The Information so collected varies from individual to individual and hence, may be stored with different data controllers and processors associated with Incuspaze, depending upon the processing requirement.
7.3 Incuspaze takes appropriate security measures to protect against any unauthorized access, alteration, modification, disclosure or destruction of data uploaded and stored by you. These safeguards take into account the sensitivity of the Data that we collect, process, and store and the current state of technology. Technological safeguards that we implement to secure your Data include firewall protection and end-to-end encryption of your Data, all the server connections made through the Platform are HTTPS secured. At an organizational level, we only allow specific personnel of Incuspaze, who are pre-authorised, to access your Information only on a need-to-know basis. Incuspaze has implemented appropriate physical, electronic, and managerial procedures to safeguard and help prevent unauthorized access to your information and to maintain data security. These safeguards take into account the sensitivity of the information that Incuspaze collects, processes and stores and the current state of technology. Incuspaze follows generally accepted industry standards to protect the personal information submitted to Incuspaze, both during transmission and once we receive it.
7.4 All information gathered on the Website is securely stored on behalf of Incuspaze on third-party infrastructure provider Amazon Web Services. The database is stored in an encrypted form and processed on the servers provided by Amazon Web Services; with the access to the servers being password-protected and strictly limited. You can find more information about “Amazon Web Services” security practices at https://aws.amazon.com/security/. However, as effective as the security measures maintained by Incuspaze are, no security system is impenetrable. Incuspaze cannot guarantee the security of Incuspaze's database, nor can Incuspaze guarantee that the information supplied to Incuspaze by you will not be intercepted while being transmitted to Incuspaze over the Internet. The Internet is an ever evolving medium. Incuspaze may change this Policy from time to time to incorporate necessary future changes. Incuspaze's use of any information that Incuspaze gathers will always be consistent with the policy under which the information was collected, regardless of what the new policy may be.
7.5 Incuspaze assumes no liability or responsibility for disclosure of your information due to errors in transmission, unauthorized third-party access, or other causes beyond our control. You play an important role in keeping your personal information secure. You should not share your username, password, or other security information for your account with anyone. If Incuspaze receives instructions using your username and password, Incuspaze will consider that you have authorized the instructions. Further, notwithstanding anything contained in this Policy or elsewhere, we shall not be held responsible for any loss, damage, or misuse of your Information, if such loss, damage, or misuse is attributable to any event that is beyond our reasonable control or is directly attributable to you.
7.6 Incuspaze hereby explicitly informs you that any information uploaded, shared or put on the Website by you shall be viewable and accessible for record-keeping, analysis and verification by the third party authorized by us for the purpose of providing the Services including the use of the Platform. Incuspaze takes all reasonable measures to protect any and all information collected by Incuspaze and the same is shared with third party sub-contractors only for the purposes of completing the contractual transaction between Incuspaze and you.
8. how incuspaze uses the information
We undertake to use and process your Information with integrity, accountability, fairness and transparency. We also undertake to use our best efforts to protect the Information from unlawful processing. We use the information we collect from and about you for a variety of purposes, including:
• contacting you to understand your requirements for the Services, including sharing prospective terms for the Services;
•organizing physical demonstration of the Services offered;
• sharing notifications in relation to the Services;
• processing and responding to your queries;
• providing you with customer support;
• understanding your usage (how you use the Platform, what features you like, etc.), improving the content and features of the Services;
• diagnosing technical problems;
• sending you communications that you have requested or that may be of interest to you by way of emails, courier, registered post, telephone calls, or any other mode of communication;
• sending you questions/messages from other users that you may/shall be able to answer/respond to if you have registered with us;
•generating and reviewing reports and data about, and conducting research on, the user base and Service usage patterns;
• carrying out our obligations and enforcing our rights arising from any contracts entered into between you and us, including for billing and collection;
• assisting you in password retrieval and policy changes;
• preserving history as governed by existing law or policy;
• sending information including confirmations, technical notices, updates, security alerts and support and administrative messages;
• communicating about promotions, upcoming events, and other news about products and services offered by us;
• meeting any applicable law, regulation and legal process;
• responding to law enforcement authority or other governmental official requests;
• detecting, preventing, or otherwise addressing fraud, security or technical issues;
• protecting against harm to our rights, property or safety, our users or the public as required or permitted by law;
• disclosures required for our audit or to investigate a complaint or security threat;
• sending newsletters;
• notifying you about changes to the Platform or Services;
• any other way we may describe when you provide the information; and
• any other purpose with your consent.
The primary basis for use and processing for the purposes mentioned above is to perform the contract with you related to these activities and services or for the administration of our business and the provision of Services. We may also use your Information to contact you about our own Services. We will hold your Information for no longer than necessary. The period for the retention of this data will depend on any legal obligations we have (such as tax obligations), the nature of any contracts we have in place with you, and the existence of your consent.
9. how incuspaze shares the information
9.1 General Disclosures. Incuspaze may disclose the information that Incuspaze collects or you provide, as described in this Policy, in the following ways:
• To Incuspaze's subsidiaries and affiliates.
• To Incuspaze's contractors, service providers and other third-parties whom Incuspaze uses/engages to support Incuspaze's business and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which Incuspaze discloses it to them.
• To third parties to market their products or services to you if you have consented to receive the promotional updates. We contractually require these third parties to keep personal information confidential and use it only for the purposes for which we disclose it to them.
• To fulfil the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• We may share your Personal Information with third party vendors that we use/engage for a variety of purposes, such as for cloud infrastructure, to send you emails and push notifications to your mobile device on our behalf, help us analyse the use of our Services, and process and collect payments. Some of our products, services, and databases are hosted by third-party hosting service providers.
9.2 Legal Purposes. Incuspaze may share your information when Incuspaze believes in good faith that such sharing is reasonably necessary in order to investigate, prevent, or take action regarding possible illegal activities or to comply with legal process. Incuspaze may also share your information to investigate and address threats or potential threats to the physical safety of any person, to investigate and address violations of this Policy, or to investigate and address violations of the rights of third parties and/or to protect the rights, property and safety of Incuspaze, its employees, users, or the public. This may involve the sharing of your information with law enforcement, government agencies, courts, and/or other organizations on account of legal requests such as subpoenas, court orders or government demands to comply with the law, where Incuspaze believes disclosure is necessary or appropriate to protect the rights, property, or safety of Incuspaze. This includes exchanging information with other companies and organizations for the purposes of fraud protection.9.3 Contractual Rights. Incuspaze may be required to disclose your Personal Information to enforce or apply our terms and conditions and other agreements.9.4 Consent. Incuspaze may share your Personal Information in any other manner as may have been consented to by you.
10. communicating choices
10.1 When you sign up for an account on the Platforms, you opt in to receive emails, notifications, and SMSs from Incuspaze. These messages, emails, or notifications are necessary for the administration of the Platform and for your use of the Services, and therefore you cannot opt out of receiving certain administrative notices, service notices, or legal notices from us.
11. reviewing, changing, or deleting information
11.1 If you would like to review or change your user name or other basic Personal Information, as may have been provided for creating an account, you can do so by logging in to your profile or by contacting us.
12. accessing & correcting your personal information
12.1 We will take reasonable steps to accurately record the Information that you provide to us and any subsequent updates.
12.2 We encourage you to review, update and correct the Information that is maintained by Incuspaze about you, and you may request that Incuspaze deletes your Information that is inaccurate, incomplete, or irrelevant for the purposes it is being collected or is being processed in a way that infringes any applicable legal requirement.
12.3 Subject to applicable law, your right to review, update, correct, and delete your Personal Information may be limited:
• if your requests are abusive or unreasonably excessive;
• where the rights or safety of another person or persons would be encroached upon; or
• if the information requested relates to any pending or threatened legal proceedings between you and Incuspaze, or providing access to you would prejudice negotiations between Incuspaze or an investigation of possible unlawful activity.
Your right to review, update, correct, and delete your information is subject to Incuspaze's records retention policies and applicable law, including any statutory retention requirements.
13. compliance with data protection regulations
13.1 The information we obtain from or about you may be processed and stored in India and our other various servers located across the globe, which may provide for different data protection rules than the country in which you reside. We comply with generally accepted industry standard regulations regarding the collection, use, and retention of data. Each location may provide for different data protection rules than the country in which you reside. By using the Services, you consent to the collection, transfer, use, storage and disclosure of your information as described in this Policy, including the transfer of your information outside of your country of residence. If you have any questions relating to your Information, please write to us at dpo@incuspaze.com.
13.2 Rights under the Digital Personal Data Protection Act, 2023
• Right to Access Information: You have the right to obtain a summary of your Personal Information being processed by Incuspaze, and the processing activities undertaken in respect thereof, in accordance with Section 11 of the DPDP Act.
• Right to Correction and Erasure: You have the right to seek correction, completion and updation of your Personal Information, and to seek erasure of your Personal Information that is no longer necessary for the purpose for which it was collected, in accordance with Section 12 of the DPDP Act. You can exercise this right by writing to the Designated Email Id.
• Right to Grievance Redressal: You have the right to have readily available means to register a grievance with Incuspaze in respect of the processing of your Personal Information, as set out in the clause titled "To Contact Incuspaze's Privacy Officer" below, in accordance with Section 13 of the DPDP Act.
• Right to Nominate: You have the right to nominate another individual to exercise your rights under the DPDP Act on your behalf, in the event of your death or incapacity, in accordance with Section 14 of the DPDP Act.
• Withdrawal of Consent: You may withdraw your consent to the processing of your Personal Information at any time, with the ease of withdrawal being comparable to the ease with which such consent was given, without prejudice to the lawfulness of processing carried out prior to such withdrawal, in accordance with Section 6(4) of the DPDP Act.
• Data Breach Notification: In the event of a personal data breach, Incuspaze shall notify the Data Protection Board of India and the affected Data Principals in the manner and within the timelines prescribed under Section 8(6) of the DPDP Act and the rules made thereunder.
• Grievance with the Data Protection Board: If you are not satisfied with the manner in which Incuspaze has addressed your grievance, you may register a complaint with the Data Protection Board of India, provided you have first availed of the grievance redressal mechanism set out in this Policy.
13.3 Rights under EU GDPR. The European Union General Data Protection Regulation (EU GDPR) has provided the below rights to EU residents. You may exercise these rights as and when Incuspaze obtains or holds Personal Information about you, to access Personal Information Incuspaze holds about you, and to obtain its correction, update, amendment or deletion in appropriate circumstances. Some of these rights may be subject to exceptions or limitations:
• Right to access or rectify your information: You have the right to request Incuspaze to access, rectify or delete your information stored with Incuspaze. You can ask Incuspaze to verify whether Incuspaze is processing personal information about you, and to rectify its records if you believe they contain incorrect or incomplete information about you. This right can be requested at dpo@incuspaze.com (the "Designated Email Id").
• Right to restrict processing: You have the right to restrict processing of your personal information where you prefer to restrict its use rather than having it erased; believe Incuspaze no longer needs the Personal Information for processing but you may require it for the establishment, exercise or defence of legal claims; or have objected to processing, pending verification of that objection. Incuspaze will duly inform you before revoking any restriction on processing. This right can be requested at the Designated Email Id.
• Right to object to processing: You have the right to object to processing on grounds pertaining to your particular situation, except where the processing is necessary for the performance of a task carried out in the public interest or the exercise of official authority vested in Incuspaze, or for legitimate interests pursued by Incuspaze or a third party. If you object, Incuspaze will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims. You can object by sending your objections to the Designated Email Id.
• Right to object to processing for direct marketing purposes: You have the right to object to processing for direct marketing purposes, including profiling. If you object, Incuspaze will cease processing your Personal Information for this purpose. You can object by sending your objections to the Designated Email Id.
• Right to object for scientific, historical research or statistical purposes: You have the right to object to processing for scientific or historical research or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest. You can object by sending your objections to the Designated Email Id.
• Right to data portability: Where you have provided Personal Information to Incuspaze, you can ask Incuspaze to transmit that Personal Information (in a structured, commonly used, and machine-readable format) directly to another company, where technically feasible.
• Right to erasure: You have the right to erase/delete your Personal Information without undue delay where it is no longer necessary for the purpose for which it was collected; you withdraw consent; you object to the processing under certain data protection rules; the processing is for direct marketing purposes and the data has been unlawfully processed; or erasure is required for compliance with a legal obligation, for exercising the right of freedom of expression and information, or for the establishment, exercise or defence of legal claims. Certain exclusions apply. You may direct deletion of your information by requesting at the Designated Email Id.
• Right to withdraw consent: Your participation and all survey invitations are always voluntary, and you can withdraw consent at any time. Withdrawal will not affect the lawfulness of any processing carried out before you withdraw your consent. You can withdraw your consent by sending your request to the Designated Email Id or selecting the opt-out link given in each email invitation.
• Retaining and deleting your personal information: Incuspaze does not delete your Personal Information at its own discretion. You are responsible for and control the time periods for which you wish to retain this information. You can delete your Personal Information by sending your request to the Designated Email Id. Incuspaze may nonetheless retain your information for compliance with a legal obligation, or in order to protect your vital interests or the vital interests of another natural person.
14. termination of account
14.1 You can close/terminate your account by visiting your profile settings page on the Platform. Incuspaze may retain information about you for the purposes authorized under this Policy unless prohibited by law. Thereafter, Incuspaze will either delete your Personal Information or de-identify it so that it is anonymous and not attributed to your identity. For example, Incuspaze may retain information to prevent, investigate, or identify possible wrongdoing in connection with the Platform or to comply with legal obligations.
15. to contact incuspaze's privacy offer
15.1 If you have an enquiry or a complaint about the way Incuspaze handles your Personal Information, or seek to exercise your privacy rights in relation to the Personal Information that Incuspaze holds about you, you may contact Incuspaze's Privacy Officer as follows:
Name: Rahul Chawla
By Email: dpo@incuspaze.com
By Mail:
Ground Floor, Plot No. 13,
Udyog Vihar Phase IV, Sector 18,
Gurugram – 122015, Haryana
15.2 While Incuspaze endeavours to resolve complaints quickly and informally, if you wish to proceed to a formal privacy complaint, Incuspaze requests that you make your complaint in writing to our Privacy Officer, by mail or email as above. Incuspaze will acknowledge your formal complaint within 10 working days of receipt.16. amendments
Incuspaze reserves the right to amend this Policy from time to time to reflect changes in the law, data collection and use practices followed by Incuspaze, the features of the services rendered by Incuspaze, or advances in technology. Use of information collected by Incuspaze is subject to this Policy in effect at the time such information is used. If Incuspaze makes any material changes to this Policy, Incuspaze will notify the changes to you. Please refer to the latest updated date mentioned at the beginning of this Policy. Please review the changes carefully. Your continued access or use of the Platform and/or use of the Services rendered by Incuspaze following the publication of the changes to this Privacy Policy will constitute your consent and acceptance of those changes.
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Terms of Use (or other similarly titled written or electronic agreement addressing the same subject matter) (“Agreement”) between the Client (as defined in the Agreement) and Incuspaze Solutions Private Limited, under which the Processor provides the Subject with the services (the “Services”). The Subject and the Processor are individually referred to as a “Party” and collectively as the “Parties”.
The Parties seek to implement this DPA to comply with the requirements of EU GDPR (defined hereunder) in relation to the Processor's processing of Personal Data (as defined under the EU GDPR) as part of its obligations under the Agreement.
For the avoidance of doubt, applicable Indian data protection laws include the Digital Personal Data Protection Act, 2023 (“DPDP Act”), together with all rules, notifications, directions, and amendments issued thereunder from time to time.
This DPA shall apply to the Processor's processing of Personal Data, provided by the Data Subject as part of the Processor's obligations under the Agreement. Except as modified below, the terms of the Agreement shall remain in full force and effect.1. definitions
Terms not otherwise defined herein shall have the meaning given to them in the EU GDPR or the Agreement. The following terms shall have the corresponding meanings assigned to them below:
• 1.1 "Data Transfer" means a transfer of the Personal Data from the Data Subject to the Processor, or between two establishments of the Processor, or with a Sub-processor by the Processor.
• 1.2 "EU GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
• 1.3 "Standard Contractual Clauses" means the contractual clauses attached hereto as Schedule 1 pursuant to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 on Standard Contractual Clauses for the transfer of Personal Data to processors established in third countries which do not ensure an adequate level of data protection.
• 1.4 “Controller” means Incuspaze Solutions Private Limited.
• 1.5 “Processor” means Incuspaze Solutions Private Limited.
• 1.6 “Sub-processor” means a processor/sub-contractor appointed by the Processor for the provision of all or parts of the Services who Processes the Personal Data as provided by the Data Subject.
• 1.7 “Customer Data” means any information, data or materials received by the Processor from the Data Subject and its end users in connection with the use of the Services.2. purpose of this agreement
This DPA sets out various obligations of the Processor in relation to the Processing of Personal Data and shall be limited to the Processor's obligations under the Agreement. If there is a conflict between the provisions of the Agreement and this DPA, the provisions of this DPA shall prevail.
3. categories of personal data and data subjects
“Data Subjects” and other end users include the Data Subject's employees, contractors, collaborators, customers, prospects, suppliers, and subcontractors. Data Subjects also include individuals attempting to communicate with or transfer Personal Data to the Data Subject's end users.
4. types of personal data
Contact Information, the extent of which is determined and controlled by the Data Subject in its sole discretion, and other Personal Data such as navigational data (including website usage information), email data, system usage data, application integration data, and other electronic data submitted, stored, sent, or received by end users via the Platform. The Data Subject confirms that it will not be providing sensitive or special categories of Personal Data to the Processor.
5. subject-matter and nature of the processing
The subject-matter of Processing of Personal Data is the provision of the Services by the Processor to the Data Subject that involves the Processing of Personal Data. Personal Data will be subject to those Processing activities as may be specified in the Agreement.
6. purpose of processing
Personal Data will be Processed for purposes of providing the Services set out and otherwise agreed to in the Agreement.
7. duration of the processing
Personal Data will be Processed for the duration of the Agreement, subject to Clause 10 of this DPA.8. data storage location
The Processor confirms that all Customer Data is stored within the AWS Asia Pacific (Mumbai) Region (ap-south-1), India region, with:
• Primary and secondary servers located in the AWS Asia Pacific (Mumbai) Region (ap-south-1), India.
• Backup servers located in the AWS Asia Pacific (Mumbai) Region (ap-south-1), India, to ensure redundancy and disaster recovery.
The Processor maintains strict data storage and access control policies to ensure data integrity and security within these regions. In case of any changes to the data storage location, the Processor shall notify the Customer at least 15 days in advance and seek written approval to ensure continued compliance with applicable data protection regulations, including EU GDPR.
9. customer responsibility
9.1 Within the scope of the Agreement and in its use of the Services, the Data Subject shall be solely responsible for complying with the statutory requirements relating to data protection and privacy regarding the disclosure and transfer of Personal Data to the Processor and the Processing of Personal Data. For the avoidance of doubt, the Data Subject's instructions for the Processing of Personal Data shall comply with all applicable laws and regulations, including the EU Data Protection Laws. Instructions shall initially be specified in the Agreement and in this DPA and may, from time to time thereafter, be amended, amplified, or replaced by the Data Subject in separate written instructions (individual instructions).
9.2 The Data Subject shall inform the Processor without undue delay and comprehensively about any errors, corrections or irregularities related to the Personal Data and statutory provisions on the Processing of Personal Data.
10. obligations of processor
10.1 Compliance with Instructions. The Processor shall process and use the Personal Data only within the scope of the Data Subject's Instructions. If the Processor believes that an Instruction of the Data Subject infringes the EU Data Protection Laws, it shall immediately inform the Data Subject without delay. If the Processor cannot process Personal Data in accordance with the Instructions due to a legal requirement under the EU Data Protection Laws, the Processor will (i) promptly notify the Data Subject of that legal requirement before the relevant Processing, to the extent permitted by the EU Data Protection Laws; and (ii) cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until the Data Subject issues new Instructions with which the Processor is able to comply. If this provision is invoked, the Processor will not be liable to the Data Subject under the Agreement for any failure to perform the Services until the Data Subject issues new Instructions regarding the Processing.
10.2 Security. The Processor shall take appropriate technical and organizational measures to adequately protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, as described under Appendix 2 to the Standard Contractual Clauses. Such measures include, but are not limited to:
• the prevention of unauthorized persons from gaining access to Personal Data Processing systems (physical access control);
• the prevention of Personal Data Processing systems from being used without authorization (logical access control);
• ensuring that persons entitled to use a Personal Data Processing system gain access only to such Personal Data as they are entitled to access, and for the time period required in accordance with their access rights, and that Personal Data cannot be read, copied, modified, or deleted without authorization while Processing, in use, or after storage (data access control);
• ensuring that Personal Data cannot be read, copied, modified, or deleted without authorization during electronic transmission, transport, or storage on storage media, and that the target entities for any transfer of Personal Data can be established and verified (data transfer control);
• ensuring the establishment of an audit trail to document whether and by whom Personal Data has been entered, modified, or removed from Personal Data Processing systems (entry control);
• ensuring that Personal Data is Processed solely in accordance with the Instructions (control of instructions); and
• ensuring that Personal Data is protected against accidental destruction or loss (availability control).
The Processor will also facilitate the Data Subject's compliance with its obligation to implement security measures with respect to Personal Data under the EU Data Protection Laws.
10.3 The Processor shall ensure that any personnel whom the Processor authorizes to process Personal Data on its behalf are subject to confidentiality obligations with respect to that Personal Data. The undertaking of confidentiality shall continue after the termination of the Processing activities.
10.4 Personal Data Breaches. The Processor will notify the Data Subject as soon as practicable after it becomes aware of any Personal Data Breach affecting any Personal Data. At the Data Subject's request, the Processor will promptly provide the Data Subject with all reasonable assistance necessary to enable the Data Subject to notify relevant Personal Data Breaches to competent authorities and/or affected Data Subjects, if the Data Subject is required to do so under the Data Protection Law. The Processor shall also take necessary actions to mitigate the effects of Personal Data Breaches and prevent the recurrence of such breaches.
10.5 Data Subject Requests. The Processor will provide reasonable assistance, including by appropriate technical and organizational measures and considering the nature of the Processing, to enable the Data Subject to respond to any request from Data Subjects seeking to exercise their rights under the EU Data Protection Laws with respect to Personal Data (including access, rectification, restriction, deletion, or portability of Personal Data, as applicable), to the extent permitted by law. If such a request is made directly to the Processor, the Processor will promptly inform the Data Subject and will advise the requester to submit their request to the Data Subject, who shall be solely responsible for responding to it. The Data Subject shall reimburse the Processor for the costs arising from this assistance.
10.6 Sub-Processors.
• The Processor shall be entitled to engage sub-Processors to fulfil its obligations defined in the Agreement only with the Data Subject's written consent. The Data Subject consents to the engagement as sub-Processors of the Processor's affiliated companies and the third parties listed in Appendix 3, which constitutes prior written consent for purposes of Clause 11 of the Standard Contractual Clauses.
• If the Processor intends to instruct sub-Processors other than its affiliates or the companies listed in Appendix 3, the Processor will notify the Data Subject in writing (email to the address on record is sufficient) and will give the Data Subject the opportunity to object within 30 days after being notified, on reasonable grounds (e.g., significant risks for the protection of its Personal Data at the sub-Processor). If the objection cannot be resolved, either party may terminate the Agreement by written notice.
• Where the Processor engages sub-Processors, it will enter into a contract with the sub-Processor imposing the same obligations that apply to the Processor under this DPA. Where the sub-Processor fails to fulfil its data protection obligations, the Processor will remain liable to the Data Subject for the performance of such sub-Processor's obligations.
• Where a sub-Processor is engaged, the Data Subject must be granted the right to monitor and inspect the sub-Processor's activities in accordance with this DPA and the EU Data Protection Laws, including obtaining information from the Processor, upon written request, on the substance of the contract and implementation of data protection obligations, where necessary by inspecting the relevant contract documents.
• This Clause 10.6 applies if the Processor engages a sub-Processor in a country outside the European Economic Area (“EEA”) not recognized by the European Commission as providing an adequate level of protection, or to an entity not registered under the EU-US Privacy Shield framework. If Personal Data is transferred to such a sub-Processor, the Processor shall, in advance of the transfer, ensure requisite safeguards are in place.
10.7 Data Transfers. The Data Subject acknowledges and agrees that, in connection with the performance of the Services, Personal Data will be transferred to the Processor's servers outside the EEA. The Standard Contractual Clauses at Exhibit 1 will apply with respect to Personal Data transferred outside the EEA, either directly or via onward transfer, to any country not recognized by the European Commission as providing an adequate level of protection for personal data, or to an entity not registered under the EU-US Privacy Shield framework.
10.8 Deletion or Retrieval of Personal Data.
• Other than to the extent required to comply with EU Data Protection Laws or any other laws to which the Processor is subject, the Processor will delete all Personal Data (including copies thereof) processed pursuant to this DPA upon completion of a period of 30 (thirty) days following termination or expiry of the Agreement. If the Processor is unable to delete Personal Data for technical or other reasons, it will apply measures to ensure that the Personal Data is blocked from any further Processing.
• The Data Subject shall, upon termination or expiration of the Agreement and by way of issuing an Instruction, stipulate, within the aforesaid period of 30 (thirty) days, reasonable measures to return Personal Data or delete stored Personal Data. Any additional cost arising in connection with the return or deletion of Personal Data after termination or expiration of the Agreement shall be borne by the Data Subject.11. audits
11.1 The Data Subject may, prior to the commencement of Processing, and at regular intervals thereafter, audit the technical and organizational measures taken by the Processor. The cost associated with such audit, including the cost of professional services from any third party, will be borne entirely by the Data Subject.
11.2 For such purpose, the Data Subject may, e.g.:
• obtain information from the Processor;
• request the Processor to submit an existing attestation or certificate by an independent professional expert; or
• upon reasonable and timely advance agreement, during regular business hours and without interrupting the Processor's business operations, conduct an on-site inspection of the Processor's business operations, or have the same conducted by a qualified third party which shall not be a competitor of the Processor.
11.3 The Processor shall, upon the Data Subject's written request and within a reasonable period, provide the Data Subject with all information necessary for such audit, to the extent that such information is within the Processor's control and it is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party.
12. indemnification
12.1 The Data Subject shall defend, indemnify and hold the Processor harmless against any claims, losses, damage, liabilities, expenses and costs (including reasonable attorneys' fees), including against any claims by Data Subjects or actions by supervisory authorities under the EU Data Protection Laws, that the Processor may incur or be subject to in relation to the Processing of Personal Data (i) so long as the Processor is Processing the Personal Data as per the Instructions received; or (ii) where such claims, losses, damage, liabilities, expenses and costs have arisen due to the Data Subject's breach of the EU Data Protection Laws.
13. general provisions
13.1 The general provisions of the Agreement shall, insofar as they are not inconsistent herewith, apply to this DPA.
13.2 In case of any conflict between the terms of this DPA and the Agreement, the terms of this DPA shall take precedence insofar as the subject matter to which it relates. Where individual provisions of this DPA are invalid or unenforceable, the validity and enforceability of the other provisions of this DPA shall not be affected.
14. others
• The organization ensures that the contract to process PII addresses the organization's role in aiding with the customer's obligations.
• The Agreement considers and follows: Privacy by Design and default; achieving security of processing; notification of breaches involving PII to a supervisory authority; notification of breaches involving PII to customers and PII principals; conducting Privacy Impact Assessments; and assurance of assistance by the PII Processors if prior consultations with relevant PII protection authorities are needed.
• Incuspaze Solutions Private Limited shall inform the customer if, in its opinion, a processing instruction infringes applicable legislation or regulation.
• The organization does not use PII processed under a contract for the purposes of marketing and advertising.
• The organization coordinates with clients to help audit the systems.
• The organization provides the customer with appropriate information so that it can demonstrate compliance with its obligations.
• Incuspaze Solutions Private Limited shall use Amazon Web Services (AWS) and Zoho Corporation as sub-processors, with security and privacy requirements fulfilled.
• The organization shall comply with all statutory and regulatory requirements.
• Data shall be deleted or de-identified after processing is complete (i.e., after the selected retention period is complete).
• Incuspaze Solutions Private Limited shall inform clients 24 hours in advance in case of any legally binding requests for disclosure of PII.
• Requests for access, correction and/or erasure of PII by Data Subjects, and any concerns or complaints related to PII, can be made by contacting the Data Protection Officer (DPO): Name: Rahul Chawla; Email: dpo@incuspaze.com.
EXHIBIT 1 – Standard Contractual Clauses (Processors)
For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, the Client, as defined in the Incuspaze Terms of Service (the "data exporter"), and the data importing organisation (each a "party", together "the parties") have agreed on the following Contractual Clauses (the "Clauses") in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.1. definitions
For the purposes of the Clauses:
• 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
• 'the data exporter' means the controller who transfers the personal data;
• 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
• 'the sub-processor' means any processor engaged by the data importer or by any other sub-processor of the data importer who agrees to receive personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer, in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
• 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
• 'technical and organizational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
2. details of the transfer
2.1 Incuspaze Solutions Private Limited complies with Information Security Management as per ISO 27001:2013. Incuspaze Solutions Private Limited shall notify the Client in writing without undue delay if it can no longer comply with its obligations under the Privacy compliance, and, in such a case, will have the option of (i) promptly taking reasonable steps to remediate any non-compliance with applicable obligations under this DPA, or (ii) engaging in a good faith dialogue with the Client to determine a new data transfer mechanism to carry out the purposes of the Terms. Incuspaze Solutions Private Limited acts as a Processor with respect to Personal Data received pursuant to a data transfer.
2.2 In the event the Privacy Compliance is invalidated, the Client and each Client Affiliate (on behalf of the relevant Data Subject(s), as the case may be), if applicable (as "data exporter"), and Incuspaze Solutions Private Limited (as "data importer"), with effect from the commencement of the relevant transfer, shall enter into the Data Subject to Processor SCCs (mutatis mutandis, as the case may be) in respect of any transfer (or onward transfer) from the Client or Client Affiliate to Incuspaze Solutions Private Limited, where such transfer would otherwise be prohibited by applicable Data Protection Laws or by the terms of data transfer agreements put in place to address applicable Data Protection Laws.
2.3 The details of the transfer, and in particular the special categories of personal data where applicable, are specified in Appendix 1, which forms an integral part of the Clauses.
3. third-party beneficiary clause
3.1 The data subject can enforce against the data exporter this Clause, Clauses 4.2 to 4.9, 5.1 to 5.5, 5.7 to 5.10, 6.1 and 6.2, Clause 7, 8.2, and 9 to 12, as a third-party beneficiary.
3.2 The data subject can enforce against the data importer this Clause, Clauses 5.1 to 5.5 and 5.7, Clause 6, 7, 8.2, and 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, in which case the data subject can enforce them against such entity.
3.3 The data subject can enforce against the sub-processor this Clause, Clauses 5.1 to 5.5 and 5.7, Clause 6, 7, 8.2, and 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless a successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, in which case the data subject can enforce them against such entity. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.
3.4 The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.
4. obligations of the data exporter
The data exporter agrees and warrants:
• that the processing, including Appendix 1 itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
• that it has instructed, and throughout the duration of the personal data-processing services will instruct, the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;
• that the data importer will provide sufficient guarantees in respect of the technical and organizational security measures specified in Appendix 2 to this contract;
• that, after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and against all other unlawful forms of processing, and ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected;
• that it will ensure compliance with the security measures;
• that if the transfer involves special categories of data, the data subject has been or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
• to forward any notification received from the data importer or any sub-processor pursuant to Clause 5.2 and Clause 8.3 to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
• to make available to the data subjects upon request a copy of the Clauses, except for Appendix 2, and a summary description of the security measures, as well as a copy of any contract for sub-processing services, unless the Clauses or the contract contain commercial information, in which case such information may be removed;
• that in the event of sub-processing, the processing activity is carried out in accordance with Clause 11 by a sub-processor providing at least the same level of protection for the personal data and the rights of the data subject as the data importer under the Clauses; and
• that it will ensure compliance with Clauses 4.1 to 9.
5. obligations of the data importer
The data importer agrees and warrants:
• to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform the data exporter promptly, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
• that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract, and that in the event of a change in this legislation likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
• that it has implemented the technical and organizational security measures specified in Appendix 2 before processing the personal data transferred;
• that it will promptly notify the data exporter about: (i) any legally binding request for disclosure of the personal data by a law enforcement authority, unless otherwise prohibited; (ii) any accidental or unauthorized access; and (iii) any request received directly from the data subjects without responding to that request, unless otherwise authorized to do so;
• to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer, and to abide by the advice of the supervisory authority regarding the processing of the data transferred;
• at the request of the data exporter, to submit its data-processing facilities for an audit of the processing activities covered by the Clauses, carried out by the data exporter or an independent inspection body with the required professional qualifications, bound by a duty of confidentiality, selected by the data exporter, where applicable in agreement with the supervisory authority;
• to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information (which may be removed), except for Appendix 2, which shall be replaced by a summary description of the security measures where the data subject is unable to obtain a copy from the data exporter;
• that in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent;
• that the processing services by the sub-processor will be carried out in accordance with Clause 11; and
• to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.
6. liability
6.1 The parties agree that any data subject who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or Clause 11 by any party or sub-processor is entitled to receive compensation from the data exporter for the damage suffered.
6.2 If a data subject is not able to bring a claim for compensation in accordance with Clause 6.1 against the data exporter, arising out of a breach by the data importer or its sub-processor of any of their obligations referred to in Clause 3 or Clause 11, because the data exporter has factually disappeared, ceased to exist in law, or become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless a successor entity has assumed the entire legal obligations of the data exporter, in which case the data subject can enforce its rights against such entity. The data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.
6.3 If a data subject is not able to bring a claim against the data exporter or the data importer as referred to in Clauses 6.1 and 6.2, arising out of a breach by the sub-processor of any of its obligations referred to in Clause 3 or Clause 11, because both the data exporter and the data importer have factually disappeared, ceased to exist in law, or become insolvent, the sub-processor agrees that the data subject may issue a claim against the sub-processor with regard to its own processing operations under the Clauses as if it were the data exporter or data importer, unless a successor entity has assumed the entire legal obligations of the data exporter or data importer, in which case the data subject can enforce its rights against such entity. The liability of the sub-processor shall be limited to its own processing operations under the Clauses.
7. mediation and jurisdiction
7.1 The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject to refer the dispute to mediation by an independent person or, where applicable, by the supervisory authority; or to refer the dispute to the courts in the Member State in which the data exporter is established.
7.2 The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
8. cooperation with supervisory authorities
8.1 The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
8.2 The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any sub-processor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
8.3 The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any sub-processor preventing the conduct of an audit of the data importer, or any sub-processor, pursuant to Clause 8.2. In such a case, the data exporter shall be entitled to take the measures foreseen in Clause 5.2.
9. governing law
9.1 The Clauses shall be governed by the law of the Member State in which the data exporter is established.
10. variation of the contract
10.1 The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required, provided they do not contradict the Clauses.
11. subprocesssing
11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor imposing the same obligations on the sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement, the data importer shall remain fully liable to the data exporter for the performance of the sub-processor's obligations under such agreement.
11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in Clause 6.1 against the data exporter or the data importer because they have factually disappeared, ceased to exist in law, or become insolvent, and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.
11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in Clause 11.1 shall be governed by the law of the Member State in which the data exporter is established.
11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5.10, which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.
12. obligation after the termination of personal data-processing services
12.1 The parties agree that, on the termination of the provision of data-processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter, or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process it anymore.
12.2 The data importer and the sub-processor warrant that, upon request of the data exporter and/or of the supervisory authority, they will submit their data-processing facilities for an audit of the measures referred to in Clause 12.1.
appendix 1 to the standard contractual clauses
This Appendix forms part of the Clauses. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix 1.
• Data exporter: The data exporter is the Client, as defined in the Incuspaze Customer Terms of Service ("Agreement").
• Data importer: The data importer is Incuspaze Solutions Private Limited.
• Data subjects: Categories of data subjects set out under Section 2 of the Data Processing Addendum to which the Clauses are attached.
• Categories of data: Name, Email, Image, Phone, Related URL, User ID, Username, IP Address.
• Special categories of data (if appropriate): The parties do not anticipate the transfer of special categories of data.
• Processing operations: The purpose of the transfer is to facilitate the performance of the Services more fully described in the Agreement and accompanying order forms. The period for which the Personal Data will be retained is more fully described in the Agreement, Addendum, and accompanying order forms.
Appendix 2 to the Standard Contractual Clauses (Technical and Organizational Security Measures)
This Appendix forms part of the Clauses. It describes the technical and organizational security measures implemented by the data importer in accordance with Clause 5 of the Standard Contractual Clauses. Incuspaze currently observes the security practices described in this Appendix 2. Notwithstanding any provision to the contrary otherwise agreed to by the data exporter, Incuspaze may modify or update these practices at its discretion, provided that such modification does not result in a material degradation in the protection offered. All capitalized terms not otherwise defined herein shall have the meanings set forth in the Agreement.
(a) Access Control
• Preventing Unauthorized Product Access – Outsourced processing: Incuspaze hosts its Services with outsourced cloud infrastructure providers and maintains contractual relationships with vendors in order to provide the Services in accordance with its Data Processing Addendums, relying on contractual agreements, privacy policies, and vendor compliance programs to protect data processed or stored by these vendors.
• Physical and environmental security: Incuspaze hosts its product infrastructure with multi-tenant, outsourced infrastructure providers whose physical and environmental security controls are aligned with ISO 27001, among other standards.
• Authentication: Incuspaze implements a uniform password policy for its customer products. Customers who interact with the products via the user interface must authenticate before accessing non-public Client Data.
• Authorization: Client data is stored in multi-tenant storage systems accessible to the Client via only application user interfaces and application programming interfaces; clients are not allowed direct access to the underlying application infrastructure. The authorization model is designed to ensure that only appropriately assigned individuals can access relevant features, views, and customization options, validated against the attributes associated with each data set. Public product APIs may be accessed over SSL/TLS-based HTTPS using a security API key only.
• Preventing Unauthorized Product Use: Incuspaze implements industry standard access controls and detection capabilities for the internal networks that support its products.
• Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the product infrastructure, including Virtual Private Cloud (VPC) implementations, security group assignment, and traditional firewall rules, which differ between infrastructure providers.
• Intrusion detection and prevention: Access to Incuspaze is aligned with best practice guidelines documented by the Open Web Application Security Project (OWASP) in the OWASP Top 10 and similar recommendations. Protections from Distributed Denial of Service (DDoS) attacks are incorporated, and traffic at the application layer is actively monitored with the ability to alert or deny malicious behaviour based on behaviour type and rate.
• Static code analysis: Security reviews of code stored in Incuspaze's source code repositories are performed, checking for coding best practices and identifiable software flaws.
• Penetration testing: Incuspaze maintains relationships with industry recognized penetration testing service providers to identify and resolve foreseeable attack vectors and potential abuse scenarios.
• Limitations of Privilege and Authorization Requirements – Product access: A subset of Incuspaze's employees have access to the products and to customer data via controlled interfaces, to provide effective customer support, troubleshoot potential problems, and detect and respond to security incidents. Access is enabled through "just in time" requests for access; all such requests are logged.
• Background checks: All Incuspaze employees undergo a third-party background check prior to being extended an employment offer, in accordance with applicable laws, and are required to conduct themselves consistently with company guidelines, non-disclosure requirements, and ethical standards.
• Transmission Control – In-transit: Incuspaze makes HTTPS encryption (SSL/TLS) available on every login interface, using industry standard algorithms and certificates. All sensitive interactions with the Incuspaze products (e.g., API calls, login, authenticated sessions) are encrypted in transit with TLS 1.2. Certain information is encrypted or hashed at rest based on sensitivity (e.g., user passwords are hashed, contact/lead data is encrypted at rest); other information such as public web content, images and documents is not encrypted at rest.
• Input Control – Detection: Incuspaze's infrastructure logs extensive information about system behaviour, traffic received, system authentication, and other application requests. Internal systems aggregate log data and alert appropriate employees of malicious, unintended, or anomalous activities. Security, operations, and support personnel are responsive to known incidents.
• Response and tracking: Incuspaze maintains a security incident response and tracking mechanism. Suspected and confirmed security incidents are investigated by security, operations, or support personnel, and appropriate resolution steps are identified and documented. For confirmed incidents, Incuspaze takes appropriate steps to minimize product and customer damage or unauthorized disclosure.
• Communication: If Incuspaze becomes aware of unlawful access to customer data stored within its products, it will notify affected customers of the incident, provide a description of the steps being taken to resolve it, and provide status updates as it deems necessary, delivered via a form Incuspaze selects (which may include email or telephone).
• Availability Control: Incuspaze maintains business continuity and disaster recovery plans focused on preventing outages through redundancy of telecommunications, systems, and business operations, and on rapid recovery strategies. Identified issues are published on Incuspaze's status site and updated until resolved. Incuspaze relies on infrastructure redundancy, real-time replication and backups; all product services are built with full redundancy, and server infrastructure is strategically distributed across two distinct availability zones. Data is replicated and backed up in multiple durable data-stores, with retention periods depending on the nature of the data, and also replicated across data-centre availability zones for fault-tolerance, scalability, and responsive recovery. Additional data resilience policies include: (i) production data is backed up leveraging multiple online replicas, with all production databases having no less than one primary and one replica copy live at any given time, and ten days' worth of backups retained for easy restoration; (ii) because private cloud services are leveraged for hosting, backup, and recovery, Incuspaze does not implement physical infrastructure or physical storage media, nor generally produce or use other kinds of hard copy media as part of making its products available to customers; and (iii) by default, all backups are protected through access control restrictions on Incuspaze product infrastructure networks, access control lists on the file systems storing the backup files, and/or database security protections.
Appendix 3 to the Standard Contractual Clauses (List of Sub-Processors)
| S. No. | Name of Sub- Processor | Description of Processing | Primary Server Location | Backup Server Location |
|---|---|---|---|---|
| 1 | Amazon Web Services (AWS) | Cloud hosting, database and storage services. | India – AWS Mumbai Region (ap-south-1) | India – AWS Mumbai Region (ap-south-1) |
| 2 | Easebuzz | Payment processing and transaction services. | India | India |
| 3 | Zoho | CRM, ticketing and customer support services. | As per the configured Zoho data center | As per the configured Zoho data center |
| 4 | Microsoft | Email delivery and communication services. | As per applicable Microsoft service configuration | As per applicable Microsoft service configuration |
| 5 | SMS-Magic | SMS delivery, OTPs and alerts. | India | India |
| 6 | Firebase (Google) | Mobile push notification services. | India | As per applicable Google/Firebase service configuration |
Quick Links
Head office
Incuspaze campus 2, Plot No-13, Phase-4, Sector 18, Gurugram, Sarhol, Haryana 122015
Contact Us
Carefully Crafted by
Quick Links
Head office
Incuspaze campus 2, Plot No-13, Phase-4, Sector 18, Gurugram, Sarhol, Haryana 122015
Contact us
© 2026 All Records Incuspaze
Carefully Crafted by
