Last updated: 18 October 2026
These Data Processing Terms apply when an organisation uses AgentDesk to record personal data about its clients and other people. They describe how AgentDesk processes that data on the organisation’s behalf and form part of the Terms of Service.
1. Roles
- The Organisation that subscribes to AgentDesk decides why and how personal data about its clients, their families and others is processed. Under the Digital Personal Data Protection Act, 2023 it is the Data Fiduciary for that data.
- Everspan Solutions LLP (“AgentDesk”, “we”) processes that data only on the Organisation’s behalf. We are its Data Processor.
- Customer Personal Data means personal data contained in the Customer Data defined in the Terms of Service.
Personal data of the Organisation’s own account users and billing contacts, which we use to run the service, is covered by our Privacy Policy.
2. Details of the processing
| Purpose | Providing the AgentDesk service: storing, organising, displaying, reporting on, backing up and exporting the Organisation’s records, and the features it chooses to use (reminders, emails, lead capture, document storage, calendar sync). |
|---|---|
| Duration | For the term of the subscription and until deletion under section 9. |
| People concerned | The Organisation’s clients and prospective clients (leads), their family members, nominees, insured members and co-applicants, referrers, and the Organisation’s own users. |
| Types of data | Identity and contact details (name, date of birth, mobile number, email, address); identity and tax numbers (such as PAN and Aadhaar numbers) and KYC documents; occupation and income; bank details; insurance policies, nominees, premiums and claims, including health information where the Organisation records it for health policies or claims; mutual fund, fixed deposit and bond holdings; loan applications and documents; meetings, notes, calls and follow-ups; and documents the Organisation uploads. |
The Organisation decides which of these it records and should record only what it needs.
3. Our obligations
We will:
- process Customer Personal Data only to provide the service and on the Organisation’s documented instructions (these terms, the Terms of Service and the Organisation’s use of the service’s settings), unless the law requires otherwise, in which case we will tell the Organisation where the law allows;
- not sell Customer Personal Data or use it for our own purposes, including marketing or training products for other customers;
- ensure our staff and contractors who can access it are bound by confidentiality and access it only when needed, for example to provide support the Organisation asks for, to fix a fault or to keep the service secure;
- maintain the security measures in Annex A;
- help the Organisation respond to requests from the people concerned (to access, correct, update or erase their data), mainly through the service’s own search, edit, export and delete tools;
- give the Organisation reasonable information and help to meet its obligations under data protection law.
4. The Organisation’s obligations
The Organisation will:
- have a lawful basis for the Customer Personal Data it records, give the people concerned any notice required and obtain any consent required, including a parent’s or guardian’s consent for children where the law requires it;
- keep the data accurate and up to date, and record only what it needs;
- handle Aadhaar numbers and copies only as the law allows (for example by masking numbers that it does not need in full);
- set user roles and permissions appropriately, remove access for people who leave, and protect its sign-ins;
- keep control of the Google Drive account it connects for documents and backups;
- answer requests from the people concerned, with our help where needed.
5. Sub-processors
The Organisation agrees that we may use the following sub-processors to provide the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hostinger | Hosting the application, database and background jobs | India (Mumbai) |
| Google LLC (Firebase Authentication) | Sending and checking SMS verification codes for users’ mobile numbers | Global |
| ZeptoMail (Zoho) | Sending emails the Organisation sets up (for example to leads), reminders and service emails | India |
| Postmark or Mailgun | Receiving email replies to support tickets | United States / European Union |
Some features connect to accounts the Organisation or its users hold directly with other providers, under their own terms: Google Drive (documents and daily backups), Google Calendar (Planner sync), Meta (Facebook and Instagram Lead Ads) and the Organisation’s own website forms. Those providers act for the Organisation, not as our sub-processors. Public data such as mutual fund NAVs is fetched from public sources without sending Customer Personal Data.
We will tell the Organisation by email or in the app before adding or replacing a sub-processor. If the Organisation reasonably objects on data protection grounds and we cannot address the objection, it may end the affected subscription and receive a refund of prepaid fees for the unused period. We remain responsible for our sub-processors’ performance of these obligations.
6. Transfers outside India
Customer Personal Data is stored on servers in India (Mumbai). Where a sub-processor processes it outside India, we will do so only in compliance with Indian law, including any restrictions the Government of India places on transfers to particular countries.
7. Personal data breaches
If we become aware of a breach of security affecting Customer Personal Data, we will notify the Organisation without undue delay, with the information we have about what happened, the data and people likely to be affected, and the steps taken. We will give further information as it becomes available, take reasonable steps to contain and remedy the breach, and help the Organisation notify the Data Protection Board of India and the people affected where it is required to.
8. Information and audits
On reasonable written request, and not more than once a year unless a breach or a regulator requires it, we will provide information reasonably needed to show compliance with these terms, such as a description of our security measures and answers to a security questionnaire. Any further audit will be agreed in advance, at the Organisation’s cost, and subject to confidentiality and to the security of other customers’ data.
9. Return and deletion
- Throughout the subscription, administrators can export data (Excel, CSV and PDF reports) and download a complete backup. Daily backups are also saved to the Organisation’s Google Drive.
- When a subscription ends, the account first stays fully usable for a grace period and then becomes read-only, so data can still be exported, before it is suspended.
- We delete Customer Personal Data from our live systems 90 days after suspension, or sooner if an administrator asks us to in writing, unless the law requires us to keep it. Copies in our own backups are overwritten as those backups are replaced.
- An administrator can also reset the Organisation’s data from Settings at any time; this removes it from AgentDesk immediately.
- Documents and backups in the Organisation’s Google Drive are under the Organisation’s control and are not deleted by us.
10. General
These Data Processing Terms remain in force while we process Customer Personal Data. If they conflict with the Terms of Service on the processing of Customer Personal Data, these terms prevail. Limitations of liability in the Terms of Service apply. We may update these terms as the law or the service changes and will give administrators at least 30 days’ notice of material changes.
Annex A: Security measures
- Encryption in transit: all traffic to the web app, the mobile apps (once available) and the API uses HTTPS.
- Credentials: passwords stored as bcrypt hashes; Google access tokens encrypted with AES-256-GCM.
- Sign-in: short-lived access tokens with refresh tokens; mobile OTP; optional authenticator-app two-factor authentication; temporary lock-out after repeated failed attempts; rate limits on sign-in and public forms.
- Separation: every record belongs to one organisation, and every request is checked so one organisation cannot read another’s data.
- Access control: role-based permissions for viewing, creating, editing, deleting and exporting each module and report; payout figures hidden from staff without permission; changes to passwords and two-factor settings take effect immediately.
- Safeguards: typed confirmation before deleting customers or resetting organisation data.
- Backups: daily full backups to the Organisation’s Google Drive, downloadable by administrators.
- Operations: our platform console requires its own accounts with two-factor authentication and can be limited to approved IP addresses; production secrets are kept out of the source code.