Data Processing Addendum

Your gym decides what happens to your members' personal data. We hold it and act on your instructions. Section 8(2) of the Digital Personal Data Protection Act, 2023 requires that relationship to rest on a contract — this is it. It applies automatically to every gym using RepDesk, and there is nothing separate to sign.

1. Scope and roles

This Addendum forms part of the Terms of Use between REPDESK (“RepDesk”) and your gym (“you”). Where this Addendum and the Terms of Use conflict on the processing of member personal data, this Addendum governs.

The second row is governed by our Privacy Policy, not by this Addendum.

Terms defined in the Act — Data Fiduciary, Data Processor, Data Principal, personal data, processing, personal data breach — carry their meanings from the Act here.

2. Processing only on your instructions

We process member personal data only to provide RepDesk to you, and only on your documented instructions. Your instructions are: this Addendum, the Terms of Use, and the operations you carry out in the product.

We will not process member personal data for any purpose of our own. The sole exception is the anonymisation described in section 10, which you authorise by accepting this Addendum, and which by definition produces data that is no longer personal data.

If we believe an instruction from you would breach the Act, we will tell you rather than silently comply or silently refuse. If we are required by law to process data in a way your instructions do not cover, we will tell you before doing so, unless that law forbids us from telling you.

3. What we process

4. Confidentiality

RepDesk is a sole proprietorship with no employees and no contractors. The proprietor is the only person who can reach member personal data, and does so only to operate or support the service.

That is a smaller promise than the usual one, and a more checkable one. If we ever engage anyone — an employee, a contractor, a support agent — they will be bound by written confidentiality obligations that survive their engagement, given access only to what their work requires, and we will publish a new version of this Addendum saying so before they start.

5. Security measures

We implement the safeguards required by Rule 6 of the Digital Personal Data Protection Rules, 2025:

• Encryption of personal data in transit, and masking or redaction of sensitive values in logs.
• Access control on every system holding personal data, limited to those who need it.
• Logging and monitoring of access, so that unauthorised access can be detected and investigated.
• Retention of logs for one year, so an incident can be reconstructed.
• Backups sufficient to preserve the confidentiality, integrity and availability of your data.
• Database-level isolation of each workspace, so one gym cannot reach another's records.
• An API that is not exposed to the open internet, reachable only through an outbound tunnel behind a protected edge.
• Contractual obligations on every sub-processor to maintain equivalent measures.

We review these measures and may improve them. We will not reduce the overall level of protection during this agreement.

6. Sub-processors

You give us general authorisation to engage sub-processors. Those currently engaged are listed, with what each receives and where it is, on our Sub-processors page.

Before a new sub-processor handles member personal data, we will update that page and give you notice by email. You may object on reasonable data protection grounds within fourteen days. We will try to resolve your objection; if we cannot, you may terminate and we will delete your data as set out in section 9.

Each sub-processor is bound by written terms no less protective than this Addendum, and we remain responsible to you for their acts and omissions as if they were our own.

7. Helping you meet your obligations

You are the Data Fiduciary, so a member's request goes to you. RepDesk gives you the tools to answer it yourself: you can view, correct, export and delete any member record directly, without involving us.

If a member approaches us instead, we will not act on it. We will refer them to you and, where we can identify your workspace, tell you promptly.

Where you genuinely cannot answer a request using the product, we will give you reasonable assistance — taking into account the nature of the processing and the information available to us. We will also give you the information you reasonably need to demonstrate your own compliance.

8. Personal data breach

If we become aware of a personal data breach affecting member personal data we process for you, we will notify you without delay, so that you can meet your own obligations — which are to inform affected members without delay, and to report to the Data Protection Board of India within 72 hours.

Our notice will tell you, as far as we know it at the time:

• What happened, and when, including the nature and extent of the breach.
• The categories of personal data and the approximate number of members affected.
• The likely consequences.
• What we have done and are doing to contain it and reduce the harm.
• What we recommend you and your members do.

We will keep you updated as we learn more, and we will cooperate with you and with the Board. We will not make a public statement identifying your gym without consulting you first, unless the law requires it.

9. Return and deletion

Throughout this agreement you can export your data yourself from Settings, in CSV, at any time and without asking us.

When this agreement ends, we delete member personal data held for you, and instruct our sub-processors to do the same — subject to one thing that is not ours to waive. Indian law requires every Data Fiduciary to retain personal data, traffic data and logs for at least one year from processing. We cannot delete below that floor. During that period the data remains protected by this Addendum and is not processed for any other purpose.

Backups are overwritten on their ordinary cycle rather than individually edited. Deleted data may persist in a backup until that cycle completes, and remains protected until it does.

Two items deliberately survive, both described in the Privacy Policy: a pseudonymised record in our sales ledger kept for accounting and tax, and one workspace-closure entry in our audit log. Neither contains member personal data.

10. Anonymised and aggregated data

You authorise us to irreversibly anonymise and aggregate data held in your workspace, and to use the result to improve RepDesk, to produce industry benchmarks, and to develop and train models that power features inside RepDesk.

This authorisation is bounded, and the bounds are contractual obligations on us, not statements of intent:

• The anonymisation must be irreversible. We will not attempt to re-identify the result, and will not permit any third party to.
• No output may single out your gym or any individual member. Nothing is published or shown unless drawn from at least 20 gyms.
• Your raw member records are never used for this, and are never disclosed to another gym.
• We will not sell this information, anonymised or otherwise.
• Nothing anonymised is fed to any third-party AI or large language model service.

Once personal data has been irreversibly anonymised it falls outside the Digital Personal Data Protection Act altogether, because the Act governs personal data. That is precisely why the obligation of irreversibility above is the load-bearing part of this section, and why we accept it as a contractual term you can hold us to.

11. Transfers outside India

The Act permits personal data to be transferred outside India, subject to restrictions the Central Government may notify for particular countries. No localisation requirement currently applies to RepDesk.

Your members' operational records are held in Mumbai, India. What crosses a border is the narrower set each sub-processor needs — principally a phone number for WhatsApp delivery and an email address for service mail. The Sub-processors page states where each one is.

If the Government restricts transfers to a country where a sub-processor operates, we will move that processing or stop it, and tell you.

12. Information and audit

On reasonable written request, and no more than once a year unless a breach or a regulator requires otherwise, we will give you the information you reasonably need to verify our compliance with this Addendum.

We will respond to a reasonable security questionnaire. Where that is genuinely insufficient, we will discuss an audit of our processing, conducted during business hours, with reasonable notice, by someone bound to confidentiality and not a competitor of ours, and in a way that does not compromise another customer's data or the security of the service. You bear your own costs.

13. Liability

The limitation of liability in the Terms of Use applies to this Addendum, and the two are read together as a single cap rather than as separate ones.

Nothing here affects a Data Principal's rights under the Act, or either party's liability to the Data Protection Board of India. Those cannot be allocated by contract.

14. Contact

Questions about this Addendum, or anything in it: privacy@repdesk.co.in.

Grievance Officer: Khursheed Alam, Proprietor Address: C-189, Abrar Nagar, Madina Masjid Road, Kalyanpur, Sadar, Lucknow, Uttar Pradesh 226022, India