Data processing

Who is who

Under India's Digital Personal Data Protection Act, you are the Data Fiduciaryfor the personal data you put into EventzNest — your customers, your students, their parents. You decide what to collect and why.

We are your Data Processor. We hold and process that data on your instructions, to run the service you are paying for, and for no other purpose. We do not decide what you collect and we do not use it for our own ends.

What we commit to

• Process only on your instructions. Using EventzNest normally is your instruction. Anything beyond that, we ask first.
• Keep it separate. Your records live in their own database schema, not in shared tables. This is checked by an automated test suite on every change — see thesecurity page.
• Keep it secure. Encryption in transit, hashed sign-in passwords, encrypted stored email credentials, role-based access checked on every request, and a full audit trail.
• Restrict who can see it. Access by us is limited to what supporting you actually requires, and is logged.
• Help you answer your people. When one of your customers asks for their data or asks you to erase it, the export and delete features let you do it yourself. Where they do not cover it, we will help.
• Tell you about breaches. Without delay, with what we know, what we are doing, and what we recommend you do — not a sanitised notice weeks later.
• Give it back and delete it. On termination you export everything, and we delete what remains.

Sub-processors

We use a small number of infrastructure providers, listed in full and kept current on thesub-processors page. We will give you notice before adding one, so you have the chance to object.

Where the data sits

On managed infrastructure operated by the providers on that list. If you have a requirement about where data is physically stored, raise it before you sign up rather than after — it is a real constraint and we would rather discuss it honestly than discover it later.

Audits

We are a small company and cannot host on-site audits. We will answer a security questionnaire, describe any mechanism on this site in more detail, and walk you through how isolation is tested. If that is not enough for your compliance requirements, say so early.

Signing this

If your organisation needs a countersigned data processing agreement rather than a published page, email info@eventznest.com and we will arrange it.