Data processing addendum

This addendum is the contract between your business and Code Colonies Private Limited ("MatruOS") about the personal data MatruOS processes for your business. It is the "valid contract" that section 8(2) of the Digital Personal Data Protection Act 2023 (DPDP Act) requires between a Data Fiduciary and a Data Processor. It forms part of the Terms of service, and you accept it when you accept them.

Section 1Roles

• Your business is the Data Fiduciary. You decide why and how the personal data of your customers, suppliers, staff, patients, students and others is used.
• MatruOS is your Data Processor. It processes that data only to provide MatruOS to you, on your documented instructions.
• Your instructions are these terms, your settings, and what you and your team do in MatruOS, including what you approve the AI team to do.
• If MatruOS believes an instruction breaks the law, it tells you and may decline to follow it.

Section 2What is processed

Your data register in Settings → Privacy shows the exact list for your business, kept up to date as you switch apps on and off.

Section 3MatruOS's duties

MatruOS will:

1. 1process the data only on your instructions and for your purposes, never for its own purposes, never to sell, and never to train AI models;
2. 2keep it confidential, and make sure that everyone at MatruOS who can reach it is bound by confidentiality, trained in privacy, and given access only as their work needs;
3. 3protect it with the reasonable security safeguards that rule 6 of the DPDP Rules 2025 requires, set out in section 4;
4. 4help you meet your duties: notices, consent records, data principals' requests, impact assessments and breach reports. Most of this is done by the privacy tools built into MatruOS;
5. 5tell you about personal data breaches as section 5 sets out;
6. 6use sub-processors only as section 6 sets out;
7. 7delete or return the data at the end, as section 9 sets out;
8. 8give you the information you need to show you comply, as section 10 sets out.

MatruOS may create aggregated statistics that cannot identify you or any person (for example, how fast screens load). These are not personal data. You may ask that your business be left out.

Section 4Security safeguards

As rule 6 of the DPDP Rules requires, MatruOS:

• encrypts data in transit (TLS) and at rest, and seals identity numbers (such as PAN and bank account numbers) so that screens and AI see only the last 4 digits unless a person with permission needs the full number;
• keeps every business's data separate at the database level (row-level security), so one business can never read another's;
• controls access with roles, two-step sign-in, passkeys for MatruOS staff and approved devices;
• keeps logs of access and changes that cannot be altered, for at least 1 year, and keeps CERT-In logs for 180 days;
• takes regular backups, tests that they can be restored, and has a plan for keeping the service running;
• has an incident plan, and tests and reviews its safeguards regularly;
• is built to ISO 27001 and SOC 2 standards. This is a description of how it is built, not a certification.

Section 5Personal data breaches

• If MatruOS becomes aware of a breach affecting your data, it tells your owners without undue delay, and in any case within 24 hours of becoming aware of it.
• It gives you what it knows: what happened, when, what data and roughly how many people are affected, the likely consequences, what MatruOS has done and what you can do. It sends updates as it learns more.
• It helps you send the reports the law requires: to the Data Protection Board within 72 hours, to each affected person without delay (DPDP Rules r.7), and to CERT-In within 6 hours where its Directions apply.
• Telling you about a breach is not an admission of fault.

Section 6Sub-processors

• You agree that MatruOS may use the sub-processors listed on the Sub-processors page, such as hosting, email, messaging, payments and AI processing.
• MatruOS binds each one by contract to protections at least as strong as this addendum, and stays responsible to you for their work.
• MatruOS tells you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and you cannot agree a solution together, you may cancel and get a refund of any fees paid for the time after the change.
• Optional providers that you choose to connect, such as your own WhatsApp number, payment gateway or email provider, are your own providers, not MatruOS's sub-processors.

Section 7Support access to your account

MatruOS staff do not look at your data. The only exception is when an owner or admin allows a support visit, and then only as follows:

• A visit needs your consent, given in the app by an owner or admin on an approved device. Email or a forwarded link can never grant access.
• Each visit is for one named staff member, for a stated reason linked to your request, for a time you choose (15 minutes to 4 hours), and for view-only or changes as you choose. Staff cannot extend a visit or approve it themselves.
• Sensitive data stays hidden unless you tick to show it on the consent screen. This covers health and patient records, children's data, identity documents and full ID numbers, job applicants, people records beyond names, and privacy requests. Customer phone numbers and emails are masked too.
• Some things are never allowed, even with changes: team and security settings, bank and payout details, billing, exports, deleting the business, payroll and the vault, approving AI actions, and messaging your customers.
• Every screen opened and action taken is logged (the page, action and record IDs, never the contents) and shown to you. When the visit ends, owners get a summary by email and in the app. You can end a visit at any time.
• Support staff are based in India, have signed a confidentiality undertaking and are trained in privacy before they are given the role.
• There is no "break-glass" or silent access.

Section 8Requests from authorities

If police, a court or a government body asks MatruOS for your data, MatruOS:

• accepts only a written order with a legal basis, checks it, and records it;
• points the authority to your business first, and gives you a copy of the order, unless the order lawfully forbids this;
• hands over data itself only when the law compels it. Then it gives only what the order names, with a second person checking, over an encrypted channel, and with every step recorded;
• tells you what was handed over, unless the law forbids it, and in that case tells you when the restriction ends;
• challenges orders that are too broad or lack a legal basis.

Section 9When your account ends

• You can export all your data at any time and for 30 days after your account ends.
• After those 30 days, MatruOS deletes your data from its live systems within a further 30 days. Copies in encrypted backups are overwritten as the backups expire, within 90 days.
• MatruOS keeps only what the law requires it to keep for itself (for example, its own invoices to you) and data under a legal hold you or a lawful order have set. Deletion is recorded.
• Your own books and records, which tax and company law require you to keep (for example, 8 years under the Companies Act 2013 s.128(5) and 72 months under the CGST Act s.36), are your responsibility. Download them before you leave. MatruOS reminds you when you cancel and 7 days before deletion.

Section 10Showing compliance and audits

• MatruOS makes available its security and privacy evidence pack: its control map, policies, test results and certificates once they exist. It answers reasonable security questionnaires.
• If that is not enough to show compliance, or a regulator requires it, you may audit MatruOS once a year at your own cost. Give 30 days' notice, use an independent auditor bound by confidentiality, and keep the audit to records and controls that concern your data, without access to other businesses' data.

Section 11Your duties

• You confirm that you have a lawful ground for all personal data you put into MatruOS or collect through it, that you give every notice and obtain every consent the law requires, and that your instructions comply with the law.
• As section 8(1) of the DPDP Act provides, you remain responsible as Data Fiduciary for compliance, including for processing MatruOS does on your behalf. Answering data principals, reporting breaches to the Data Protection Board and to affected people, and any penalty or compensation arising from how your data is collected or used, are your responsibility; MatruOS helps as this addendum sets out.
• You will not instruct MatruOS to process data in a way that breaks the law, and you will tell MatruOS promptly if you become aware of a breach affecting data in your account.

Section 12Customers outside India

If your business is in the European Union or the United Kingdom, or processes data of people there, the General Data Protection Regulation (Article 28) or the UK GDPR also applies. MatruOS will then process the data as your "processor" on the same terms as above. For transfers outside those regions, it will sign the European Commission's Standard Contractual Clauses (2021/914) or the UK Addendum. Write to consulting@codecolonies.com to put these in place before you add such data.

Section 13Liability and order of documents

• The exclusions and the cap in section 15 of the Terms of service apply to all liability under or in connection with this addendum, which is within, and not in addition to, that cap. MatruOS is liable under this addendum only for loss caused by its own breach of this addendum, and is not liable for any penalty or compensation imposed on you as Data Fiduciary except to the extent that loss was caused by that breach.
• Your indemnity in section 16 of the Terms of service applies to claims arising from your data or your instructions.
• On personal data, this addendum prevails over anything else in the terms. Where the GDPR or UK GDPR applies, nothing in this section limits a data subject's own rights against either of us under those laws.

Questions: consulting@codecolonies.com. Code Colonies Private Limited, 12th Floor, Office 1216 and 1217, i-Square, Science City Road, Sola, Ahmedabad 380063, Gujarat, India. CIN U62091GJ2023PTC140196 · GSTIN 24AAKCC9592Q1ZO · Udyam UDYAM-GJ-01-0264196.