DATA PROTECTION SCHEDULE · B2B PRIVACY

security SCHEDULE B · DPDP ACT 2023 & CERT-IN COMPLIANT

Partner Data Protection Schedule

Privacy, Security, Customer Data & Incident Obligations (Schedule B)

Effective Date: May 10, 2025

shield

Mandatory Schedule B: This Data Protection Schedule forms an integral, legally binding part of the Master Partner Agreement. By operating on the Brocoly Merchant OS or receiving subscriber orders, Partner agrees to all data protection, security SLA, and incident reporting mandates herein.

list_alt

Schedule Clauses

9 Sections

account_balance Statutory Framework

Governed in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India) and CERT-In Cyber Incident Guidelines.

location_on Bengaluru, Karnataka (IN)

shield Governance Desk

Need custom enterprise DPA terms, audit validation, or cross-border SCC clauses? Contact our Bangalore privacy team.

mail privacy@brocoly.in mail legal@brocoly.in

Scope of Personal Data Processing

Platform Data Scope

This Schedule governs all personal-data handling between Brocoly Foods Private Limited ("Brocoly") and Partner Kitchen / Cloud Kitchen Operator ("Partner") in connection with the Brocoly Platform, Merchant OS dashboard, batch fulfillment interfaces, and delivery coordination APIs.

Protected Data Classifications under this Schedule:

check_circle Subscriber Data: Name, delivery address, dietary notes, phone token, allergen profiles.

check_circle Fulfillment Logs: Dispatch timestamps, meal temperature logs, packaging tamper-seal codes.

check_circle Staff Credentials: Kitchen manager identifiers, OTP authenticators, kitchen audit logs.

check_circle Financial Records: Settlement ledgers, invoice reconciliations, payout accounts.

Determine Roles by Processing Activity

Statutory Classification

The parties explicitly document whether a party acts as a Data Fiduciary / Controller, Data Processor / Service Provider, or another legally recognised role for each processing activity. Contract labels do not override the actual legal relationship or applicable DPDP Act determinations.

Processing Activity	Brocoly Statutory Role	Partner Kitchen Role	Lawful Basis
Customer Meal Subscriptions & Profiles Dietary requirements, address, schedule	Data Fiduciary	Data Processor (Fulfillment)	Explicit Consent / Contract
Daily Kitchen Assembly & Dispatch Delivery tokens, meal portions, allergens	Joint Fiduciary	Joint Fiduciary	Contractual Performance
Kitchen Internal Staff Management Chef credentials, operational hygiene logs	SaaS Platform Host	Independent Fiduciary	Legitimate Employment Use
Payment Reconciliation & GST Invoicing Tax IDs, bank account tokens, remittances	Data Fiduciary	Independent Fiduciary	Statutory Legal Obligation

Permitted Platform Uses & Direct Marketing Ban

Strict Usage Boundaries

Data shared through Brocoly may be processed strictly for account administration, meal plan subscriptions, payment reconciliation, delivery fulfillment, verified customer assistance, anti-fraud controls, and platform notifications.

block Expressly Prohibited Processing (Strict Commercial Breach)

Partner must NEVER export, scrape, or extract customer phone numbers, addresses, or email addresses into external CRM, WhatsApp bots, or spreadsheet stores.
Partner is STRICTLY FORBIDDEN from engaging in off-platform direct marketing, cold calling, flyers, or unsolicited promotional inserts targeting Brocoly subscribers.
Partner shall not sell, license, broker, or combine customer profiles with third-party datasets or rival aggregator channels.

Technical & Organisational Security Controls

Mandatory Controls

Partner agrees to implement, enforce, and regularly audit reasonable security safeguards to prevent unauthorised access, modification, disclosure, accidental loss, or destruction of Platform data.

lock Mandatory MFA & Auth

Multi-factor authentication required on all partner portal accounts. Shared generic logins (e.g. kitchen@gmail.com) are strictly banned.

badge Least-Privilege RBAC

Line chefs and packaging crew only access daily assembly sheets with masked contact details. Full customer addresses remain restricted to dispatch heads.

enhanced_encryption Encrypted Rest & Transit

All endpoints, local printers, and tablets accessing Brocoly APIs must support TLS 1.3 in transit and AES-256 local encrypted storage.

screen_lock_portrait Device Sanitation

Thermal print receipts displaying customer delivery addresses must be safely shredded or destroyed post-dispatch, never discarded openly.

Data Breach Handling & Incident Escalation SLA

High Priority Clause

timer

Immediate Incident Escalation SLA: 24 Hours

Mandatory CERT-In & DPDP Board reporting coordination deadline

Escalate: privacy-ops@brocoly.in

Partner shall notify Brocoly without undue delay, and in any event within 24 hours of becoming aware of any confirmed, suspected, or probable Personal Data Breach affecting shared infrastructure, partner tablet endpoints, employee email compromises, or fulfillment logs.

The written incident disclosure must contain:

warning Nature and scope of incident including estimated number of impacted subscribers.

engineering Immediate remediation, isolation steps, and active containment measures taken.

badge Name, title, and 24/7 direct telephone contact of partner's technical incident lead.

policy Coordination protocol for required regulatory notifications (CERT-In / DPDP Board).

Third Parties & Sub-processors

Vendor Ecosystem

Brocoly utilizes vetted third-party hosting, payment processing, transactional messaging, and infrastructure service providers to deliver the Platform. Partner remains strictly liable for any custom third-party integrations, POS links, or delivery aggregators it connects to the Brocoly merchant ecosystem.

Authorized Core Platform Sub-processors:

Cloud Infrastructure

AWS (Asia Pacific - Mumbai) / Google Cloud India

Payment Gateways

Razorpay / Cashfree (PCI-DSS Level 1)

Messaging & OTP

Gupshup / Exotel / AWS SES

Data Retention & Post-Termination Purge

Lifecycle Rules

Data is retained only as long as strictly necessary for operational meal fulfillment, active subscription cycles, billing reconciliation, tax compliance, and dispute resolution.

auto_delete 30-Day Subscriber Data Purge

Upon termination of the Partner Agreement, Partner must permanently delete or return all customer contact directories, delivery records, and dietary sheets within thirty (30) calendar days.

receipt_long 7-Year Statutory Tax Retention

Tax invoices, settlement remittances, and GST invoices are preserved for 7 years as required by the Central Goods and Services Tax Act, 2017 and Indian accounting standards.

Data Principal Rights & Lawful Requests

DPDP Rights Enforcement

The parties agree to reasonably cooperate in responding to customer requests exercising statutory rights under the DPDP Act 2023. Where a request relates directly to Partner's own collection or handling of personal data, Partner shall be directly responsible for timely redressal.

visibility Right to Access Summary of data & processing

edit_note Right to Correct Dietary, allergy, address fixes

delete_forever Right to Erasure Account deletion workflows

support_agent Grievance Redress 7-day escalation response

Cross-Border Data Processing & Localization

Sovereignty & Jurisdiction

All customer meal data, subscriber delivery coordinates, payment audit journals, and partner kitchen telemetry are hosted primarily within data centres located inside the territory of India. Any transfer, remote engineering access, or overseas API connection shall strictly comply with Central Government notifications and negative lists issued under Section 16 of the DPDP Act 2023.

flag

Primary Data Residency: India (Mumbai / Hyderabad data centre availability zones).

draw Schedule Incorporated into Master Partner Agreement

Execution of the Brocoly Master Partner Agreement or digital verification via the Partner Onboarding Desk constitutes legally binding acceptance of this Schedule B in its entirety.

verified Partner Onboarding Portal