This agreement is between Centre for Advanced Practical Project Management (“CAPPM”) and the organization that uses the platform (the “Customer”). It forms part of the Terms of Service.
1. Roles
The Customer is the Data Fiduciary (controller) for the personal data of all its users, staff and consumers alike, including the sign-in identities they use within its organization and apps, and all data the Customer and its users put into the platform. CAPPM is its Data Processor (processor): it processes that data only on the Customer's instructions, given case by case or in advance as the Standard Instructions in section 3, and for no purpose of its own.
CAPPM is the Data Fiduciary only for the Customer's business contacts (its owners, its administrators as contacts, and its billing contacts), under its own Customer Privacy Notice.
3. Standard Instructions
By accepting this agreement, the Customer instructs and authorises CAPPM in advance to:
- offer its users a self-service “Delete my account” tool, and carry out a deletion a user asks for: tell the Customer on the day it is asked, wait 14 days during which the user can cancel, then remove the user from every Customer they belong to and, with no Customer left, erase their identity;
- let its members leave its organization where the Customer allows it, 14 days after they ask, and pass on to the Customer the requests of members who may not leave;
- erase an identity that no Customer uses any more, 14 days after the last access ends, telling the person first;
- keep security records: access and processing logs, and a minimal record of each erased identity (its identifier, organizations and roles, sessions with device and IP address, the dates it was created, asked to be deleted and erased, and any reason given), for one year in an isolated store only CAPPM's platform security staff can read, every search of it logged, as a security safeguard supporting the Customer's obligations under the DPDP Rules 2025, Rule 6(1)(e) and Rule 8(3) read with the Seventh Schedule; then delete them;
- suspend the accounts that relied on a lapsed domain (Terms, section 5), and never delete them for that reason;
- keep backups for up to 35 days, use them only to restore the service after a failure, and apply again any erasure made since a restored backup was taken.
CAPPM carries these out as the Customer's processor; it does not decide them. The Customer may ask CAPPM in writing to change how an instruction applies to it, where the platform allows.
4. Privacy contact and notices
The Customer may name a privacy contact. CAPPM sends it notice of:
- a user's request to leave, or to delete their account, on the day it is made, with the date it takes effect (14 days later) and any reason given;
- the user's removal or erasure when it takes effect;
- a member's request to be removed when the Customer does not let members leave, with a due date 30 days later;
- a domain's failing checks and its lapse (Terms, section 5).
Without a privacy contact, notices go to the Customer's administrators. The Customer may also receive the same events at a webhook it configures, signed by CAPPM. The events carry the person's identifier, and their name and email where the Customer needs them to act.
5. Data principals' requests
Requests from the Customer's users are the Customer's to answer. When CAPPM receives one, it passes it to the Customer (or each Customer concerned) within 3 working days, does not answer it itself, and assists the Customer: it records each request with a due date 30 days after it is made and provides the tools to act on it (removing a user, purging HRMS records). Requests covered by a Standard Instruction (section 3) are carried out as instructed.
6. The Customer's notice to its users
The Customer gives its users its own privacy notice, naming itself as their Data Fiduciary (DPDP Act, Section 5), and sets its address in its settings before it opens sign-up to the public. The platform links it from the Customer's sign-in and sign-up pages.
7. Employee records after an account is deleted, and their retention
When a person deletes their account, or leaves or is removed from the Customer, HRMS keeps the Customer's employee records about them, without depending on the deleted identity. The Customer keeps them for the purposes of employment, including safeguarding itself from loss or liability (DPDP Act, Section 7(i)), and because retention is necessary for compliance with Indian tax and labour laws (Section 8(7)(b)).
The Customer decides how long HRMS keeps them, per category of record, counted from the end of the financial year (31 March) in which the employee's last entry falls (their exit, last payslip or full and final settlement). For each category HRMS proposes a default at or above a reference period, shows the reference and its basis, and warns when a setting is shorter. The reference periods are not legal advice; the Customer remains responsible for its retention obligations.
HRMS never purges a record on its own: records that pass their retention date are listed for the Customer to review, and the Customer either purges a record or keeps it longer with a reason. Purging anonymises the person's identifying details, removes free-text notes from the person's leave, expense and similar records (payroll and tax records keep theirs), and deletes the person's files, keeping the amounts, dates and codes needed for totals and statutory reports.
In production, stored files are protected against deletion for 365 days after they are written. A purge does not override that protection: a file still within it is deleted automatically when the protection ends, and the Customer is told how many such files remain and the date by which they will be deleted.
8. Deletion on termination, or when the organization is deleted
When the Customer deletes its organization (Terms, section 4), or on termination, CAPPM deletes all Customer personal data 30 days after the deletion is requested, including HRMS records and files, overriding the file protection in section 7, and erases each user's identity that no other Customer uses. A deletion can be scheduled only after the Customer confirms that its statutory records have been exported (Terms, section 4); that confirmation is kept. Copies in backups expire within 35 days (section 3 f).
CAPPM keeps no copy of the Customer's data after deletion, except the security records in section 3 d and the record of the confirmation.
9. Sub-processors and location
CAPPM hosts the platform in the United States (AWS us-east-1), and uses these sub-processors:
- Amazon Web Services (hosting, database, storage, and Amazon SES (email))
- Cashfree Payments India Pvt. Ltd. (optional HRMS bank account and identity verification, when used by the Customer)
10. EU and UK residents
Where the Customer's personal data includes data of residents of the European Union or the United Kingdom, the EU GDPR or UK GDPR also applies to that data, and this agreement is read as the controller–processor contract required by Article 28 of that law. CAPPM's handling of requests (section 5) and the notices in section 4 meet its time limits.
Where such data is transferred outside the European Economic Area or the United Kingdom to a country without an adequacy decision (including India or the United States), the transfer is governed by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module Two: Controller to Processor, with Clause 7 docking optional, Clause 9(a) Option 2 general written authorisation with 14 days' notice, Clause 11 optional redress omitted, and Clause 17/18 governed by the laws and courts of Ireland) and, for UK data, the UK Information Commissioner's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, both of which are incorporated into this agreement by reference.