NeoKaam Data Processing Addendum

For personal data you or your team members put into the service — names, email addresses, task content, comments, attachments — you are the controller and Sumit Sourabh is the processor. We process that data only to provide the service, only on your documented instructions (your use of the product being those instructions), and never for our own purposes.

For the small amount of data we decide the purpose of ourselves — account and billing records, security logs, and the audit trail — we are the controller. That processing is described in the Privacy Policy.

Subject matter: provision of a task and project management service. Duration: for as long as your account exists, plus the retention periods in section 6. Nature and purpose: storage, organisation, retrieval, display and transmission of the content you create, plus the notifications and reminders the product sends on your behalf.

Categories of data subjects: your team members and anyone they invite or name in a task. Categories of personal data: name, email address, profile image, authentication identifiers, IP address and user agent in security logs, and whatever personal data you choose to put into task titles, descriptions, comments and attachments.

We do not ask for and do not want special-category data (health, biometrics, political or religious beliefs) or payment card numbers. Card details go directly to our payment processors and never reach our servers.

• We process personal data only on your instructions.
• Everyone with access is bound by confidentiality, and access is limited to what the job requires.
• We implement the security measures described in section 4.
• We engage subprocessors only under section 5, and remain responsible for their performance.
• We help you respond to data subject requests — export and deletion are self-service in the product (Profile → export / delete account).
• We notify you without undue delay after becoming aware of a personal data breach affecting your data, and in any case within 72 hours.
• On termination, we delete or return your personal data as described in section 6.
• We make available the information needed to demonstrate compliance, and allow audits (see section 8).

Technical and organisational measures currently in place:

• TLS 1.2+ for all traffic in transit; encrypted disks at rest.
• Passwords stored only as bcrypt hashes; optional time-based two-factor authentication.
• Role-based access within projects, enforced server-side on every request.
• An append-only audit trail of access-, money- and account-level events.
• Automated encrypted backups on more than one schedule, held offsite as well as on the server, with a periodic restore drill.
• A published vulnerability disclosure policy — see Security.
• Structured error and security logging with alerting on operational failures.

These measures are reviewed as the product changes and may be updated, provided the level of protection is not reduced.

You give general authorisation for us to engage the subprocessors listed at /subprocessors, which names each one, what it does and where it processes data. Some rows on that page are conditional: they apply only when the optional feature or provider named in the row is switched on for your deployment, and the row says which condition that is. We will announce a new or replacement subprocessor on that page before it begins processing, and you may object on reasonable data-protection grounds by writing to [email protected]; if we cannot resolve the objection you may terminate the affected part of the service.

Deleting your account removes your personal data from the live database immediately. It then has to age out of our backups, which are encrypted and overwritten on a fixed rotation: the daily backup slots are replaced within a few days, and the encrypted offsite weekly slots — which hold roughly a year of history — within approximately 12 months, after which no copy remains. Security audit records and login history are kept for a limited period for fraud and abuse investigation and are then pruned automatically.

You can export your data at any time from your profile, in a machine readable format, without asking us.

Our servers are hosted on a single virtual private server [to confirm: hosting region — verify in the hosting console]. Some subprocessors process data in the United States or in India; those transfers rely on the European Commission's Standard Contractual Clauses, on an adequacy decision, or on the provider's own certification, as identified on the subprocessors page.

On reasonable written request, and no more than once a year unless required by a supervisory authority, we will answer a security questionnaire and provide the documentation we hold. We are a small team: on-site audits are not practical, and we say so plainly rather than promising one we could not honour.

Questions about this Addendum, or a request to sign one, go to [email protected]. NeoKaam is operated by Sumit Sourabh.