Data Processing Terms

These Data Processing Terms ("DPA") form part of the Terms of Service between the Customer ("you") and The Right Management ("we"). They apply to personal data contained in Customer Data that we process on your behalf ("Customer Personal Data").

Under the Digital Personal Data Protection Act, 2023, you are the Data Fiduciary for Customer Personal Data and we are your Data Processor. Words defined in that Act have the same meaning here.

• People involved: your clients and their contacts, artists and their representatives, crew, vendors, venue contacts, follow-up recipients and your own team members.
• Types of data: names, phone numbers, email addresses, company names, cities, fees and booking details, event itineraries, travel and hotel details, show expenses, notes, photos, riders, show documents and links you add.
• Purpose: only to provide the Service to you: storing records, building proposals and show links, preparing follow-up messages and the other features you use.
• Duration: for as long as you use the Service, and then until deletion under section 8.

• You have a lawful basis, such as valid consent, to collect Customer Personal Data and to share it with us.
• You give the people concerned any notice the law requires, and you handle their requests to access, correct or erase their data. We will help you (section 6).
• You only send WhatsApp or other messages to people who have agreed to hear from you, and you stop when they ask.
• You only publish proposal and show links containing information the people who receive them are entitled to see.
• You do not upload sensitive data the Service does not need, such as bank or card details or health information. If you upload identity documents for travel or venue access, you mark them for managers only and delete them once the show is over.
• You manage your team's access and remove people who should no longer have it.

• We process Customer Personal Data only on your documented instructions, which are these Terms and your use of the Service's features, unless Indian law requires otherwise (in which case we tell you first where the law allows).
• We never sell Customer Personal Data, use it for our own purposes or for advertising, or use it to train AI models.
• No access by our staff. No one at The Right Management, including our developers, opens, reads or reviews Customer Personal Data, except at the written request of your workspace owner or admin for a specific support issue, where Indian law requires it, or to deal with a security incident. Anyone who does access it under these exceptions is bound by confidentiality.
• We keep each company's data separate and protect it with the measures described on our Security page. We review them regularly and do not reduce their overall level of protection.
• We keep Customer Personal Data accurate as you enter it, and do not change it except as you instruct through the Service.

You authorise us to use the providers listed in section 5 of our Privacy Policy as sub-processors. Each is bound by a written contract with data protection duties no less protective than these. We will give at least 15 days' notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot address your concern, you may cancel and receive a pro-rata refund of prepaid fees for the unused period. We remain responsible for our sub-processors.

• Owners and admins can view, correct, export and delete Customer Personal Data directly in the Service at any time.
• If we receive a request from one of your contacts, we pass it to you and do not respond ourselves unless you ask us to.
• We will give reasonable help with requests from the Data Protection Board or other authorities about Customer Personal Data.

If we become aware of a breach affecting Customer Personal Data, we will notify the workspace owners without undue delay, and in any case within 48 hours. We will tell you what happened, what data and people are affected, the likely consequences and the steps we have taken, and keep you updated. This is so you can meet your own duty to notify the Data Protection Board of India and the people affected. We will take immediate steps to contain the breach.

• You can download all workspace data at any time from Settings → Account & data.
• If you delete your company, all Customer Personal Data in it is deleted immediately.
• If your subscription ends, part-way through a billing period or at its end, the data stays available for 30 days and is then permanently deleted.
• Copies in rolling backups are removed within 30 days of deletion. We keep no other copies, except where Indian law requires us to.

On request, we will give you the information you reasonably need to show that we meet this DPA, including a description of our security measures and sub-processors. Enterprise customers may agree additional audit rights in their order form.

We treat Customer Data as confidential. We only allow access under the exceptions in section 4, and anyone with that access is bound by confidentiality obligations that continue after they stop working with us.

Questions about this DPA: info@therightmanagement.in.