Legal · Real Estate CRM
Data Processing Terms
How we handle the personal data our q4u customers entrust to us.
These Data Processing Terms form part of the q4u Terms of Service (the "CRM Terms") between Qubrix Technode Private Limited ("Qubrix Technode", "we") and the business using q4u, our Real Estate CRM (the "Customer"). They apply whenever we process personal data on the Customer's behalf through the CRM.
1. Roles
Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it, the Customer is the Data Fiduciary and Qubrix Technode is its Data Processor for personal data in the CRM. Words such as "personal data", "Data Principal" and "personal data breach" have the meanings given in the DPDP Act.
2. What we process
| Purpose | Providing, securing and supporting the CRM for the Customer. |
|---|---|
| Activities | Hosting and storing records, organising leads and inventory, sending and receiving messages, generating assistant answers and lead scores, and producing reports. |
| People | Prospective buyers and leads, the Customer's buyers, channel partners, and the Customer's own staff who use the CRM. |
| Data | Names, phone numbers, email addresses, messages, property preferences and budget, site-visit and booking details, documents the Customer uploads, and staff account details. |
| Duration | For as long as the Customer uses the CRM, plus the return and deletion period in section 10. |
3. Processing only on instructions
We process the Customer's personal data only to provide the CRM, as described in the CRM Terms, these Data Processing Terms and the way the Customer configures and uses the CRM. If the law requires us to process it otherwise, we will tell the Customer first unless the law prohibits that.
4. The Customer's responsibilities
- Giving Data Principals the notices, and obtaining the consents, that the DPDP Act requires before their data enters the CRM, including before messaging them on WhatsApp.
- Responding to Data Principals' requests to access, correct or erase their data, and to their grievances.
- Keeping the data accurate, and collecting only what is needed for the purpose.
5. Our people
Only personnel who need access to run or support the CRM can reach Customer personal data, and they are bound by confidentiality obligations.
6. Security
We maintain reasonable security safeguards, including:
- encrypted connections (HTTPS) between users and the CRM;
- each Customer's records scoped to that Customer's account, with role-based permissions for its users;
- WhatsApp connection credentials stored encrypted, per Customer;
- production access limited to authorised personnel, and regular backups.
7. Sub-processors
The Customer authorises us to use the following providers to deliver the CRM. We require each to protect the data at least as well as these terms require.
| Service | Provider | Purpose |
|---|---|---|
| Cloud hosting | Render | Runs the CRM application |
| Database | MongoDB Atlas | Stores CRM records |
| Media storage | Cloudinary | Stores images and documents uploaded to the CRM |
| WhatsApp messaging | Meta Platforms (WhatsApp Business Platform) | Sends and receives WhatsApp messages |
| SMS and one-time passwords | Twilio | Sends sign-in codes |
| AI models | Anthropic; OpenAI | Generate assistant answers and assess lead interest |
| Email delivery | Our email service provider | Sends account and notification emails |
We will update this list and email account administrators at least 15 days before adding a new sub-processor. If the Customer objects on reasonable data-protection grounds, we will discuss it in good faith; if we cannot resolve the objection, the Customer may end the affected service.
Some providers may process data outside India. We will not transfer personal data to any country or territory that the Central Government has restricted under the DPDP Act.
8. AI processing
We send personal data to AI model providers only to generate answers and lead scores for the Customer it belongs to. We do not use Customer personal data to train AI models. Under their standard terms for business API use, the providers listed above do not use data sent through their APIs to train their models.
9. Personal data breaches
If we become aware of a personal data breach affecting Customer data, we will tell the Customer without undue delay, with what we know about its nature, the data and people affected, its likely consequences and the steps we are taking. We will help the Customer with the intimations it must make to the Data Protection Board of India and to affected Data Principals.
10. Return and deletion
When the CRM service ends, we will give the Customer an export of its data if it asks within 30 days. We then delete the Customer's personal data within 90 days, except where the law requires us to keep it. Copies in backups are overwritten in the normal backup cycle.
11. Help and information
- We will help the Customer respond to Data Principals' requests, through the CRM's features or on request.
- We will provide information reasonably needed to show that we meet these terms, such as answers to security questionnaires. Any audit beyond that is by agreement, with reasonable notice, at the Customer's cost and no more than once a year.
12. Liability
Each side's liability under these Data Processing Terms is subject to the limits in the CRM Terms.
13. Contact
Questions about these terms, or a data-protection concern:
Grievance Officer, Qubrix Technode Private Limited
Runway Studio Suites, 109, Gaur Yamuna City, YEIDA, Nawada, Gautam Buddha Nagar – 203201, Uttar Pradesh, India
Email: qubrixtechnode@gmail.com