Data Processing Addendum (DPA)

1. Scope & Applicability

This Data Processing Addendum ("DPA") supplements the Terms of Service and Privacy Policy between Book Your Calendar ("Data Processor") and the organization or individual subscribing to our scheduling services ("Customer" or "Data Fiduciary").

This DPA applies to all processing of Personal Data carried out by Book Your Calendar on behalf of Customer in connection with scheduling appointments, consultations, payments, and calendar synchronization.

2. Data Residency (Indian Cloud Infrastructure)

Book Your Calendar prioritizes national data sovereignty and compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act):

3. Security & Confidentiality Measures

• ISO 27001:2022 Certified Information Security: Rigorous access controls, vulnerability scanning, and risk governance.
• Payment Security: All payment transactions are processed through Razorpay (PCI-DSS Level 1 compliant). Book Your Calendar does not store raw credit/debit card credentials.
• Calendar Access Scopes: We request strictly necessary, restricted OAuth 2.0 scopes from Google Workspace and Microsoft Graph, using tokens encrypted with unique KMS keys.
• Role-Based Access Control: Strict least-privilege administrative access with multi-factor authentication (MFA) required for internal staff.

4. Sub-processors

Customer provides general authorization for Book Your Calendar to engage sub-processors to deliver core infrastructure, payment facilitation, and transactional notifications.

A complete and current list of authorized sub-processors is publicly maintained at /sub-processors. Book Your Calendar will notify customers at least 30 days prior to onboarding any new infrastructure sub-processor.

5. Data Principal Rights & Retention

In compliance with DPDP Act Section 11-13 and GDPR Articles 15-22, Data Principals possess the statutory right to access, correct, complete, or request erasure of their personal data.

Retention Period: Active account booking histories are retained for the duration of the subscription. Upon account closure or verified deletion request, all personal data is permanently purged from active production databases within 30 days.

6. Statutory Grievance Redressal Officer (DPDP Act)

Pursuant to the Digital Personal Data Protection Act, 2023, Book Your Calendar has appointed a designated Grievance Officer for data protection inquiries: