Scope
| Data Principals | Sellers, buyers, executants, witnesses, identifiers, heirs, co-owners, borrowers and other persons named in the Documents |
| Personal Data | Names, guardian names, ages, addresses, land holdings, Aadhaar and PAN numbers as printed, signatures and photographs on the Documents |
| Purpose | Reading the Documents, searching Public Records and courts, and preparing Reports for your matter |
| Duration | As long as you use the Service, then as section 7 says |
Your duties as Data Fiduciary
2.1 You decide why the data is processed, and you have a lawful basis to share it with us (for example your client's consent or instructions, or a legitimate use under s.7).
2.2 You give the Data Principals any notice the law requires, and you answer their requests. We help you (section 5).
Our duties as Data Processor
3.1 We process the data only to provide the Service to you and on your documented instructions (these Terms and your settings are those instructions). We do not use it for our own purposes, except that, if you switch on model improvement, we may use de-identified data under Terms section 10.3.
3.2 Our staff and contractors who can see the data are bound to confidentiality.
3.3 We keep reasonable security safeguards (s.8(5)), described at https://www.bhoomiscan.in/security.
Sub-processors
4.1 You authorise the Sub-processors listed at https://www.bhoomiscan.in/subprocessors. We bind each to data-protection terms no weaker than this Addendum and remain responsible for them.
4.2 We give you notice of a new Sub-processor before it receives your data (at least 30 days under a Master Services Agreement). You may object on reasonable grounds; if we cannot accommodate the objection, you may stop using the affected service and get a refund of prepaid fees for it.
Helping you meet your duties
5.1 If a Data Principal contacts us about data you uploaded, we pass the request to you without delay and do not answer it ourselves unless you ask us to.
5.2 You can access, correct, export and delete your Documents and Reports from your Account. We help with anything you cannot do yourself.
Personal Data Breach
We tell you without undue delay, and in any case within 24 hours of becoming aware, of a Personal Data Breach affecting your data, with what we know and what we are doing, so that you can meet your own duty to inform the Data Principals and the Data Protection Board of India. We help you with the detailed report the DPDP Rules require within 72 hours.
Deletion and return
7.1 Document files and their OCR text are deleted 90 days after upload. You may delete earlier from your Account.
7.2 When you close your Account, you may first download your Reports. We then delete your data on the Privacy Policy schedule, except what a law requires us to keep.
Audit
On reasonable written notice, and no more than once a year unless a breach or a regulator requires it, we answer your written questions about our safeguards and give you the evidence we reasonably can. Institutional Users have the wider audit and regulator-access rights in their Master Services Agreement.
Cross-border processing
Some Sub-processors process data outside India, as listed. We do not transfer data to a country the Central Government has restricted under s.16.