Data Processing Addendum
1. Roles
You (the Marketplace Operator) are the Data Fiduciary of personal data of your customers, organisers and staff held in your marketplace. Ironbay Innovations Pvt Ltd (10mins) is your Data Processor.
2. What we do with it
We process that data only to provide the software and hosting to you, to keep it secure, and as you instruct through the panel and these terms. We do not use it for our own marketing, sell it, or use it to train AI models. Aggregated, non-identifying statistics may be used to run and improve the service.
3. Security
We keep it secure with encrypted connections, hashed passwords, separation between marketplaces, access controls and logging that are reasonable for this kind of service.
4. Service providers
We use providers for hosting, storage, notifications, email and payments infrastructure, bound by confidentiality and security duties. You authorise their use. We remain responsible for their handling of your data.
5. People's requests and breaches
We will help you to respond to people's requests to access, correct or erase their data, using the tools in the panel (customers can download and delete their own data in the app). We will tell you without undue delay, and in any case within 48 hours, after we become aware of a breach of your data, with what we know, so that you can meet your own duty to inform the affected people and the Data Protection Board of India.
5A. Children and sub-processors
You are responsible for obtaining verifiable parental consent where your marketplace processes a child's data. We process such data only as you instruct. Our current sub-processors are listed on the Sub-processors page of the 10mins website; we will update that page before adding or replacing one, and you may object by writing to contact@10mins.co within 14 days.
6. Your responsibilities
You must have a lawful basis and any consents needed for the data you collect, publish an accurate privacy policy, and give us only data you may lawfully give us.
7. Return and deletion
When this agreement ends we will make your data available for export for a reasonable period and then delete it, except where the law requires us to keep it, in which case we keep only what is required and keep protecting it.
8. Audits
On reasonable notice, and no more than once a year unless a breach has occurred, we will give you information reasonably needed to confirm we are meeting this addendum.