Data Processing Addendum
How we handle
your customers' data.
DPDPA-compliant. Plain English. The standing version your auditor or CA can read instead of a signed contract.
1. The parties
Kenro is a product of TUD Innovations (OPC) Private Limited ("Kenro", "we"). When you use Kenro Dealership to run your showroom, you are the Data Fiduciary under DPDPA 2023; we are your Data Processor for the customer, vehicle, lead, booking, loan, insurance and RTO records you enter. This DPA sets out how we handle that data on your behalf.
2. What we process and why
We process the personal data you put into Kenro — customer name, phone, email and address, identity documents such as Aadhaar and PAN where you record them, vehicle and RC details, loan and insurance papers, photos, and payment records — solely to provide Kenro Dealership to your showroom. When your staff use the built-in assistant, the records needed for an answer are sent to our AI model provider to produce it. We do not use your customers' data for marketing, profiling, or AI training. We do not sell or rent it to anyone.
3. Sub-processors we use
We use a small number of service providers to run Kenro Dealership: cloud hosting and database services in India (Mumbai), transactional email, messaging services for SMS or WhatsApp where you turn them on, and an AI model provider for the built-in assistant. Each is bound by its own data-processing terms, consistent with this one. The current list for your installation is available on request, and we tell you in writing before we add or replace one.
4. Where data is stored
Your installation has its own separate database, stored in India (Mumbai). Backups are taken daily, encrypted at rest and retained for 7 days. Documents and photos are stored privately — a public link is created only when you choose to share one, such as a car's listing.
5. Security measures
Encryption in transit (TLS 1.2+) and at rest. Each dealership runs on its own separate installation and database, so no other business can reach your data. Inside it, access is set per person by role, branch and module, and an audit trail records who created, changed or deleted each record. Access to production data is restricted to a small team with 2FA enforced.
6. How long we hold data
Your records: for as long as your subscription is active, then as set out in section 10. Records the law requires to be kept, such as tax records: for the period the law sets. Audit trail: kept with your records. Backups: retained for 7 days, then replaced.
7. Customer rights (DPDPA §11–14)
Your customers can ask you for a copy of their data, ask for corrections, or ask you to delete it. In Kenro Dealership you can correct or delete a record and export your records as CSV files. Where a request needs more than that, such as removing a person completely, email hello@usekenro.com and we carry it out on your instructions.
8. Breach notification
If we become aware of a personal data breach affecting your customers, we notify you within 24 hours of detection so you can meet the 72-hour DPDPA reporting window. Our internal runbook documents containment, assessment, and notification steps. Director's email is the contact point.
9. Audits
Once a year, you may request a written summary of our security posture and any audits we've completed. For multi-branch dealers and dealer groups, we'll work with your auditors directly under NDA. We don't expose source code or production access.
10. Termination + data return
If your subscription ends, there is a 15-day grace period; after it, Kenro Dealership goes read-only and you can read and export your data at any time for 12 months. We remind you before that period ends. After it, we permanently delete your data from our active systems, except records the law requires us to keep; encrypted backups age out within 7 more days.
11. Liability + governing law
Liability for data-handling claims is limited to the amount you paid us in the 12 months prior to the claim, except in cases of gross negligence or wilful misconduct. Governing law: Republic of India. Jurisdiction: Delhi.
12. Signing this
For most showrooms, this published DPA is sufficient — using Kenro Dealership means accepting it. If your auditor or CA needs a counter-signed copy with your business's name on it, email hello@usekenro.com with your business's legal name and GSTIN.