Who you are contracting with, what we owe each other, and which duties the Act leaves with you whatever this document says.
Expertinasia Pvt. Ltd., a company incorporated in India. RuleExpert is our product. Registered contact: 302 Shagun Arcade, Rasoma Lab Square Rd, Vijay Nagar, Indore, Madhya Pradesh 452010, and C/56/35 C Block, Phase 2, Sector 62, Noida, Uttar Pradesh 201309.
The organisation named in the order form or subscription, and the people it authorises to use the platform. Where an individual accepts these terms on behalf of an organisation, they confirm they are entitled to bind it.
These terms and conditions cover the platform, the free Scorecard, and this website. Consulting and managed services are scoped in a separate written statement of work, which prevails over this page where the two differ.
This is the part that decides who answers a data principal, who tells the Board about a breach, and who carries a penalty. It is not something either of us can move by agreement.
For the personal data you put into the platform — your patients, customers, employees — you decide why and how it is processed, so the Act makes you responsible for it. That includes giving notice, obtaining valid consent, answering rights requests, and reporting breaches.
We are a Data Processor in the Act’s own words — Section 2(k) — processing that data only on your documented instructions, under this contract, as Section 8(2) requires. We do not decide the purpose, we do not use it for our own ends, and we do not share it except as you instruct or the law compels.
Section 8(1) makes the Data Fiduciary responsible for complying with the Act irrespective of any agreement to the contrary, including for processing done by a processor on its behalf. We say this in our own terms because a customer who believes otherwise is exposed, and because any vendor implying it could take that duty off you is telling you something the Act does not allow.
What we do carry is our own conduct as a processor: the safeguards under Section 8(5), telling you without delay if something happens on our side so your own clocks can start, and giving you what you need to answer a data principal within your deadline.
Nothing on this site, in the platform, in the Scorecard, or in a consultation is legal advice, and no advocate-client relationship arises from using any of it. We build software and run compliance operations. Where an answer turns on interpretation, we will say so and tell you to put it to your counsel — and we would rather lose an argument that way than win it wrongly.
It scores what you tell it. A self-assessment can only report what you already know about, which is the wrong instrument for finding what you have forgotten. The score, the risk band and the rupee exposure are indicative — useful for prioritising, not a prediction of what the Board would do. Actual penalties are at the Board’s discretion under the Act’s Schedule.
Sensible. Our data processing agreement is available on request, and your counsel is welcome to mark it up before anything is signed.
Availability targets, support response times and any committed uptime are set in your order form or statement of work. We do not promise uninterrupted service on this page, because a number written here that your contract does not carry would be worth nothing.
As set out in your order form, exclusive of taxes, payable per the agreed schedule. The Scorecard is free and stays free.
The subscription runs for the period in your order form and renews only as that document provides. We will not auto-renew a term you were not told about.
Either of us may end the contract for material breach not remedied within a reasonable notice period, and as otherwise agreed in writing.
On termination you can export your data, and we delete or return what remains on your instruction, subject to anything a law requires either of us to keep. Your audit trail is yours — the point of building it was that you can produce it later.
We own the platform and everything in it that is ours. You own your data and the records you create with it. Where we produce a deliverable in a service engagement, the material stays with you — the point is that you can run it without paying us to come back.
Each of us keeps the other’s confidential information confidential, uses it only for the purpose it was shared for, and protects it at least as carefully as our own.
Limits and exclusions are set in your order form or statement of work, and nothing in any of it excludes liability that cannot lawfully be excluded — including under the DPDP Act, where the Board’s penalties fall where the Act puts them regardless of what we agree between us.
These terms are governed by the laws of India, and the courts at Indore, Madhya Pradesh have jurisdiction, unless your order form says otherwise.
We may update these terms; the date at the top changes when we do. Where a change materially affects a live subscription we will tell the customer rather than rely on you noticing.
Yes, for the data in your account, and that surprises people. Section 8(1) makes the Data Fiduciary responsible irrespective of any agreement to the contrary, so the duty to tell the Board and the affected people is yours whoever caused it. What we owe you is speed: telling you without undue delay, with what happened and who is affected, so your own clocks — which under Rule 7 include intimating each affected person without delay and giving the Board full particulars within 72 hours — can actually be met.
Yes, and you should ask every vendor for one. Ours is available on request and your counsel is welcome to mark it up. If a vendor will not show you their processing terms before signature, that is information about the vendor.
For prioritising, yes. As a prediction of what the Board would decide, no, and we label it indicative everywhere it appears for that reason. It scores what you tell it, so it cannot see the system nobody mentioned or the vendor nobody documented — which is exactly why a discovery exercise finds things a questionnaire never will.
You export it, and we delete or return what remains on your instruction. Nothing is held hostage and there is no export fee. The audit trail matters most here: the reason to build evidence as you go is to be able to produce it later, and that stays true after you stop being a customer.
No. A Data Protection Officer is mandatory only for a Significant Data Fiduciary, and must be based in India and answerable to your board — a role a vendor cannot occupy for you. Our DPO-as-a-Service engagement provides the named, reachable person doing the job where you are not an SDF; where you are, we support your DPO rather than replace them.
Real client quotes, attributed by role and sector — we never name a client.
Working across
Ask them now rather than after. We would rather spend an hour on your counsel’s questions than have a clause misunderstood for a year.
Thank you — we have it. Someone will reply by email, usually within one working day.
Nothing else is needed from you. If it is urgent, email tushar@ruleexpert.com and it will reach the same people.
RuleExpert