Data Processing Terms
These terms govern how Microlevel Solution ("MICROLEVEL", "Processors", "we") processes the personal data of your leads, clients and contacts ("Data Subjects") on your behalf ("Data Controller") when you use the Service. They apply in addition to the Terms of Service.
1. Scope of processing
We process personal data as instructed by you (as Data Controller) for:
- Storing lead and client records in your workspace
- Sending and receiving WhatsApp messages on your behalf via Meta Cloud API
- Sending email campaigns and transactional notifications on your behalf
- Generating GST invoices, statements, and payment reminders
- Running AI lead scoring and workflow automation on your data
2. Your instructions
You are responsible for ensuring you have a lawful basis (consent, contract, or other legal basis under the DPDP Act) to process the personal data of your leads and clients for the purposes above. We process data on documented instructions that you configure in the Service (campaign settings, workflow rules, consent fields on public forms).
3. Sub-processing
We use the subprocessors listed in the Sub-processor List to deliver the Service. Data processed by subprocessors is subject to the same confidentiality obligations we owe you.
4. Security
We implement administrative, technical, and physical safeguards commensurate with the risk of the processing, including: TLS in transit, AES-256 at rest, role-based access control, tenant isolation, audit logging of data access and send actions, and vulnerability management.
5. Data subject rights
If a Data Subject (your lead or client) contacts you to exercise access, correction, or erasure rights, you may request assistance from us to respond. We will assist within the timeframe required by the DPDP Act, and you remain responsible for providing the response to the Data Subject.
6. Breach notification
If we become aware of a personal data breach affecting your data, we will notify you without unreasonable delay and provide the information required to assess and respond to the breach.
7. Return and deletion
Upon termination of the Service, we will delete all personal data within 30 days, except where retention is required by law. We will provide a deletion certificate on request.