Data Processing Agreement

The Society decides why and how resident personal data is used, and is therefore the Data Fiduciary under the DPDPA.

RWB processes that data only on the Society's behalf and on its instructions, and is therefore the Data Processor.

RWB acts as a Data Fiduciary only for its own limited purposes — the accounts of the committee members who administer the platform, subscription billing records, and platform security logs.

• Resident and household identity and contact data: name, flat, relationship to the flat, mobile number, email, photograph where uploaded.
• Vehicle data: registration numbers, vehicle type, parking slot allocation.
• Visitor and gate data: visitor name and mobile number, purpose, host flat, entry and exit timestamps, gate photographs where captured, delivery and cab records.
• Financial data: bills raised, amounts due and paid, payment references and receipts. Card and bank credentials are never stored by RWB; they are handled by the payment gateway.
• Staff and workforce data: name, role, shift and attendance records, and where the Society records them, identity and bank details for wage payments.
• Community activity: notices read, forum posts, poll votes, complaints and service tickets raised.
• Technical data: device tokens for notifications, session and audit logs, IP address.

RWB processes the data only to provide, secure and support the platform for the Society, and to comply with law.

RWB does not sell resident personal data, does not use it to train third-party models, and does not use it for its own marketing to residents. Aggregated, de-identified statistics that cannot be linked back to an individual or a specific society may be used to improve the product.

RWB uses the following categories of sub-processor, each bound to confidentiality and security obligations no weaker than these:

• Cloud hosting and managed database infrastructure.
• Payment gateways the Society or platform connects: Razorpay, Cashfree, Stripe, PhonePe, PayU, CCAvenue.
• Notification delivery: push notification services, transactional email, and SMS or WhatsApp providers where the Society enables them.
• AI providers used for optional in-product assistance and translation, on a no-training basis.

• Row-level access control in the database so each society sees only its own records, and each resident only what their role allows.
• Encryption in transit, and encryption at rest for stored payment gateway credentials.
• Least-privilege access for support staff, with access to society data only where needed to resolve a reported issue.
• Audit logging of sensitive reads and of privileged actions such as contact-number reveals, financial approvals and permission changes.
• Rate limiting, session controls and idle timeout on committee and staff accounts.

If RWB becomes aware of a personal data breach affecting the Society's data, it will notify the Society's registered committee contacts without undue delay and, in any case, within 72 hours of becoming aware.

The notice will describe what happened, the categories and approximate number of people affected, the likely consequences and the steps taken. RWB will support the Society in any notification the Society must itself make to the Data Protection Board of India or to affected residents.

Residents exercise their DPDPA rights against the Society. RWB provides the tools that let the Society answer them: access and export of a resident's records, correction of records, erasure requests, and a record of consents and grievances.

If a resident approaches RWB directly, RWB will not act unilaterally on their record; it will direct them to the Society and inform the Society's committee contact.

Personal data is retained while the subscription is active and thereafter for the period stated in the data retention policy, so the Society can export its records.

Time-limited records are cleared earlier by automated retention sweeps — for example gate and visitor logs, notification delivery logs and session records.

At the end of the retention window, RWB deletes or irreversibly anonymises the Society's personal data, except where law requires a copy to be kept (for example tax and invoice records).

Everyone at RWB with access to society data is bound by confidentiality obligations that survive the end of their engagement, and is granted access only to the extent their work requires.

On reasonable written request, and no more than once a year unless a breach has occurred, RWB will provide the Society with information about its processing and security measures sufficient to demonstrate compliance with this DPA. On-site or third-party audits are available to Township and Enterprise societies under a signed agreement.

Data is hosted on infrastructure selected by RWB. Some sub-processors, including notification and AI providers, may process data outside India. RWB only uses providers that are permitted destinations under Indian law and that offer contractual protection for the data.

At any time during the subscription, and during the retention window after it ends, the Society may export its records in a machine-readable format through the platform, or request an export from RWB.

Where this DPA conflicts with any other RWB terms on the handling of resident personal data, this DPA prevails for the accepting Society.