Data processing agreement

1. Roles

You (the customer) are the controller of the personal data you enter into Sevo Biz App - your staff, your customers, your suppliers. WEB DESIGNS LANKA is the processor and processes it only on your instructions, which are the features of the product as documented.

2. What we process

Names, e-mail addresses and phone numbers of your users, customers and supplier contacts; transaction records (sales, purchases, payments); device identifiers of registers; audit entries of who changed what.

3. Sub-processors

• Amazon Web Services - hosting, storage, authentication (Amazon Cognito), e-mail; AWS Asia Pacific (Singapore)
• Neon - managed PostgreSQL database; same region
• PayHere - card payments for your subscription (we never receive card numbers)

We tell you at least 30 days before adding a sub-processor that would handle your data.

4. Security

Encryption in transit and at rest; each company's data isolated at the database level; role-based access with an audit log; least-privilege access for our staff, used only for support you ask for or to keep the service running.

5. Assistance, deletion and return

You can export reports and lists from the product, and we provide a full copy of your data on request. On termination, data is kept for 90 days so you can return or export it, then deleted. We assist with data-subject requests that you cannot fulfil through the product yourself.

6. Incidents

We notify you without undue delay, and at the latest within 72 hours, of a personal-data breach affecting your data.

7. Governing law

This agreement forms part of the Terms of service and, like them, is governed by the laws of Sri Lanka, with disputes decided by the courts of Sri Lanka.