Draft, not yet in force. This page is being reviewed and will apply once it is published with a date.

This agreement forms part of the Terms of Service between Raysho OPC Private Limited (One Person Company) ("Raysho", the processor) and the customer (the controller). It applies whenever Raysho processes personal data for the customer in providing Paralleon CRM, and needs no separate signature. Where it conflicts with the Terms on personal data, it wins.

1. What is processed

• Subject matter and duration: providing Paralleon CRM, for as long as the customer's account lasts and until the data is deleted under section 9.
• Nature and purpose: hosting, storing, syncing, displaying, searching, summarising (where AI is on), sending what the customer confirms, backing up and supporting.
• Data subjects: the customer's people, and the customer's contacts, prospects and other people whose data the customer keeps or syncs.
• Personal data: names, contact details, job and company details, notes and activity, email and calendar content and metadata, and any other data the customer chooses to store. The customer should not store special-category data unless the law allows it.

2. Raysho's duties (GDPR Article 28(3))

• Process personal data only on the customer's documented instructions, which are these terms and the customer's use of the service, unless the law requires otherwise; in that case Raysho tells the customer first unless the law forbids it.
• Make sure everyone who can reach the data is bound to confidentiality.
• Keep the security measures in the annex below.
• Use sub-processors only under section 5.
• Help the customer answer requests from data subjects, as far as the service allows.
• Help the customer with security, breach notification, impact assessments and consultation with authorities, taking into account the information Raysho has.
• Delete or return the data at the end, under section 9.
• Make available the information needed to show compliance, and allow audits under section 8.
• Tell the customer at once if it believes an instruction breaks data-protection law.

3. The customer's duties

The customer is responsible for the lawfulness of the data it gives Raysho and of its instructions, including having a lawful basis and giving notice to the people concerned, especially prospects it contacts.

4. Breach notification

Raysho tells the customer without undue delay, and in any case within 48 hours, after becoming aware of a breach of security affecting the customer's personal data. The notice says what happened, the data and people affected, the likely consequences and what is being done, and Raysho updates it as more is known. This lets the customer meet its own duties under the GDPR, PIPEDA and its breach-of-security-safeguards rules, India's DPDP Act and other laws.

5. Sub-processors

• The customer authorises the sub-processors listed on Sub-processors.
• Raysho gives at least 30 days' notice by email to account owners, and on that page, before adding or replacing one. The customer may object on reasonable data-protection grounds within that time; the parties will discuss it in good faith, and if they cannot agree, the customer may end the affected service and receive a pro-rata refund of prepaid fees.
• Each sub-processor is bound by a written contract with duties at least as protective as these. Raysho remains responsible for its sub-processors.

6. International transfers

• Where personal data subject to the GDPR goes from the customer to Raysho in a country without an adequacy decision, the European Commission's standard contractual clauses (Decision 2021/914) apply and are incorporated by reference: Module 2 (controller to processor) between the customer and Raysho, and Module 3 (processor to processor) between Raysho and its sub-processors.
• In those clauses: clause 7 (docking) applies; under clause 9, option 2 (general authorisation) applies with the notice period in section 5; the optional wording in clause 11 does not apply; clauses 17 and 18 choose the law and courts of Ireland; Annex I is section 1 of this agreement; Annex II is the annex below; Annex III is the sub-processor list.
• For data subject to UK law, the UK International Data Transfer Addendum (version B1.0) applies alongside, with the same choices; for Swiss data, the clauses apply with the Swiss authority and law in place of the EU ones.

7. United States (CCPA) terms

Where the California Consumer Privacy Act applies, Raysho is a service provider. Raysho will not sell or share the personal data; will not retain, use or disclose it for any purpose other than providing the service, including outside the direct business relationship with the customer; will not combine it with other data except as the law allows; will comply with the CCPA and give the same level of protection; will tell the customer if it can no longer meet these duties; and passes these duties on to its sub-processors. The customer may take reasonable steps to stop unauthorised use.

8. Audits

Raysho answers reasonable written security questionnaires once a year, and makes available the information needed to show it meets this agreement. Where that is not enough, or an authority requires it, the customer may audit, with 30 days' notice, at its own cost, in working hours, under confidentiality, without access to other customers' data.

9. Deletion or return at the end

While the account is open the customer can export all its data. When it ends, the customer has 30 days to export, then Raysho deletes the customer's personal data, with backups following within 30 days, unless the law requires it to keep some.

10. India (DPDP Act)

For personal data under India's Digital Personal Data Protection Act 2023, the customer is the data fiduciary and Raysho the data processor, and this agreement is the valid contract under which Raysho processes data on the customer's behalf. Raysho keeps reasonable security safeguards (the annex), tells the customer of any personal data breach as section 4 says, helps the customer answer the requests of data principals and its grievance process, and erases the data as section 9 says.

Annex: security measures

Encryption

TLS 1.2 or later for all traffic; the database and stored files encrypted at rest (AES-256); mailbox access tokens encrypted again with a separate key (AES-256-GCM).

Access and isolation

Every request checks workspace membership and scopes the query to that workspace; owner and member roles; sessions end after 7 days without use; rate-limited sign-in; staff access only for support or operations, and logged.

Availability and recovery

Nightly backups per workspace, kept 30 days; providers' redundant infrastructure.

AI safeguards

Mail reaches AI only where an owner allows it; mail is marked as untrusted text; summaries and drafts have no tools; the assistant only reads within the workspace and cannot send or change anything without a person's click; no training on customer content.

Logging and change control

Audit events for sign-ins, settings, connected apps and members; automated tests on every change, including tests that one workspace cannot reach another's data.

People

Confidentiality duties for everyone with access; access removed when no longer needed. Security contact: contact.us@paralleon.com. Privacy contact: contactus@raysho.ai.