Data Processing Terms

#1. Scope and roles

These Data Processing Terms (“DPA”) are part of the Terms of Service between you (“customer”) and Abhishek DG, trading as 2090.tech (“we”). They apply to personal data in customer data: what you and your tools put in your Chronos databases, and your app users’ data held by Chronos Auth.

For customer data, you decide why and how it is processed (you are the data fiduciary under India’s DPDP Act, and the controller under the GDPR), and we process it only for you (data processor). For our own account data about you, see the Privacy Policy.

#2. The processing

#3. Your instructions

• We process customer data only on your documented instructions: these Terms, and what you and your tools do through the service (queries, settings, merges). We don’t process it for our own purposes.
• If we believe an instruction breaks data protection law, we tell you. If the law requires us to process customer data otherwise, we tell you first unless the law forbids it.
• You are responsible for having a lawful basis for the processing and for telling your data subjects about it.

#4. Confidentiality

Anyone we let access customer data is bound to keep it confidential, and accesses it only as needed to run, secure or support the service, or where the law requires.

#5. Security

We keep appropriate technical and organisational measures, including:

• encryption in transit (TLS, required for Postgres connections);
• separate processes, files and credentials per database;
• credentials stored as hashes; secrets we must use again encrypted with AES-256-GCM;
• Chronos Auth passwords hashed with Argon2id, refresh tokens rotated, failed sign-ins throttled;
• backups kept apart from the database, for the plan’s backup period;
• access to production limited to what running the service needs.

You are responsible for the security of what you control: your credentials, who you give access to, your agents’ permissions and merge policies, and your apps.

#6. Subprocessors

• You authorise us to use subprocessors to provide the service: providers of cloud hosting and storage, website hosting, DNS and network security, sign-in and identity, and email delivery.
• The current list of subprocessors by name is available on request to legal@2090.tech.
• We bind each subprocessor to data protection terms no less protective than these, and we remain responsible for their performance.
• We give notice of a new subprocessor at least 15 days before it processes customer data. You may object on reasonable data protection grounds by writing to legal@2090.tech; if we can’t address the objection, you may stop using the affected part of the service.

#7. Helping you

• Most requests from your data subjects (to see, correct or delete their data) you can carry out yourself with the service: SQL, the dashboard, and Chronos Auth’s user management. Where you can’t, we help, as far as reasonably possible.
• We forward to you any request we receive from your data subjects, and don’t answer it ourselves unless you ask us to or the law requires.
• We give reasonable help with your security, impact assessments and consultations with authorities, as they concern our processing.

#8. Personal data breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to customer data, we notify you without undue delay, and within 72 hours where feasible, with what we know: what happened, the data and people affected, its likely consequences, and what we are doing about it. We keep you updated as we learn more, and help you meet your own notification duties, including to the Data Protection Board of India.

#9. Transfers

Customer data may be processed in India and in other countries where we and our subprocessors operate. Transfers follow the law that applies to them; for personal data of people in the EU or UK, with safeguards such as the European Commission’s standard contractual clauses.

#10. Return and deletion

• You can export customer data at any time over Postgres (for example with pg_dump) or the dashboard.
• When you delete a project, its database is deleted at once, and its backups when their period ends. When your account ends, we delete remaining customer data within 30 days, and backups as their period ends, unless the law requires us to keep it.

#11. Information and audits

We make available the information reasonably needed to show we meet this DPA, in writing, on request to legal@2090.tech. Where that isn’t enough and the law requires it, you may audit our compliance with reasonable notice, at your cost, no more than once a year, in a way that protects other customers’ data and our security.

#12. Liability and order

Each party’s liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict about personal data, this DPA prevails.