Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms an integral part of the 99Broker Terms & Conditions, Privacy Policy, and all agreements executed through the 99Broker Platform.

This DPA governs the processing of Personal Data by 99Broker, a product of 99Yard – A Unit of Rudra Group ("Company", "99Broker", "Platform", "we", "our", or "us") on behalf of Brokers, Buyers, Sellers, Owners, Team Members, Organizations, and other Users ("User", "Controller", or "Customer").

This Agreement shall apply whenever the Platform processes Personal Data in connection with services provided through 99Broker.

01 Purpose

The purpose of this DPA is to define the responsibilities of the Parties regarding Personal Data, ensure lawful processing, protect the rights of Data Principals, allocate responsibilities, establish security standards, and support compliance with applicable privacy and data protection laws.

02 Definitions

Personal Data: Any information relating to an identified or identifiable individual, including: name, mobile number, email address, address, property ownership information, identity documents, location data, financial information, communication records, preferences, and uploaded documents.

Data Principal: The natural person to whom Personal Data relates.

Data Fiduciary: The person or organization determining the purpose and means of processing Personal Data under applicable law.

Data Processor: A person or organization processing Personal Data on behalf of another.

Processing: Any operation performed on Personal Data, including collection, storage, retrieval, consultation, use, disclosure, transmission, deletion, and destruction.

Security Incident: Any actual or reasonably suspected unauthorized access, use, disclosure, loss, alteration, or theft of Personal Data.

03 Relationship of the Parties

For Customer Data stored within the Platform, the Broker or Organization generally acts as the Data Fiduciary (Controller) for its client information. 99Broker acts primarily as a Data Processor by processing such data on behalf of the Broker.

For Personal Data relating to Platform Accounts, billing, authentication, security, fraud prevention, and legal compliance, 99Broker may act as an independent Data Fiduciary to the extent permitted by law.

04 Categories of Personal Data

The Platform may process User Account Data (name, mobile, email, photo), Client Data (buyer, seller, tenant info), Property Data (address, GPS location, media, documents), Communication Data (follow-ups, notes, messages), and Technical Data (device, IP address, logs).

05 Purpose of Processing

Personal Data may be processed solely for account creation, authentication, CRM management, property/client management, site visits, AI assistance, support, security, fraud prevention, regulatory compliance, and service improvements.

06 Instructions from the Customer

99Broker shall process Customer Data only in accordance with this Agreement, the Customer's documented instructions, as necessary to provide the Platform, or as required by applicable law.

07 Confidentiality

The Company shall ensure that persons authorized to process Personal Data are subject to confidentiality obligations, receive appropriate training, and access Personal Data only where necessary for their duties.

08 Security Measures

The Company implements commercially reasonable technical and organizational measures, including encryption in transit, encryption at rest where practicable, role-based access control, multi-factor authentication for privileged access, backups, audit logging, and incident response procedures.

09 Customer Responsibilities

The Customer remains responsible for lawfully collecting Personal Data, obtaining required consents, verifying data accuracy, managing user permissions within their organization, and responding to Data Principal requests.

10 Sub-processors

The Company may engage trusted third-party service providers (Sub-processors) to assist in providing cloud infrastructure, authentication, email/SMS delivery, AI features, mapping, payment processing, or analytics. Sub-processors are contractually required to protect Personal Data appropriately.

11 International Processing

Where necessary for the operation of the Platform, Personal Data may be processed or stored outside the User's state or country, subject to applicable legal requirements and safeguards.

12 Data Subject Requests

Where the Company receives a request from a Data Principal relating to Customer Data, the Company may refer the request to the Customer or assist the Customer in responding, where reasonably practicable.

13 Security Incident Notification

In the event of a confirmed Security Incident affecting Customer Data, the Company shall notify the affected Customer without undue delay after becoming aware of the incident, where required by law.

14 Data Retention

The Company shall retain Customer Data only for the duration necessary to provide the services, as instructed by the Customer, as required by law, or for backup, audit, security, and dispute resolution.

15 Data Deletion and Return

Upon termination of the account, and subject to legal/audit/regulatory exceptions, the Company shall delete Customer Data or return it in a commonly used format if requested within a reasonable period.

16 Audit Rights

Where reasonably necessary and subject to confidentiality safeguards, the Customer may request information demonstrating compliance. The Company satisfies such requests through documentation and summaries.

17 Artificial Intelligence Processing

AI processing is limited to providing Platform features. AI outputs do not constitute professional advice, and the Company does not guarantee the accuracy of AI-generated content.

18 Data Ownership

Customer Data remains the property of the Customer or the relevant Data Principal. The Company receives only the limited rights necessary to host, process, back up, and transmit data to provide the Platform.

19 Compliance with Law

The Parties agree to comply with applicable data protection laws, including the Digital Personal Data Protection (DPDP) Act 2023, Information Technology Act 2000, and other applicable rules.

20 Limitation of Liability

Liability under this DPA shall be governed by the limitation of liability provisions contained in the 99Broker Terms & Conditions, except where applicable law provides otherwise.

21 Governing Law

This DPA shall be governed by the laws of India. Subject to arbitration and mandatory provisions, Shimla, Himachal Pradesh, India shall have exclusive jurisdiction over disputes.

22 Electronic Acceptance

This DPA may be accepted electronically (OTP verification, secure logins, signatures, or checkboxes). The Platform maintains audit logs of acceptance including timestamps, versions, IP addresses, and device info.

23 Contact Information

99Broker (99Yard, a Unit of Rudra Group)
📍 Office # 9, Second Floor, Padamdev Complex, Ridge, Shimla -171001 (H.P.), India
📞 +91 78070-95953 • +91 70182-01049
✉️ admin@rudragrup.com

User Acknowledgement

By clicking "I Agree", creating an account, completing OTP verification, or using the Platform, you acknowledge that you have read, understood, and voluntarily accept this Data Processing Agreement, and authorize data processing as described herein.