Data processing terms

Roles

For your buyers’ personal data (names, phone numbers, addresses, order and chat history), you are the data fiduciary under the Digital Personal Data Protection Act, 2023: you decide why and how it is used. LyteCart is your data processor and handles it only for you. These terms are part of our Terms.

What is processed

Your instructions

We process buyers’ data only on your documented instructions, which are these terms and what you do in the app. We tell you if an instruction would break the law. You are responsible for having a lawful purpose and any notice and consent your buyers need, and for telling them how their data is used.

Security

• Each shop’s data is separated at the database level; one seller cannot see another’s.
• Channel, courier and payment keys are encrypted; passwords are salted hashes; traffic is encrypted in transit; backups are encrypted.
• Staff can see only counts, unless you approve time-limited, logged access.
• We keep access and change logs and review them.

Our staff

Everyone at LyteCart who can reach personal data is bound by confidentiality and given only the access their work needs.

Helpers we use

We use the providers listed on the Privacy page (hosting, storage, email, SMS, payments, AI model). They are under contract to protect the data and use it only for their part. We stay responsible for them. We tell you in the app before adding a provider that handles buyers’ data; you may object and, if we cannot meet your objection, close your account.

Requests from buyers

If a buyer asks us directly for access, correction or erasure, we send them to you and help you answer. You can export and edit data in the app, and write to us from Help for erasure of a buyer’s details.

Breaches

We tell you without undue delay after we find a breach of personal data we hold for you, with what we know, and help you meet your own duty to inform the Data Protection Board and affected people.

Deletion and return

You can download your data at any time. We erase it 90 days after a pause, and one year after you close your account (for those 12 months nobody can sign in, and for the first 30 days the owner can reopen it; we keep the year because the DPDP Rules require us to retain some personal data and logs for one year), except records the law requires us to keep (GST records, 8 years) and encrypted backups that expire on their own cycle. On request we confirm the erasure in writing.

Reviewer (lawyer): check against the DPDP Rules’ one-year log retention and confirm the deletion timeline.

Proof and audits

On reasonable written request we give you what you need to check that we follow these terms, and let you, or an auditor bound by confidentiality, review it once a year, or after a breach, at your cost and without disturbing other sellers.

Questions: see Contact.