Luit Infotech maintains security controls designed to protect customer data against unauthorized access, disclosure, alteration, or destruction.

Security controls may include:

• Role-based access control
• User authentication
• Audit logging
• Data backup procedures
• Access monitoring
• Network security controls
• Infrastructure security
• Disaster recovery procedures
• Change management controls

Security practices are reviewed periodically to address evolving threats and business requirements.

LuitBiz cloud environments are hosted on enterprise-grade infrastructure designed to provide:

• High availability
• Data resilience
• Security monitoring
• Backup capabilities
• Disaster recovery support

Customer data may be processed within approved infrastructure locations necessary for service delivery.

Luit Infotech may engage trusted third-party service providers ("Subprocessors") to support service delivery.

Examples may include:

• Cloud infrastructure providers
• Backup service providers
• Email delivery providers
• Customer support platforms
• Security monitoring providers

Luit Infotech remains responsible for ensuring that subprocessors maintain appropriate data protection obligations.

Where personal data is transferred across jurisdictions, Luit Infotech will implement reasonable safeguards designed to support applicable privacy and data protection requirements.

Such safeguards may include:

• Contractual protections
• Technical controls
• Security measures
• Regulatory compliance mechanisms

Where applicable, Luit Infotech will provide reasonable assistance to Customers in responding to requests relating to:

• Access requests
• Correction requests
• Deletion requests
• Restriction requests
• Portability requests
• Objection requests

Customers remain responsible for managing and responding to requests from their users and data subjects.

In the event of a confirmed security incident affecting customer personal data, Luit Infotech will:

• Investigate the incident
• Take reasonable remediation measures
• Notify affected customers without undue delay where legally required
• Provide relevant information reasonably available at the time

Notification timing may vary depending on the nature and severity of the incident.

Customer data will be retained only as necessary to:

• Provide services
• Meet contractual obligations
• Comply with legal requirements
• Support disaster recovery and backup processes

Upon termination of services and subject to applicable agreements:

• Customer data may be returned to the customer where technically feasible
• Data may be securely deleted according to established retention schedules
• Certain records may be retained where required by law

Customers may request information reasonably necessary to evaluate:

• Security controls
• Data protection practices
• Compliance commitments

Luit Infotech may satisfy such requests through:

• Documentation
• Security questionnaires
• Compliance information
• Vendor review processes

Customers are responsible for:

• Determining lawful grounds for processing
• Obtaining required consents
• Managing user permissions
• Configuring data retention settings
• Ensuring compliance with applicable laws
• Responding to data subject requests

Luit Infotech cannot determine the legality of customer data processing activities.

Luit Infotech may update this DPA periodically to reflect:

• Changes in legal requirements
• Product enhancements
• Security improvements
• Operational changes

Updated versions will be published on this page with a revised effective date.

Liability relating to data processing activities shall be governed by applicable contractual agreements, Terms of Service, and applicable laws.

Nothing in this DPA expands liability beyond limitations otherwise agreed between the parties.

For questions regarding data processing, privacy, security, or compliance matters, please contact:

Luit Infotech Pvt. Ltd.

Email: sales[AT]luitinfotech.com

Website: https://www.luitbiz.com