These terms form part of our Terms of Service. They apply whenever Media Sathi processes personal data of your customers on your behalf, for example the people who message your business through Booking Sathi.
1. Roles
You (the client) are the Data Fiduciary. BVTL INFOTECH ("Media Sathi") is your Data Processor under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
2. Your instructions
We process your customers' personal data only to provide the services and as you instruct. Your settings and configuration in Booking Sathi count as your instructions. If we believe an instruction breaks the law, we will tell you.
3. Your responsibilities
You are responsible for having a lawful basis and any needed consent for the data, for giving your customers a privacy notice, and for answering their requests about their data.
4. Our team
Only people who need access to provide the service can see your data, and they are bound by confidentiality.
5. Security safeguards
- Encryption of data in transit (HTTPS/TLS).
- Encrypted storage of access tokens and secrets.
- Role-based access control and unique logins for each team member.
- Access logs that are reviewed and kept for at least one year.
- Regular backups and a tested restore process.
- Regular security updates to our servers and software.
6. Sub-processors
You allow us to use these sub-processors: Meta Platforms (WhatsApp Business Platform), our cloud hosting provider, our AI model provider (only for the AI chatbot add-on), Razorpay (payment links) and our email provider. We bind each one to data protection duties at least as strong as these. We will tell you 15 days before adding or replacing a sub-processor, and you may object. A current list is available on request at info@mediasathi.in.
7. Personal data breach
If we become aware of a personal data breach affecting your data, we will tell you without undue delay and within 24 hours, with the details you need to inform affected people and the Data Protection Board of India.
8. Helping with requests
We will help you respond to your customers' requests to access, correct or erase their data, and to withdraw consent.
9. Transfers outside India
You allow your data to be processed by our sub-processors outside India, only as permitted by the DPDP Act and never in a country restricted by the Government of India.
10. End of service
When your service ends, we will give you an export of your data on request within 30 days, then delete it from our systems, except where the law requires us to keep it.
11. Information and audits
We will give you the information reasonably needed to show that we follow these terms. You may request one audit a year, with 30 days' notice, at your cost.