Data processing agreement
Last updated 2026-09-22
Draft — the company details, sub-processor list and governing-law clause are placeholders until the company registration and the owner's decisions are final (docs/26). Do not rely on this text yet.
1. Roles
You (the customer) are the controller of the personal data you enter into Sevo ERP — your staff, your customers, your suppliers. WEBDESIGNS LANKA is the processor and processes it only on your instructions, which are the features of the product as documented.
2. What we process
Names, e-mail addresses and phone numbers of your users, customers and supplier contacts; transaction records (sales, purchases, payments); device identifiers of registers; audit entries of who changed what.
3. Sub-processors
- Amazon Web Services — hosting, storage, authentication (Amazon Cognito), e-mail; AWS Asia Pacific (Singapore)
- Neon — managed PostgreSQL database; same region
- PayHere — card payments for your subscription (we never receive card numbers)
We tell you at least 30 days before adding a sub-processor that would handle your data.
4. Security
Encryption in transit and at rest; each company's data isolated at the database level; role-based access with an audit log; least-privilege access for our staff, used only for support you ask for or to keep the service running.
5. Assistance, deletion and return
You can export your data from the product at any time. On termination, data is kept for 90 days so you can return or export it, then deleted. We assist with data-subject requests that you cannot fulfil through the product yourself.
6. Incidents
We notify you without undue delay, and at the latest within 72 hours, of a personal-data breach affecting your data.
7. Governing law
As in the Terms of service (Sri Lanka). to be confirmed