Data processing terms

1.1 These Data processing terms are a schedule to the XoraPro Terms of Service (xorapro.com/legal/terms) and form part of them. When a business agrees to the Terms of Service, it agrees to these terms too, and so do we.

1.2 They are between M/s N.P. Xora Private Limited (Company Registration No. 387740/82/83, PAN 623570591, Ward No. 3, Samakhusi, Kathmandu Metropolitan City, Nepal), called "N.P. Xora", "we" or "us", and each business that has an account on XoraPro, called "the business" or "you".

1.3 They cover one thing: how we handle the information about people that your business puts into XoraPro. The Privacy Policy (xorapro.com/legal/privacy) explains the rest, including what we keep about you as our own customer.

1.4 If these terms and the Terms of Service say different things about how we handle your business data, these terms apply.

• Business data means personal information about any person that your business, or anyone you let into your account, puts into XoraPro or collects through it: your customers, staff, suppliers, guests, students, patients and anyone else in your records, including what visitors send through your public pages. It includes their names, phone numbers, addresses, identity documents, pay, balances, transactions and staff location records.
• Personal information has the meaning given in section 2 of the Individual Privacy Act 2075.
• Your people means the owner, staff, accountant and anyone else who signs in to your business on XoraPro.
• Outside company means a company that is not N.P. Xora and that receives or can reach business data because it helps us run XoraPro. The current ones are listed at xorapro.com/legal/subprocessors.
• Breach means any event in which business data is lost, destroyed, changed, seen or given out without authority, or in which someone without lawful access gains access to it.
• Instructions has the meaning in section 3.3.

3.1 Your business decides. You decide what business data goes into XoraPro, why, which of your people can see it, and how long it stays, within what the law requires.

3.2 We keep it and process it only for you. We store, protect, organise, display, send and otherwise process business data only to provide XoraPro to your business, and only on your instructions. We do not use it for any purpose of our own.

3.3 What counts as your instructions. Your instructions are:

• (1) the Terms of Service and these terms;
• (2) the settings you choose and the features you switch on, for example SMS receipts, electronic billing to the Inland Revenue Department, or the staff clock-in;
• (3) what your people do in XoraPro, for example sending an invoice by email or publishing a shop page; and
• (4) any other written instruction from an owner of your business that is consistent with the Terms of Service.

3.4 What we never do with business data. We do not sell it. We do not use it for advertising. We do not build profiles of your customers or staff for ourselves. We do not use it to help another business. We do not use it to train AI. We do not contact the people in your records for our own purposes.

3.5 If an instruction looks unlawful. If we believe an instruction would break the law of Nepal, we will tell you, and we may decline to carry it out until it is clarified.

3.6 When the law requires otherwise. We give business data to a government body or court only when the law requires it: a written demand from an investigating or prosecuting official, an order of a court, or a written demand from an authorised official (Individual Privacy Act 2075 section 26(1)), or a demand from the Inland Revenue Department about tax records (Value Added Tax Act 2052 section 16(1a)). We check that each demand is lawful and in writing, give only what it covers, keep a record of it, and tell you about it unless the law forbids us. We refuse informal requests.

3.7 Your side. You are responsible for having the right to put business data into XoraPro and use it as you do. That includes obtaining any consent the law requires (Individual Privacy Act 2075 section 12, and Individual Privacy Regulation 2077 rule 5(2) where written approval is needed), telling people what you collect and why (section 23), obtaining a guardian's consent for anyone under 18 (section 33), and giving your staff the notice the Privacy Policy describes before you use the staff clock-in and location record. XoraPro provides tools and notices to help, but it cannot give consent on your behalf.

4.1 Everyone at N.P. Xora who can reach business data, whether an employee, a director or a contractor, is bound in writing to keep it confidential, both while they work with us and after they leave.

4.2 Access to business data is limited to named people who need it for a task, and each of them sees only what that task needs. The tasks are: support you have asked for; keeping the service running; fixing a fault; checking and protecting security; and meeting a legal duty under section 3.6.

4.3 We do not read your messages, listen to calls made in XoraPro, or record them. If support needs to look at a message, we ask the person concerned first, each time (Individual Privacy Act 2075 sections 13, 14 and 19(3)).

4.4 Our people are also bound by the duty of professional confidentiality in section 18 of the Individual Privacy Act 2075: what they learn about a person in the course of their work is not disclosed without consent or lawful order.

4.5 When our people use software tools, including AI tools, to build and maintain XoraPro, those tools are shown only what the task needs.

5.1 We apply reasonable technical and organisational measures to keep business data secret and secure, so that no one without lawful access can reach it (Individual Privacy Regulation 2077 rule 4(2)). Section 9 of the Privacy Policy describes the measures, and we will not reduce the overall level of protection they give during your subscription.

5.2 Among them: every connection is encrypted; every record carries the business it belongs to and every request checks that the signed-in person belongs to that business and has a role allowed to see it; passwords and PINs are stored only as scrambled values; sensitive secrets are stored encrypted; backups are encrypted in Nepal before they leave; and the audit trail is tamper-evident.

5.3 The main copy of your business's books and records is stored in Nepal, at Ncell Axiata Limited's data centre in Pokhara, as the Electronic Billing Procedure 2082 clause 7.2 requires. A read-only standby copy of the database is kept on Amazon Web Services in Singapore. Outside companies abroad receive only what the list at xorapro.com/legal/subprocessors says.

5.4 Security is shared. The Electronic Billing Procedure 2082 clause 8(छ) places the duty to protect a billing business's data and backups on the business and on the software producer together. Our part is set out in this section. Your part is to keep sign-ins private, give each person only the role they need, remove people who leave, switch on two-step sign-in for owners, and tell us at once if you think someone has got into your account.

5.5 XoraPro does not hold, and these terms do not claim, any security certification.

6.1 The list. We use outside companies to run XoraPro. The page xorapro.com/legal/subprocessors names each one, what it does, what business data it receives, the country, and the date we started using it, with a dated change log. By agreeing to these terms you allow us to use the companies on that list for those purposes. Outside companies we use

6.2 What each one gets. Each outside company receives only the business data its job needs. We use each one under written or online terms that require it to protect what it receives, and we remain responsible to you under these terms for what we ask it to do.

6.3 30 days' notice before a change. Before we add an outside company, or change what an existing one receives or where it does it, we tell the owners of every affected business at least 30 days ahead, by email and inside the app, and we update the page and its change log.

6.4 If you object. If you object to a change, tell us within those 30 days. We will discuss whether the change can be avoided for your business. If it cannot, you may close your account before the change takes effect and export your records first, and we will refund any fees paid in advance for whole months not yet started.

6.5 Urgent changes. If we must replace an outside company urgently to keep XoraPro running or secure, for example because it stops its service or suffers a breach, we may make the change first and tell you within 7 days, with the reason. Section 6.4 then applies from the day we tell you.

6.6 Services that stay switched off. A service that XoraPro can connect to but has not switched on (for example the WhatsApp Business service run by Meta, or Viber) is shown on the list as "not in use". We give the 30 days' notice in 6.3 before switching one on.

6.7 What is not an outside company. Government systems that your business switches on itself, such as the Inland Revenue Department's CBMS for electronic billing or the Department of Immigration's FNMIS for foreign guest registration, are not our outside companies. Sending data to them is a disclosure your business chooses to make under the law that requires it, and the Privacy Policy describes each one. Messages your business sends through a wa.me, viber:// or sms: link go from your own phone, not through XoraPro.

7.1 We tell you. If we become aware of a breach that affects your business data, we tell the owners of your business without undue delay, aiming to do so within 72 hours of becoming aware of it, even if we do not yet know everything.

7.2 What we tell you. As far as we know it at the time: what happened and when; what kinds of business data and roughly how many people are affected; what the likely effects are; what we have done and are doing about it; what you should do; and whom to contact at N.P. Xora. We update you as we learn more.

7.3 We help you tell your people. If you need to tell your staff, customers or others, we give you the facts you need and, if you ask, draft wording in Nepali and English for you to send.

7.4 We act. We take reasonable steps to contain the breach, reduce its harm and stop it happening again. Where the Data Centre and Cloud Service Directive 2081 section 8(3) applies, we inform the service provider concerned and, if forensic examination is needed, the National Cyber Security Center. Where an offence may have been committed, we report it to the police.

7.5 Not an admission. Telling you about a breach is not an admission that we were at fault.

7.6 Tell us too. If you learn of a breach or suspected misuse of your account, tell us at once at support@xorapro.com.

8.1 People whose information is in your records usually ask your business first, as the Privacy Policy (section 13) tells them to. You can see, correct and export most business data yourself from your own screens.

8.2 If a person asks us, not you, about their information in your records, we pass the request to your business within 5 working days and tell the person we have done so. We do not answer it for you unless you ask us to, or the law requires us to.

8.3 Where your own screens cannot do what a lawful request needs, we help you, at no charge for reasonable requests.

8.4 Posted entries in your books cannot be erased: the Electronic Billing Procedure 2082 requires corrections to be recorded, not deleted. A correction is made by reversal, and both entries stay (Terms of Service section 6).

9.1 Export. You can export your records from inside XoraPro at any time while your account is open, and during any notice period before we close it (Terms of Service sections 4 and 11). Export before you close the account; it is easier than asking afterwards.

9.2 Deletion when the account closes. When your account closes, we delete business data or remove what identifies people in it as the account deletion page (xorapro.com/delete-account) and Privacy Policy section 12 describe. We aim to finish within 30 days, and on request we confirm in writing when it is done.

9.3 What the law makes us keep. We keep only what Nepal law requires: books a business must keep for VAT, for six years after the end of the fiscal year (VAT Rules 2053 rule 23(7)); records supporting income tax (Income Tax Act 2058 section 81); the audit trail attached to them (Electronic Billing Procedure 2082); and each fiscal year's backup (the same Procedure). Section 10 of the Privacy Policy lists each period. While we keep them, these terms keep applying: they stay confidential and secure and are used for no other purpose. When the period ends they are destroyed.

9.4 Backups. Deleted data leaves our daily backups within about five weeks and our monthly backups within about thirteen months. A backup is never restored to bring back data you asked us to delete, only to recover from a failure.

10.1 An owner of your business may ask us in writing (support@xorapro.com) reasonable questions about how its business data is protected: the measures in section 5, where the data is stored, which outside companies receive what, and how a past breach was handled. We answer in writing within 15 days.

10.2 For businesses that issue electronic invoices, we give you what you need to tell the Inland Revenue Department where your billing server is, and to sign the three-way agreement with Ncell and N.P. Xora in the form of Annexure 7 (Electronic Billing Procedure 2082 clause 7.2(ख) and (घ)).

10.3 We need not disclose anything that would weaken security, reveal another business's data, or break a confidentiality duty we owe to someone else. If we hold something back for one of those reasons, we say so.

10.4 These terms do not give a right to enter our premises or inspect our systems. If a court or a law requires more, we will cooperate.

11.1 Changes. We change these terms the same way as the Terms of Service (section 12 of those terms). If a change reduces your protection, we tell you by email and inside the app at least 30 days before it takes effect, and everyone is asked to agree again at their next sign-in.

11.2 Responsibility. Section 10 of the Terms of Service sets out what we are and are not responsible for, including its limit. Nothing in these terms limits a liability that the law does not allow to be limited.

11.3 What continues. Sections 4, 5, 7 and 9 continue to apply after your account closes, for as long as we hold any of your business data.

11.4 Law. These terms are governed by the law of Nepal. Any dispute is decided by the courts of Nepal. Nothing in these terms stops you from going to court. Before going to court, please raise the matter with us by email (Terms of Service section 14); we reply in writing within 15 days. Send it with the subject "Complaint" (in Nepali, "गुनासो") to: support@xorapro.com

11.5 Language. These terms are published in Nepali and in English, side by side.