Data Processing Agreement

This summary describes how Entrio processes personal data on behalf of the event organisers who use the platform. It is issued under the Digital Personal Data Protection Act, 2023 (DPDP Act)and forms part of the agreement between Entrio and each Organiser. A full signed DPA is available to Organisers on request.

1. Roles

Each Organiser is the Data Fiduciaryfor its attendees' personal data — it decides why the data is collected. Entrio is the Data Processor, processing that data only on the Organiser's documented instructions to provide the ticketing and access service.

2. Scope & purpose

Entrio processes attendee data solely to operate the service the Organiser has bought — account creation and OTP login, ticket sales and invoicing, delivery and collection, gate entry and fraud prevention, and related support. Entrio does not use attendee data for its own purposes and does not sell it or use it for advertising.

3. Sub-processors

Entrio uses a limited set of vetted sub-processors, each only for its specific function:

• MSG91 — SMS / OTP / email delivery.
• Meta (WhatsApp Cloud API) — WhatsApp messages (tickets, payment links).
• Razorpay / Paytm — payment processing and refunds.
• Google Maps — delivery navigation (home delivery only).
• DigitalOcean (Bangalore, India) — hosting and storage.

4. Security

Entrio applies encryption in transit (TLS) and encryption at rest for sensitive secrets, one-way hashing of passwords and OTPs, tenant isolation between Organisers, role-based least-privilege access, and audit logging. See our Security page for detail.

5. Data location

Attendee data is hosted in India (DigitalOcean, Bangalore). Any processing outside India by a sub-processor is limited to what that service requires and is done only as permitted under the DPDP Act.

6. Retention & deletion

Entrio retains data for the term of the Organiser agreement and returns or deletes it on termination, except where records must be kept to meet a legal obligation (for example, tax records). Retention periods for specific data types are set out in our Privacy Policy.

7. Data-principal requests

Requests from attendees to access, correct, or erase their data, or to withdraw consent, are directed to the Organiser (the Data Fiduciary); Entrio assists the Organiser in responding as its Processor.

8. Contact

For a copy of the full Data Processing Agreement or any question about processing, write to [email protected] or call +91 89802 98564.