Kshitij ERP — SaaS Subscription Agreement

1. The parties. This agreement is between Kshitij Infotech, [to be confirmed] with its registered office at [to be confirmed], GSTIN [to be confirmed] (“Kshitij”), and the business named in the Order that accepts it (the “Customer”).
2. What this covers. Access to Kshitij ERP as an online service that Kshitij hosts (the “Service”). The plan, users, branches, add-on services and fees are set out in the “Order”: the plan chosen in the account, or a signed order form. Where the Order and this agreement differ on a point, the Order wins on that point.
3. Accepting. The Customer accepts this agreement when its Owner or an Admin clicks “I accept”. That person confirms they have the authority to bind the Customer. Kshitij records the acceptance: who, when, which version, the network address and the device. Kshitij keeps that record for as long as the agreement lasts and for 8 years after it ends. An agreement accepted this way is a valid contract under section 10A of the Information Technology Act, 2000.
4. Users. The Customer decides who gets an account and what each account can see and do. The Customer is responsible for what is done through its users’ accounts. It removes people who leave, and it keeps sign-in codes and passwords private. Kshitij may require a second sign-in step (a sent code or an authenticator app) for any user. Kshitij will never ask a user for their password or a sign-in code.
5. The Customer’s data. Everything the Customer and its users enter or upload belongs to the Customer (“Customer Data”). Kshitij may use it only to provide, secure and support the Service, and to meet a legal duty. Kshitij does not sell it, does not use it for advertising, and does not message the Customer’s customers for its own purposes. Personal data in it is handled under Schedule 1.
6. What Kshitij provides.
   1. The Service, to the levels in Schedule 2, with updates included.
   2. Backups: a copy of the database every hour and a full copy every night, encrypted before they leave the server. Kshitij keeps the last 7 nightly copies, one copy for each of the last 4 weeks and one for each of the last 12 months.
   3. The security measures in Schedule 1, clause 4.
   4. Kshitij may change the Service to improve it. It will not take away billing, stock, accounts or GST reporting during a paid term without 30 days’ notice. If such a change harms the Customer, the Customer may end the agreement and get back the fees it prepaid for the remaining months.
7. What the Customer is responsible for.
   1. The accuracy of what it enters. Its books, tax returns, e-invoices, e-way bills and TDS/TCS remain the Customer’s legal responsibility. Kshitij ERP prepares and checks them, but it does not replace the Customer’s accountant. The Customer reviews a return before it files it.
   2. Having a lawful basis for every piece of personal data it enters, as Data Fiduciary under the Digital Personal Data Protection Act, 2023.
   3. Using the Service lawfully. It may not resell access, copy or reverse-engineer the software, get around its access limits, upload malicious code, or load-test or security-test the Service without Kshitij’s written permission.
8. Fees.
   1. Fees are as set out in the Order and are payable in advance, yearly unless the Order says monthly, plus GST. Each invoice is due within 15 days.
   2. Metered services, such as WhatsApp messages, are charged as their own terms say.
   3. Kshitij changes prices only at renewal, and tells the Customer at least 30 days before.
   4. If a renewal is not paid: the Customer keeps full use for the grace days in its plan (7 unless the Order says otherwise). After that the account is read-only for the plan’s read-only days (7 unless the Order says otherwise): everything can be seen and exported, but nothing new can be recorded. After that the account is suspended. Suspension deletes nothing, and the account comes back within one working day of payment.
   5. A suspended Customer that wants to leave can ask for a free 30-day export window. Clause 16 then applies.
9. Confidentiality. Each party keeps the other’s non-public information confidential and uses it only for this agreement. This continues for 3 years after the agreement ends, and for as long as the data exists in the case of Customer Data. Kshitij staff open Customer Data only to support the Customer when the Customer asks, or to keep the Service running and secure. Every such access is logged.
10. Promises. Kshitij provides the Service with reasonable skill and care and in line with the law that applies to it. Apart from what this agreement states, Kshitij makes no promise that the Service will be free of errors or interruptions, and figures it computes should be checked before they are relied on for a filing. The Customer confirms that it is entitled to enter the data it enters.
11. Limit of liability.
    1. Neither party is liable for indirect or consequential loss, lost profit, lost business or lost goodwill.
    2. For all claims arising in any 12 months, Kshitij’s total liability is capped at the fees the Customer paid for the Service in the 12 months before the first event giving rise to a claim.
    3. If Customer Data is lost or damaged, Kshitij will restore it from the most recent backup it holds, free of charge. Anything further falls within the cap.
    4. Kshitij is not liable for failures of the Customer’s own internet connection or devices, of third-party services the Customer turns on (Meta, its GST Suvidha Provider, its mail server, payment providers), or of government systems (the GST portal, the e-invoice and e-way bill systems).
    5. The cap does not limit: the Customer’s fees, either party’s indemnity under clause 12, fraud or wilful misconduct, or anything the law does not allow to be limited.
12. Indemnities. The Customer will defend Kshitij against claims arising from Customer Data, from the Customer’s messages, or from its breach of clause 7, and will cover the cost. Kshitij will defend the Customer against a claim that the Service, as Kshitij provides it, infringes someone’s intellectual property in India. Kshitij will then either change the Service so it no longer infringes, or end the agreement and refund the prepaid fees for the remaining months.
13. Suspension for safety. Kshitij may suspend a user, a feature or the account at once if there is a security threat, unlawful use, or a legal order. It suspends as little as it can, says why, and restores access when the cause is dealt with.
14. Term. The agreement starts when it is accepted. It runs for the term in the Order (12 months unless the Order says otherwise) and renews for the same length, unless either party gives notice at least 30 days before the renewal. Either party may end it if the other commits a serious breach and does not fix it within 30 days of written notice. Kshitij may end it with 90 days’ notice if it stops offering the Service, and refunds the prepaid fees for the remaining months. The Customer may stop at any time, but the current paid period is not refunded.
15. Changes to this agreement. Kshitij may publish a new version and tells the Owner at least 30 days before it takes effect. The Owner or an Admin is asked to accept it at the next sign-in. Until it is accepted, the old version applies until the end of the current paid period. If the Customer does not accept a version that reduces its rights, it may end the agreement and get back the fees it prepaid for the remaining months.
16. When it ends. The account stays read-only for 30 days so the Customer can export everything: documents, ledgers, masters and attachments, in CSV and PDF, plus a full database export on request. Kshitij then deletes Customer Data within a further 60 days and confirms the deletion in writing if asked. Copies inside backups expire on the backup cycle (12 months at most), and Kshitij never restores them except at the Customer’s written request. The Customer must keep its own books after the export: Indian law requires books of account to be kept for 8 years (Companies Act, 2013, s.128) and GST records for 72 months (CGST Act, 2017, s.36). Kshitij keeps only its own records about the Customer: invoices, this agreement’s acceptances, and the log of its staff’s access.
17. Events beyond control. Neither party is liable for delays caused by events it could not reasonably prevent: flood, fire, power-grid or national network failure, government action, war or epidemic. If such an event stops the Service for more than 30 days, either party may end the agreement, and the prepaid fees for the remaining months are refunded.
18. Law and disputes. Indian law governs this agreement. A dispute is first escalated between the parties’ named contacts for 30 days. If it is not settled, it goes to a sole arbitrator under the Arbitration and Conciliation Act, 1996, seated at [to be confirmed], in English. The courts at [to be confirmed] have exclusive jurisdiction over interim relief and enforcement.
19. Notices. Notices to the Customer go to the Owner’s email on the account. Notices to Kshitij go to [to be confirmed]. An email notice takes effect on the working day after it is sent.
20. General. This agreement, the Order and the schedules are the whole agreement between the parties. The Customer may not transfer it without Kshitij’s written consent. Kshitij may transfer it to whoever takes over its business, after giving notice. If one clause is held invalid, the rest stands. Not enforcing a right is not a waiver of it. The English text governs, and any translation is for convenience.

Schedule 1 — Data processing (Digital Personal Data Protection Act, 2023)

1. Roles. For the personal data of its customers, suppliers and staff, the Customer is the Data Fiduciary and Kshitij is its Data Processor. Kshitij processes that data only to provide the Service and only on the Customer’s instructions; section 8(2) of the Act requires this contract. For the people who sign in, register for a demo or write to Kshitij, Kshitij is the Data Fiduciary, as its privacy policy says.
2. What is processed. Names, mobile numbers, email and postal addresses, GSTIN and PAN, transactions, bank and UPI details, staff records and documents, messages sent and received, and the consent recorded against each recipient.
3. Purpose. Kshitij uses the data to run the Service as the Customer configures it, to keep it secure, to support the Customer when asked, and to meet a legal duty. It does not use the data for advertising, does not sell it, and does not use it to message the Customer’s contacts for its own purposes.
4. Safeguards (section 8(5)).
   1. Every connection is encrypted.
   2. The database itself (row-level security) separates each customer’s data from every other’s, not just the application.
   3. Addresses, bank and UPI details, staff personal details, notes, reference numbers, authenticator secrets and inbox message text are encrypted at rest (AES-256-GCM), with the key held off the server’s disk.
   4. Backups are encrypted.
   5. A tamper-evident audit trail records every change.
   6. The Customer can require a second sign-in step for all its staff.
   7. Each user’s access is limited by role and branch.
5. Sub-processors. Kshitij uses third-party services of the kinds below, and only these. The current list, with each provider’s name and where it processes data, is in the account (Settings → Company), and Kshitij tells the Customer 30 days before it changes. The Customer may object, and if the objection cannot be met, it may end the affected feature.
   1. A hosting provider in India, which hosts the Service.
   2. Encrypted backup storage, which receives encrypted backups only.
   3. An encryption-key service, which holds the key and no personal data.
   4. The WhatsApp messaging provider, which receives the recipient’s number and the message, only when WhatsApp is turned on. Outside India.
   5. A maps lookup service, which receives an address being looked up, only when a location is pinned. Outside India.
   6. A GST Suvidha Provider and the government’s e-invoice and e-way bill systems, which receive invoice details, only when e-invoicing is turned on. In India.
6. Breach. Kshitij tells the Customer within 24 hours of becoming aware of a breach affecting its data: what happened, whose data and which data, what has been done, and who to contact. Kshitij keeps the Customer informed after that and keeps a record of every breach. The 24 hours leave the Customer time to tell the Data Protection Board within the 72 hours the Rules allow.
7. People’s rights. When a person asks Kshitij to access, correct or erase data the Customer holds, Kshitij passes the request to the Customer within 7 days and helps it answer. The Service lets the Customer find, export, correct and blank a person’s details.
8. Retention. Kshitij keeps the Customer’s data while the agreement runs. When it ends, clause 16 of the agreement applies: 30 days to export, then deletion within a further 60 days, with backups expiring on their own cycle.
9. Transfer outside India (section 16). WhatsApp messages pass through the WhatsApp messaging provider outside India. Kshitij will stop any transfer to a country the Government restricts.
10. Audit. Once a year, on 30 days’ notice, the Customer may ask for evidence that this schedule is being met. Kshitij provides a written report first, and an inspection only if the report does not answer the question.
11. Staff. Everyone at Kshitij who can reach Customer Data is bound to confidentiality, and every support access is logged.

Schedule 2 — Service levels

1. Availability: 99.5% each calendar month. Kshitij measures it with a check of the sign-in page every minute. It does not count: planned maintenance announced 48 hours ahead and done between 23:00 and 06:00 IST; urgent security fixes; and the causes in clauses 11(d) and 17 of the agreement.
2. Credits. The Customer is credited a share of that month’s fee: 5% below 99.5%, 10% below 99.0%, and 25% below 97.0%. It must claim within 30 days, and the credit comes off the next invoice. Credits are the only remedy for availability. The exception: if availability falls below 97.0% in any two months out of six, the Customer may end the agreement and get back the fees it prepaid for the remaining months.
3. Support. In the app, on WhatsApp at +91 97007 96005, or by email, Monday to Saturday, 10:00–19:00 IST, except national holidays.
   1. Urgent (the company cannot sign in or bill): a reply within 1 working hour, and work continues until it is fixed.
   2. Broken with a workaround: a reply within 1 working day.
   3. A question or request: a reply within 2 working days.
4. Recovery. At most 1 hour of data is lost (the hourly copy). The target is to have the Service running again within 8 working hours of a server loss. That is a target, not a guarantee. A restore of the backups is tested automatically every night.