Terms of Service

1.1Parties. These Terms of Service (“Terms” or “Agreement”) are a legally binding agreement between Skorydov Systems Private Limited, a company incorporated under the Companies Act, 2013, bearing Corporate Identification Number [SKORYDOV CIN], PAN [SKORYDOV PAN] and GSTIN [SKORYDOV GSTIN], having its registered office at [SKORYDOV REGISTERED OFFICE ADDRESS], which operates myconsentapp (“Skorydov”, “we”, “us”), and the person accessing or using the Platform (“You” or “Your”).

1.2Acceptance. You are deemed to have accepted these Terms upon the earliest of: (a) clicking or otherwise indicating acceptance; (b) creating an account on the Platform; (c) activating any credential or API key issued to You; or (d) accessing or using the Platform in any manner. If You do not accept these Terms in their entirety, You shall not access or use the Platform.

1.3Authority. If You access or use the Platform on behalf of a business or other entity, You represent and warrant that You are authorised to accept these Terms on its behalf, that Your acceptance binds both You and that entity, and that references to “You” include that entity. Skorydov may require evidence of Your authority at any time.

1.4Precedence over enterprise arrangements. Where a business has executed a Master Subscription Agreement, Order Form or other written agreement with Skorydov for myconsentapp (an “Enterprise Agreement”), the Enterprise Agreement governs the commercial relationship and prevails over these Terms to the extent of any inconsistency. These Terms continue to govern the individual conduct of each Authorised User, and Clauses 5 (Use Restrictions) and 6 (Misuse Prevention) apply in addition to the Enterprise Agreement.

1.5Nature of the Platform. The Platform is a consent management platform operated by Skorydov for the purposes of the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the “DPDP Act”). Skorydov is a proposed Consent Manager. It is not yet registered as a Consent Manager with the Data Protection Board of India (the “Board”) and will apply for registration once the Board opens applications. Its current registration status, ownership and the other particulars required by the DPDP Act will be published on this website once finalised.

1.6Documents incorporated by reference. The following documents, as amended from time to time under Clause 1.7, form part of these Terms: (a) the myconsentapp Privacy Policy; (b) the Data Processing Addendum at Annexure A, to the extent Skorydov processes Personal Data on behalf of a business; (c) the Support and Service Level Terms at Annexure B, for paid business subscriptions; and (d) the Cancellation and Refund Terms at Annexure C. In the event of conflict, the body of these Terms prevails, save that the Data Processing Addendum prevails on its subject matter and an executed Order Form prevails on commercial terms it expressly addresses.

1.7Amendment. Skorydov may amend these Terms from time to time. Save for amendments that (a) are, in Skorydov’s reasonable judgement, non-material, (b) relate to new, optional, beta or preview functionality, or (c) are required by law or by any direction of the Board or another competent authority, Skorydov shall give You not less than fifteen (15) days’ prior notice, by email or in-app notification, before an amendment takes effect. No amendment has retrospective effect, and no amendment alters a consent record already made. Your continued use of the Platform after an amendment takes effect constitutes acceptance of it. If an amendment materially and adversely affects a business’s rights and Skorydov cannot resolve the matter within fifteen (15) days of it being raised in writing, the business may terminate on fifteen (15) business days’ written notice and receive a pro rata refund of prepaid Fees for the unexpired Subscription Term.

2.1Individuals. You may hold an individual account if You are at least eighteen (18) years of age and competent to contract under the Indian Contract Act, 1872. Consent on behalf of a child, or of a person with a disability who has a lawful guardian, may be given only by the parent or lawful guardian through the features the Platform provides for that purpose, and every such action is recorded. You may act for another person only where You are their parent, lawful guardian or nominee under the DPDP Act.

2.2Businesses. A business account may be opened only by a person authorised under Clause 1.3. Live use of the Platform requires completion of Skorydov’s business verification (including verification of legal name, registration and authorised signatory) and an active subscription. Skorydov may decline or withdraw access where verification is not completed or eligibility criteria are not met.

2.3Registration. You shall furnish accurate registration particulars, including Your own mobile number and email address, and keep them current. Businesses shall also keep their organisation details, Data Protection Officer and grievance contacts accurate, as these may be shown to Data Principals.

2.4Credentials and API keys. Credentials are issued to a single named individual and shall not be shared, transferred or made available to any other person, including within the same organisation. API keys are issued to a business and shall be kept secret, stored securely and used only from systems under the business’s control. You are responsible for all activity under Your credentials and keys, and shall notify Skorydov at myconsentapp@skorydov.com immediately upon becoming aware of any actual or suspected unauthorised access. Skorydov recommends, and may require, a second sign-in factor.

2.5Organisational administration. A business is responsible for inviting, suspending and removing its team members, for assigning roles, and for revoking API keys that are no longer needed. Credentials shall be issued only to the business’s employees and contractors engaged exclusively in work for it (“Authorised Users”).

3.1What the Platform does. The Platform enables a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform, and enables Data Fiduciaries to issue notices, request consent, verify the status of consent and act on withdrawals, corrections, erasure requests and grievances. The Platform also provides consent receipts, a record of every consent event, and the ability to nominate another person.

3.2Free for individuals. The Platform is free for Data Principals. Skorydov does not charge You for giving, reviewing, managing or withdrawing consent, and withdrawal is always as easy as giving consent.

3.3Acting on Your behalf. In relation to a Data Principal, Skorydov acts on behalf of that Data Principal and in a fiduciary capacity. Skorydov shall avoid conflicts of interest with Data Fiduciaries, including with any promoter, director or key managerial personnel of Skorydov, and shall not sub-contract or assign its obligations as a Consent Manager save as permitted by the DPDP Act.

3.4Data is not read by Skorydov. Where the Platform carries Personal Data from one Data Fiduciary to another at Your direction, it does so in a way that does not allow Skorydov to read the content of that Personal Data, save to the extent necessary to operate the Platform or as required by law.

3.5Business licence. Subject to compliance with these Terms and payment of applicable Fees, Skorydov grants a business a limited, non-exclusive, non-transferable, non-sublicensable and revocable right, during the Subscription Term, to access and use the Platform’s business console, application programming interfaces, software development kits, hosted consent pages and notice templates (together, the “Business Services”) solely for its own internal purposes, within the modules and usage parameters of its subscription plan.

3.6Sandbox, trial, beta and preview access. Skorydov may make a sandbox, trial, beta or preview of the Business Services available free of charge. Notwithstanding anything else in these Terms: (a) Skorydov may limit, withdraw or terminate such access at any time; (b) it is provided “as is” and “as available” without warranty, and Clause 14.2 does not apply; (c) Skorydov’s aggregate liability for it shall not exceed ₹10,000 (Rupees ten thousand only); and (d) sandbox accounts shall not contain real Personal Data, and records in them may be deleted without notice.

3.7Changes to the Platform. Skorydov may update, modify or discontinue any feature of the Platform in the ordinary course of development. Skorydov shall give not less than fifteen (15) days’ prior notice of a change that materially reduces the functionality of a paid subscription plan, and no change shall prevent a Data Principal from viewing or withdrawing a consent already given.

3.8Reservation of rights. Save for the rights expressly granted in these Terms, no right, title or interest in the Platform or any Intellectual Property Rights of Skorydov is granted to You. All rights not expressly granted are reserved to Skorydov and its licensors.

4.1Duties of a Data Principal. In using the Platform You shall comply with the duties of a Data Principal under Section 15 of the DPDP Act, and in particular shall not impersonate another person, shall not suppress material information when providing Personal Data for any document or identifier issued by the State, shall not register a false or frivolous grievance or complaint, and shall furnish only verifiably authentic information when seeking correction or erasure.

4.2Your decisions. You decide whether to give, refuse or withdraw consent. The Platform shows You the notice supplied by the business; Skorydov does not write that notice and is not responsible for the business’s processing. Withdrawal does not affect the lawfulness of processing done before it, and the business, not Skorydov, is responsible for stopping processing after You withdraw.

5.1Restrictions. You shall not, and shall not attempt to, permit or enable any other person to, whether directly or indirectly:

1. access, or attempt to access, the consent records, Personal Data or account of any other person, or any system, network or infrastructure of Skorydov, without authorisation;
2. record, request or represent consent that a Data Principal has not in fact given, backdate or alter a consent event, or use the Platform to mislead any person about what they are agreeing to;
3. present a notice that is inaccurate, incomplete, bundled with unrelated purposes, or otherwise fails to meet the requirements of the DPDP Act;
4. send unsolicited, repetitive or harassing consent requests, or use the Platform to send marketing messages unrelated to consent;
5. reverse engineer, decompile, disassemble or otherwise seek to derive the source code, signing keys, ledger structure or underlying logic of the Platform, save to the extent such restriction is prohibited by law;
6. copy, adapt, translate or create any derivative work of the Platform or its documentation;
7. sell, resell, rent, sublicense or otherwise make the Business Services available to any third party, including on a service bureau or managed services basis, without Skorydov’s written consent;
8. share credentials or API keys, or permit any person other than the named individual to use credentials issued to them;
9. employ robots, crawlers, scrapers or scripted clients to access the Platform, save through a supported API in accordance with its documentation;
10. exceed the rate limits or usage parameters of Your plan, or circumvent, disable or manipulate any rate limit, signature, audit record, security control or verification step;
11. introduce any virus, malware or other harmful code, or impair the integrity, security, availability or performance of the Platform;
12. upload or transmit material that is unlawful, defamatory, obscene, harassing or infringing, or use the Platform in contravention of any law, including the Information Technology Act, 2000;
13. use the Platform or any part of it to build or benchmark a competing product, or publish any benchmark of the Platform without Skorydov’s prior written consent; or
14. represent that Skorydov has reviewed, approved or certified a business’s notices or processing.

5.2Fair use. Where any usage entitlement is described as “unlimited”, it remains subject to a reasonable fair use standard consistent with the ordinary business use of the plan. Skorydov may contact a business whose consumption is materially disproportionate to discuss an appropriate plan and may, failing agreement, exercise its rights under Clauses 6 and 17.

5.3Verification of compliance. Skorydov may verify compliance with this Clause 5 and with a plan’s usage parameters, including by reviewing access logs, API usage and credential records. Where usage exceeds the plan, the business shall, within thirty (30) days of written notice, pay the additional Fees for the excess at Skorydov’s then current list price.

5.4Material breach. Any breach of this Clause 5 is a material breach of these Terms.

6.1Technical controls. Skorydov operates controls to detect and prevent misuse of the Platform, including rate limits, usage metering, anomaly detection, credential sharing detection, request signing and logging of access and administrative activity. These controls form part of the Platform and may be updated without notice.

6.2Automated and manual intervention. Where Skorydov detects or reasonably suspects conduct in breach of Clause 5, conduct posing a security, legal or reputational risk, or consumption inconsistent with fair use, Skorydov may, with or without prior notice and without liability: (a) throttle, rate limit or queue requests; (b) decline to process a particular request; (c) block access from any device, network, location, credential or API key; (d) require re-authentication or further verification; (e) suspend an account in whole or in part under Clause 17.1; and (f) preserve relevant logs for investigation and, where required, disclosure to a competent authority.

6.3Notification and review. Where access is blocked or suspended under this Clause 6, Skorydov shall, unless prohibited by law or where notice would prejudice an investigation, notify You by email within a reasonable period and identify in general terms the ground for the action. You may request a review by writing to myconsentapp@skorydov.com. Skorydov shall restore access promptly once the cause has been resolved. Blocking a business never prevents a Data Principal from viewing or withdrawing consent given to that business.

6.4No obligation to monitor. Nothing in this Clause 6 obliges Skorydov to monitor Your use of the Platform, and the existence of these controls is no assurance that misuse by another person will be detected or prevented.

6.5Reporting. Suspected misuse, including a misleading notice, an unwanted consent request or suspected credential sharing, may be reported to myconsentapp@skorydov.com.

7.1Ownership. As between You and Skorydov, You retain all rights in the information You submit to the Platform, and a business retains all rights in its notices, purposes, templates and configuration (together, “Your Content”). Nothing in these Terms transfers ownership of Your Content to Skorydov.

7.2Licence to Skorydov. You grant Skorydov a limited, non-exclusive, royalty-free licence to host, store, process, transmit and display Your Content solely to: (a) provide, secure and support the Platform; (b) record and evidence consent events; (c) prevent and address fraud, abuse and security incidents under Clause 6; and (d) comply with law and any binding direction of the Board or another competent authority.

7.3The consent ledger. Every consent event (including notices shown, consent given, refused, modified or withdrawn, and data shared at Your direction) is signed and recorded in a tamper-evident ledger, and a receipt is issued. Because these records are evidence, a recorded event cannot be edited or deleted, including on closure of an account; a correction is made by recording a new event. Skorydov keeps these records for at least seven (7) years, or for such longer period as the Data Principal and the Data Fiduciary agree or the law requires, and makes them available to You on request in a machine-readable form.

7.4No sale, no advertising, no model training. Skorydov does not sell Personal Data, does not use it to show advertising, and does not use Your Content to train any artificial intelligence model made available to others. Skorydov may produce de-identified and aggregated usage statistics, which do not include Your Content, for security, capacity planning and product improvement.

7.5Your responsibility. You are responsible for the accuracy and lawfulness of Your Content and for Your right to submit it, including every consent and authorisation needed for Skorydov to process it as these Terms contemplate.

7.6Business records and export. The consent ledger is kept for the purposes of the DPDP Act and is not a substitute for a business’s own records of processing. A business remains responsible for maintaining its own copies of anything it needs to retain. On expiry or termination of a business subscription, Skorydov shall make the business’s Content available for export for thirty (30) days, after which it may delete or anonymise that Content, save for ledger records retained under Clause 7.3.

8.1The business is the Data Fiduciary. A business using the Business Services remains the Data Fiduciary for the Personal Data it collects. It alone determines the purposes and means of its processing, and it remains solely responsible for complying with the DPDP Act and every other law that applies to it.

8.2Notices and purposes. A business shall describe each purpose and each item of Personal Data accurately, in clear and plain language, in English and in any language of the Eighth Schedule to the Constitution that the Data Principal chooses, and shall not bundle unrelated purposes into a single request.

8.3Honouring decisions. A business shall verify consent through the Platform before relying on it, process Personal Data only for the purposes consented to or as the law otherwise permits, cease processing (and procure that its Data Processors cease processing) within a reasonable time after consent is withdrawn, and act on correction, erasure, nomination and grievance requests received through the Platform within the periods the DPDP Act prescribes.

8.4No legal advice. Templates, sample notices, use-case guides, checklists and other material on the Platform are provided to help businesses implement consent flows. They are not legal advice, may not suit a particular business, and must be reviewed by the business before use. Skorydov does not review or approve a business’s notices or processing, and no lawyer-client relationship arises from use of the Platform.

8.5Security of integrations. A business is responsible for the security of its own systems, for validating signed responses and webhooks from the Platform, and for the conduct of any person or system using its API keys.

9.1Dependencies. The Platform depends on services not owned or controlled by Skorydov, including cloud infrastructure, SMS and email delivery providers, identity and payment providers, and authenticator applications (together, “Third Party Services”).

9.2Effect on availability. The availability and performance of the Platform, and the delivery of one-time codes and notifications, may be affected by an outage, change or error in a Third Party Service. Skorydov shall use reasonable endeavours to mitigate the impact of such events but does not warrant the conduct of any Third Party Service.

9.3Integrations. Where a business connects the Platform to its own or a third party’s software, the business’s use of that software is governed by the relevant provider’s terms, and Skorydov gives no warranty that it will remain interoperable with the Platform.

9.4Substitution. Skorydov may replace, add or remove any provider underlying the Platform, provided that any change affecting the location of processing is made in accordance with Clause 11.4 and the Data Processing Addendum.

10.1Fees. A business shall pay the fees for its subscription plan as displayed at the point of purchase or set out in the applicable Order Form (“Fees”). Unless stated otherwise, Fees are payable in advance, exclusive of taxes, and non-refundable save as these Terms and Annexure C provide.

10.2Taxes. Fees are exclusive of Goods and Services Tax and any other applicable tax, which is charged in addition at prevailing rates. Where a business is required to deduct tax at source, it shall deduct only the amount legally required, remit it within the prescribed time, and promptly furnish the applicable certificate.

10.3Renewal and revision of Fees. Unless stated otherwise, the Subscription Term renews automatically for successive periods of equal duration at Skorydov’s then current list price. A business may prevent renewal by cancelling in the console, or by written notice, not less than thirty (30) days before expiry for annual plans and at any time before the end of the billing cycle for monthly plans. Skorydov shall give not less than thirty (30) days’ notice of any increase in Fees for a renewal term, and shall not increase Fees during a Subscription Term.

10.4Cancellation and refunds. Cancellation, the cooling-off window for annual plans and refunds are governed by Annexure C.

10.5Late payment. Any undisputed amount not paid when due accrues interest at 1.5% per month or the maximum rate permitted by law, whichever is lower. A business disputing an invoice in good faith shall notify Skorydov in writing within thirty (30) days of the invoice date and pay the undisputed portion by the due date. Chargebacks initiated without first raising the matter with Skorydov may result in suspension pending resolution.

11.1Roles. Skorydov is a Data Fiduciary for the account, authentication, billing and usage data it collects to run the Platform, and acts as a proposed Consent Manager on behalf of Data Principals. Where Skorydov processes Personal Data on behalf of a business (for example, contact details of the business’s customers used to deliver consent requests), the business is the Data Fiduciary and Skorydov is its Data Processor on the terms of Annexure A.

11.2Privacy Policy and grievances. The data Skorydov collects, why, for how long and Your rights over it are described in the Privacy Policy. In short, for an individual Skorydov stores consent records, an encrypted copy of the mobile number and the preferred language. Skorydov has designated a Data Protection Officer who may be contacted at dpo@skorydov.com. Grievances about the Platform may be raised through the in-app grievance feature or at myconsentapp@skorydov.com, and shall be answered within the period prescribed under the DPDP Act. Nothing in these Terms limits Your right to complain to the Board after exhausting that grievance mechanism.

11.3Security safeguards. Skorydov shall implement and maintain reasonable technical and organisational security safeguards to protect Personal Data against accidental or unlawful destruction, loss, alteration and unauthorised access or disclosure, consistent with its obligations under the DPDP Act. The safeguards are described in Schedule 2 to Annexure A.

11.4Location of processing. Skorydov stores and processes Personal Data on infrastructure located in India, and shall not transfer Personal Data outside India otherwise than in accordance with Section 16 of the DPDP Act and any restriction notified by the Central Government.

11.5Personal data breach. Skorydov shall intimate the Board and each affected Data Principal of a personal data breach in the manner and within the time the DPDP Act prescribes, and shall notify an affected business in accordance with Annexure A.

11.6Demands by authorities. If Skorydov receives a binding demand from a court, the Board, a law enforcement or regulatory authority or any other person for Your Content, Skorydov shall, unless prohibited by law: (a) promptly notify You and provide a copy; (b) where permissible, direct the requesting party to You; (c) disclose only what it is legally compelled to disclose; and (d) disclose the minimum necessary.

12.1Skorydov Intellectual Property. Skorydov and its licensors own all rights, including all Intellectual Property Rights, in the Platform, its software, documentation, templates, ledger and signing systems, and all improvements and derivative works of them.

12.2Feedback. Skorydov may use any suggestion or feedback You provide about the Platform without restriction or obligation, provided it does not identify You as the source without Your consent and does not use Your Content for that purpose.

12.3Marks. “myconsentapp”, “Skorydov” and the associated logos are trade marks of Skorydov. You shall not use them without Skorydov’s prior written consent, save for accurate identification of the Platform, including a business stating that it uses myconsentapp for consent management.

13.1Definition. “Confidential Information” means all non-public information disclosed by one party to the other that is designated as confidential or that a reasonable person would understand to be confidential. Skorydov’s Confidential Information includes the architecture, signing keys, security documentation and non-public pricing of the Platform. Your Confidential Information includes Your Content.

13.2Obligations. The receiving party shall use the other party’s Confidential Information only to perform these Terms, protect it with at least reasonable care, and disclose it only to its personnel, professional advisers and, for Skorydov, sub-processors, on a need-to-know basis and under written obligations of confidentiality no less protective than this Clause 13.

13.3Exclusions. This Clause 13 does not apply to information that: (a) is or becomes public otherwise than through breach of these Terms; (b) was rightfully known to the receiving party before disclosure; (c) is rightfully received from a third party without breach of confidence; or (d) is independently developed without use of the other party’s Confidential Information.

13.4Compelled disclosure. The receiving party may disclose Confidential Information to the extent required by law or by order of a competent court or authority, giving the disclosing party prompt notice where legally permissible and disclosing only the minimum required.

13.5Duration. These obligations subsist for five (5) years after expiry or termination, save that obligations in respect of Your Content subsist for so long as Skorydov retains it, and obligations in respect of a trade secret subsist for so long as it remains a trade secret.

14.1Your representations. You represent and warrant that: (a) You hold all rights and authorisations needed to submit Your Content and to grant the licence in Clause 7.2; (b) Your use of the Platform will comply with Clauses 5 and 6 and all applicable law; and (c) You meet the eligibility criteria in Clause 2.

14.2Skorydov warranty and exclusive remedy. Skorydov warrants that it shall provide the Platform with reasonable care and skill and materially in accordance with its documentation, and shall perform the obligations of a Consent Manager under the DPDP Act. A business’s sole remedy for breach of the first part of this warranty is re-performance within a reasonable time or, failing that, a refund of Fees prepaid for the affected period.

14.3Disclaimer. SAVE AS EXPRESSLY SET OUT IN CLAUSE 14.2, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE PLATFORM AND ITS DOCUMENTATION AND TEMPLATES ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, AND WITHOUT WARRANTY THAT THE PLATFORM WILL BE UNINTERRUPTED OR ERROR FREE. SKORYDOV DOES NOT WARRANT THAT USE OF THE PLATFORM WILL BY ITSELF MAKE A BUSINESS COMPLIANT WITH THE DPDP ACT OR ANY OTHER LAW.

15.1Excluded heads of loss. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY SHALL BE LIABLE TO THE OTHER, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), UNDER STATUTE OR OTHERWISE, FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE OR CONSEQUENTIAL DAMAGES, OR FOR ANY LOSS OF PROFIT, REVENUE, GOODWILL, DATA OR BUSINESS OPPORTUNITY, ARISING OUT OF OR IN CONNECTION WITH THESE TERMS.

15.2Aggregate cap. SUBJECT TO CLAUSES 15.3 AND 15.4, THE AGGREGATE LIABILITY OF EACH PARTY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS SHALL NOT EXCEED THE GREATER OF: (a) THE TOTAL FEES PAID OR PAYABLE BY YOU IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM; AND (b) ₹25,000 (RUPEES TWENTY FIVE THOUSAND ONLY). FOR SANDBOX, TRIAL, BETA OR PREVIEW ACCESS, THE LIMIT IN CLAUSE 3.6(c) APPLIES INSTEAD.

15.3Enhanced cap. Subject to Clause 15.4, the aggregate liability of each party for (a) breach of Clause 13 (Confidentiality), (b) breach by Skorydov of Clause 11.3 (Security safeguards), and (c) its indemnification obligations under Clause 16, shall not exceed the greater of three (3) times the amount in Clause 15.2(a) and ₹1,00,000 (Rupees one lakh only).

15.4Unlimited liability and statutory rights. Nothing in this Clause 15 excludes or limits: (a) a business’s obligation to pay Fees; (b) liability for gross negligence, wilful misconduct or fraud; (c) any liability that cannot be limited by law; or (d) any right of a Data Principal, or any power of the Board, under the DPDP Act.

15.5Allocation of risk. The parties acknowledge that the Fees reflect the allocation of risk in this Clause 15 and in Clauses 8 and 9.

16.1Indemnity by a business. A business shall defend, indemnify and hold harmless Skorydov, its Affiliates and their directors, officers, employees and agents from and against all losses, damages, penalties, costs and expenses (including reasonable legal fees and the cost of responding to any enquiry by the Board or another regulator) arising out of any claim, complaint, proceeding or enquiry relating to:

1. the business’s processing of Personal Data, including processing beyond the consent given or after consent was withdrawn;
2. any notice, purpose, template or other Content the business publishes through the Platform;
3. access to or use of the Platform in breach of Clause 5 or Clause 6, or by any person using the business’s credentials or API keys;
4. any representation by the business that Skorydov has reviewed or approved its notices or processing; or
5. any breach of the business’s representations in Clause 14.1.

16.2Indemnity by Skorydov. Skorydov shall defend a paying business against any third party claim alleging that the Platform, used in accordance with these Terms, infringes that third party’s Intellectual Property Rights, and shall indemnify the business against damages finally awarded or agreed in settlement. Skorydov may instead modify the Platform to be non-infringing, procure the right to continue using it, or terminate and refund prepaid Fees for the unexpired Subscription Term. This indemnity does not cover claims arising from the business’s Content, use in breach of Clause 5, or combination with anything not provided by Skorydov.

16.3Procedure. The party seeking indemnity shall promptly notify the other in writing, give it sole control of the defence and settlement, and provide reasonable cooperation at its cost. No settlement may impose any payment, admission or obligation on the indemnified party without its prior written consent, not to be unreasonably withheld.

16.4Survival. The indemnities in this Clause 16 survive expiry or termination.

17.1Suspension. Skorydov may suspend access, in whole or in part, immediately on written notice (which may be by email) if: (a) an undisputed Fee remains unpaid fifteen (15) days after a written reminder, or a scheduled payment cannot be collected within the period in Annexure C; (b) Skorydov reasonably believes the access poses a security, legal or reputational risk or breaches Clause 5 or 6; or (c) Skorydov is required to do so by law or by the Board. Skorydov shall restore access promptly once the cause is resolved. Suspension of a business never prevents a Data Principal from viewing or withdrawing consent.

17.2Closure by an individual. You may close Your individual account at any time from the app. Closing Your account does not withdraw consents You have given; withdraw them first if You wish to. Consent records already made remain in the ledger for the period in Clause 7.3.

17.3Termination by a business. A business may cancel its subscription at any time. Cancellation takes effect under Annexure C, and prepaid Fees are not refundable save as Clauses 1.7, 14.2, 16.2 and 17.4 and Annexure C provide.

17.4Termination for cause. Either party may terminate with immediate effect by written notice if the other commits a material breach that is incapable of remedy or is not remedied within fifteen (15) days of written notice. Skorydov may terminate without a cure period for a breach of Clause 5 or 6 giving rise to a security, legal or reputational risk, or where required by law. Where a business terminates for Skorydov’s uncured material breach, Skorydov shall refund prepaid Fees for the unexpired Subscription Term pro rata.

17.5Consequences of termination. On expiry or termination: (a) all licences cease and You shall stop using the Business Services; (b) the business shall pay all Fees accrued; (c) each party shall return or destroy the other’s Confidential Information, subject to routine backups and legal retention; (d) Clause 7.6 and Annexure A govern export and deletion of business Content; and (e) Skorydov shall continue to let each Data Principal view their consents to the business and shall relay any withdrawal to the business’s published grievance contact.

17.6Survival. Clauses 6.2(f), 7, 9.2, 10 (as to accrued Fees), 12, 13, 14.3, 15, 16, 17.5, 18, 19 and 20 survive expiry or termination.

18.1Governing law. These Terms are governed by the laws of India, without regard to conflict of laws principles.

18.2Negotiation. Any dispute arising out of or in connection with these Terms (a “Dispute”) shall first be referred to good faith negotiation between the parties for thirty (30) days from written notice of the Dispute.

18.3Arbitration. Any Dispute not resolved under Clause 18.2 shall be finally resolved by arbitration under the Arbitration and Conciliation Act, 1996, by a sole arbitrator appointed by agreement or, failing agreement within thirty (30) days of a written request, by the Bombay High Court. The seat and venue of arbitration shall be Mumbai, and the proceedings shall be in English.

18.4Statutory remedies preserved. Nothing in this Clause 18 prevents a Data Principal from using the grievance mechanism in Clause 11.2, complaining to the Board, or exercising any other right under the DPDP Act, and nothing prevents either party from seeking urgent interim relief from the courts at Mumbai.

18.5Jurisdiction. Subject to Clauses 18.3 and 18.4, the courts at Mumbai, India have exclusive jurisdiction over any matter arising out of these Terms.

19.1Notices. Notices under these Terms shall be in writing. Routine notices to Skorydov shall be sent to myconsentapp@skorydov.com. Notices concerning termination, indemnification, a Dispute or service of process shall be sent to legal@skorydov.com and by registered post or courier to Skorydov’s registered office. Notices to You shall be sent to the email address on Your account or given by in-app notification, and are deemed received on transmission unless a delivery failure notice is received.

19.2Assignment. You shall not assign or transfer these Terms without Skorydov’s prior written consent. Skorydov may assign these Terms to an Affiliate or in connection with a merger, acquisition or sale of the business relating to the Platform, subject always to the DPDP Act and to any approval of the Board it requires.

19.3Sub-processors. Skorydov may engage sub-processors, such as cloud hosting and message delivery providers, and remains responsible for their acts and omissions as if they were its own. Sub-processors with access to business Content are engaged under Annexure A.

19.4Entire agreement. These Terms, the documents incorporated under Clause 1.6 and any applicable Order Form are the entire agreement between the parties on their subject matter and supersede all prior agreements and understandings. No term in a purchase order issued by a business has any effect.

19.5Severability. If any provision is held invalid or unenforceable, it shall be modified to the minimum extent necessary to make it enforceable or, failing that, severed, and the remaining provisions continue in full force.

19.6No waiver. No failure or delay in exercising any right operates as a waiver of it. No waiver is effective unless made in writing.

19.7Relationship of the parties. As between Skorydov and a business, the parties are independent contractors, and nothing creates a partnership, joint venture, agency or employment relationship.

19.8No third party rights. These Terms confer no rights on any person other than the parties and their permitted successors, save for the rights of Data Principals under the DPDP Act, which are unaffected.

19.9Force majeure. Neither party is liable for any failure or delay in performance (other than payment) caused by an event beyond its reasonable control, including natural disaster, war, civil unrest, epidemic, act of government, failure of internet, telecommunications or power infrastructure, or failure of a Third Party Service.

19.10Publicity. Skorydov may identify a business as a user of the Platform, and use its name and logo for that purpose, only with its prior written consent, which may be withdrawn at any time.

19.11Electronic execution. These Terms may be accepted electronically, and such acceptance is a valid and enforceable electronic record and, where applicable, electronic signature for the purposes of the Information Technology Act, 2000 and the Bharatiya Sakshya Adhiniyam, 2023.

19.12Interpretation. Unless the context requires otherwise: (a) “writing” includes email and in-app notification; (b) headings, margin notes and the plain language summary are for convenience only and do not affect interpretation; (c) “including” means “including without limitation”; (d) a reference to a statute includes any amendment or re-enactment and any rule made under it; and (e) the singular includes the plural.

19.13Language. These Terms are published in English. Where a translation is provided for convenience and differs from the English text, the English text prevails. The notices and consent requests shown to You by businesses are available in the languages the DPDP Act requires.

A1.1Scope and roles. This DPA applies where Skorydov processes Personal Data on the Customer’s behalf, such as contact details used to deliver consent requests and notifications. For that Personal Data the Customer is the Data Fiduciary and Skorydov is a Data Processor. It does not apply to consent records, which Skorydov keeps as a proposed Consent Manager on behalf of Data Principals, or to account and billing data, for which Skorydov is an independent Data Fiduciary.

A1.2Precedence. This DPA prevails over the rest of these Terms on its subject matter. An Order Form prevails over this DPA only where it expressly refers to the provision it varies.

A3.1Processing instructions. Skorydov shall process Personal Data only for the purposes in Schedule 1, on the Customer’s documented instructions consistent with the Platform’s functionality, or as required by law (in which case it shall inform the Customer first unless the law prohibits it).

A3.2No sale or secondary use. Skorydov shall not sell Personal Data, process it for its own purposes, use it to train any generally available model, or disclose it to any third party save as this DPA permits.

A3.3Unlawful instructions. If Skorydov reasonably believes an instruction infringes the DPDP Act, it shall inform the Customer without undue delay and may suspend that instruction until it is confirmed, amended or withdrawn.

A5.1Assistance. Taking into account the nature of the processing, Skorydov shall provide reasonable assistance to the Customer with security of processing, breach notification, Data Principal requests and any enquiry from the Board.

A6.1Personnel. Skorydov shall limit access to Personal Data to personnel who need it, each bound by written confidentiality obligations and given periodic data protection and security training.

A7.1Security safeguards. Skorydov shall maintain the safeguards in Schedule 2, and may update them provided no update materially reduces the overall level of protection.

A8.1Sub-processors. The Customer authorises Skorydov to engage sub-processors. Skorydov shall give not less than fifteen (15) days’ notice of an intended new or replacement sub-processor. The Customer may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected subscription and receive a pro rata refund of prepaid Fees. Skorydov shall impose on each sub-processor obligations no less protective than this DPA and remains responsible for them.

A9.1Data Principal requests. Data Principal requests about the Customer’s processing are routed to the Customer through the Platform. Skorydov shall not respond to the substance of a request made directly to it about the Customer’s processing, save as required by law, and shall promptly refer it to the Customer.

A10.1Personal data breach. Skorydov shall notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Personal Data processed on the Customer’s behalf. The notice shall describe, so far as then known, the nature and likely consequences of the breach, the categories and approximate volume of data and Data Principals affected, the measures taken or proposed, and a point of contact, with further information provided in phases. Skorydov shall cooperate with the Customer’s own intimation to the Board and to Data Principals.

A11.1Location of processing. Skorydov shall store and process Personal Data on infrastructure located in India, and shall not transfer it outside India save in accordance with Section 16 of the DPDP Act and with prior written notice to the Customer.

A12.1Audit and information. On written request, not more than once in any twelve (12) months, Skorydov shall provide information reasonably necessary to demonstrate compliance with this DPA. Where that information is insufficient, or following a personal data breach, the Customer may on thirty (30) days’ notice audit Skorydov’s processing at its own cost, subject to confidentiality and to protection of other customers’ data. Nothing limits any inspection by the Board.

A13.1Deletion and return. On expiry or termination, Skorydov shall make the Customer’s Content available for export for thirty (30) days, and shall then delete Personal Data processed on the Customer’s behalf from live systems within thirty (30) days and from backups within ninety (90) days, save where retention is required by law. Skorydov shall confirm deletion in writing on request.

A14.1Customer obligations. The Customer warrants that it has a lawful basis for the Personal Data it submits, shall give all notices and keep all records required of a Data Fiduciary, and is responsible for administering its own accounts and API keys.

A15.1Liability and law. Liability under this DPA is subject to the exclusions and limits in Clause 15. This DPA is governed by the laws of India and subject to Clause 18. Enquiries under it may be sent to dpo@skorydov.com.

S1Schedule 1. Details of processing. Subject matter: Personal Data processed to deliver the Business Services. Nature: collection, storage, retrieval, transmission, disclosure to sub-processors and erasure, by automated means. Purposes: delivering notices, consent requests, receipts and notifications; verifying consent status; routing Data Principal requests and grievances; support; security and misuse prevention; and legal compliance. Data Principals: the Customer’s customers, prospective customers and Authorised Users. Personal Data: names, mobile numbers, email addresses, preferred language, customer reference identifiers and consent preferences. Duration: the Subscription Term and the periods in A13.1.

S2Schedule 2. Security safeguards.

1. a documented information security programme reviewed at least annually;
2. least-privilege, role-based access, reviewed at least half-yearly, with unique credentials and multi-factor authentication for administrative access;
3. encryption of Personal Data in transit using TLS 1.2 or above and at rest using AES-256 or equivalent, with mobile numbers stored encrypted and keys managed separately;
4. logical segregation of each Customer’s data;
5. signed, append-only consent records and tamper-evident audit logs, retained and protected against alteration;
6. firewalls, network segmentation, monitoring and risk-prioritised patching;
7. vulnerability scanning at least quarterly and independent penetration testing at least annually;
8. encrypted backups, tested restoration, and documented business continuity and disaster recovery plans;
9. secure development with code review and testing, and no production Personal Data in test environments;
10. personnel confidentiality undertakings and training;
11. hosting in data centres in India with physical and environmental controls; and
12. a documented and tested incident response plan.

S3Schedule 3. Sub-processors. The current list of sub-processors is available on request to dpo@skorydov.com and is updated in accordance with A8.1.

B1.1Definitions. “Business Hours” means 09:30 to 18:30 IST on a Business Day. “Business Day” means any day other than a Saturday, Sunday or public holiday in Maharashtra. “Incident” means a reproducible failure of the Platform to operate materially in accordance with its documentation.

B2.1Support channels. Incidents may be logged by email to myconsentapp@skorydov.com or through the support feature in the console, and should include a description, the affected functionality, steps to reproduce and the time first observed. Support is provided in English and Hindi.

B3.1Severity and response targets.

1. Severity 1, Critical: the consent APIs or the individual app are wholly unavailable, with no workaround. Response within two (2) hours, 24x7; workaround target eight (8) hours.
2. Severity 2, High: a material function is degraded for multiple users, with a workaround. Response within four (4) Business Hours; workaround target two (2) Business Days.
3. Severity 3, Medium: a non-material function or a single user is affected. Response within one (1) Business Day.
4. Severity 4, Low: a cosmetic issue, question or feature request. Response within two (2) Business Days.

B4.1Service Credits. A claim must be made in writing to myconsentapp@skorydov.com within thirty (30) days of the end of the month. Service Credits for a month shall not exceed 10% of that month’s Fees, are applied against future Fees, and are the Customer’s sole remedy for failure to meet B3.1. No credit is payable for a month in which the Customer is in arrears.

B5.1Maintenance. Scheduled maintenance shall not exceed eight (8) hours a month, shall be scheduled outside Business Hours where reasonably possible, and shall be notified at least five (5) Business Days in advance. Emergency maintenance may be carried out at any time to protect security or integrity, with notice as soon as practicable.

B6.1Out of scope. Support does not include legal advice, drafting of notices, consultancy, custom development, or support for the Customer’s own systems or third party software.

B7.1Changes. Skorydov may amend these Support Terms on thirty (30) days’ notice, provided no amendment during a Subscription Term materially reduces B3.1.

C1.1Sandbox and trial. Sandbox and trial access requires no payment, so no refund arises. At the end of a trial a business may convert to a paid plan or let the account lapse.

C2.1Monthly subscriptions. Monthly plans may be cancelled at any time and cancellation takes effect at the end of the current billing cycle. No pro rata refund is given for mid-cycle cancellation because access continues until cycle end.

C3.1Annual subscriptions. Annual plans carry a fourteen (14) day cooling-off window from the start of the term, within which a full refund is available if the business has not issued live consent requests. After that, annual Fees are non-refundable, but the business may cancel to prevent renewal under Clause 10.3.

C4.1Enterprise contracts. Refunds under an Enterprise Agreement are governed by its Order Form. Absent specific terms, Fees for service already rendered are non-refundable.

C5.1Payment failures. If a scheduled payment fails, Skorydov will retry for seven (7) days and contact the business. If payment cannot be collected within fourteen (14) days, access may be suspended under Clause 17.1 and is restored on payment. Data Principals can still view and withdraw consents during any suspension.

C6.1Invoice disputes. Invoice disputes must be raised within thirty (30) days of the invoice date. Skorydov will respond within ten (10) working days. Please do not initiate a chargeback without first raising the matter with Skorydov.

C7.1Taxes. GST and similar taxes are charged at prevailing rates and are not refundable by Skorydov.

C8.1Refunds under these Terms. Where these Terms provide for a refund (including under Clauses 1.7, 14.2, 16.2 and 17.4 and A8.1), it is calculated pro rata for the unexpired Subscription Term unless the clause says otherwise.

C9.1How to request a refund. Write to myconsentapp@skorydov.com with the account name, invoice number and the nature of the request. Skorydov acknowledges within five (5) working days, responds within ten (10) working days, and processes approved refunds within thirty (30) working days to the original payment method.