These Terms of Use set forth the terms and conditions that apply to the access and use of the website https://www.tartanhq.com, including any sub-domains thereof, dashboards, interfaces, mobile applications and software providing application programming interfaces (APIs), (hereinafter collectively referred to as the “Technology Solutions”), which are owned, managed and operated by TartanHQ Solutions Private Limited, a private limited company incorporated under the Companies Act, 2013, having its registered office at WeWork, Vaswani Chambers, HD-015, Floor-2, Plot-264/265, Dr. Annie Besant Road, Worli Colony, Mumbai City, Mumbai, Maharashtra – 400030, India (hereinafter referred to as “Tartan”, “we”, “us”, “our” or the “Company”).
PLEASE READ THESE TERMS OF USE THOROUGHLY AND CAREFULLY. These Terms of Use constitute a legal and binding agreement between Tartan and the User. By accessing, using, visiting, registering for, and/or otherwise engaging with the Technology Solutions in any manner whatsoever, and by clicking on “I have read and agree to the terms of use”, you hereby certify that you are either:
a person who has approached Tartan for access to payroll, employment or other information of an End User on the basis of lawful consent obtained from such End User (“Customer”, “You”, “Your” or “User”);
a person whose data or information is accessed, transmitted, uploaded or stored subject to these Terms of Use (“End User”, “You”, “Your” or “User”); or
an internet surfer or visitor (“You” or “User”).
You acknowledge and agree that your use of the Technology Solutions shall constitute your acceptance of these Terms of Use, the Privacy Policy of the Company and any other documents incorporated by reference herein. If you do not agree to the foregoing, you should not click to affirm your acceptance thereof, in which case you are prohibited from accessing or using the Technology Solutions.
This document is an electronic record published in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and other Applicable Laws, as amended from time to time, and is generated by a computer system that does not require any physical or digital signatures.
In the event the Company enters into a specific written agreement with you governing commercial or licensing terms, the terms of such agreement shall prevail over these Terms of Use to the extent of any inconsistency
PRIVACY POLICY
Please visit and review our Privacy Policy, which will also govern Your visit to the Technology Solutions, to understand our practices. These Terms of Use shall be read along with the Privacy Policy which will help You understand the limits of Your usage of the Technology Solutions, what information we collect, why we collect it, and how You can update, manage, export, and delete Your information. If You object or withdraw Your consent to Your information being stored, transferred or used as per the Privacy Policy of the Company, please do not use or stop using the Technology Solutions. The Privacy Policy is located at https://www.tartanhq.com/privacy-policy
Modifications to Terms of Use and/ or Privacy Policy
The Company reserves the right, in its sole discretion, to change, modify, or otherwise amend the Terms of Use and Privacy Policy and any other applicable company policies or documents incorporated by reference herein, at any time, and it will post the amended terms at the Technology Solutions. Kindly review the Terms of Use/ Privacy Policy for any changes and You are encouraged to check the same frequently. Your continuous use of the Technology Solutions following any such amendments will signify Your assent to and acceptance of the revised terms. If You do not agree to abide by these or any future Terms of Use or Privacy Policy, please do not try to use or access the Technology Solutions.
SCOPE OF THE TECHNOLOGY SOLUTIONS
Tartan, acting as a Technology Solutions provider which technology is used for processing of data, makes available licensed Technology Solutions that enable Customers to securely access, synchronise, verify and process personal data, enterprise data, including payroll, employment data, financial accounts and related information of End Users, by leveraging integrations with enterprise systems such as human resource management systems (“HRMS”), payroll systems and other third-party Information Providers, strictly on the instructions of the Customer and in accordance with Applicable Laws.
The Technology Solutions comprise modular and configurable software, APIs and related technological infrastructure that enable, inter alia, secure data synchronisation and orchestration with enterprise systems such as HRMS, payroll systems and other internal data repositories; automated and rule-based verification and validation of employment, income, payroll and related information accessed through integrated systems; and application-layer tools, automation frameworks and system-driven interfaces, including configurable applications and chatbot-enabled tools, designed to facilitate operational workflows and controlled access to information, as may be made available by Tartan from time to time.
A broad description of the Technology Solutions and the functionality that Tartan enables is available on Tartan’s website. You acknowledge that Tartan is not bound to provide any or all of the Technology Solutions and may, at its sole discretion, modify, add, alter, replace, or remove any or all aspects of functionalities at any time in a manner that it may so deem fit.
For the avoidance of doubt, Tartan retains discretion solely with respect to the technological manner in which the Technology Solutions are delivered, including the choice of cloud infrastructure, hosting environment and system architecture, provided that such choices remain compliant with Applicable Law and applicable contractual obligations.
ROLE OF TARTAN
Tartan operates solely as a Technology Solution provider and licensor of the Technology Solutions. In the context of the Technology Solutions and processing activities covered under these Terms, Tartan acts as a Data Processor within the meaning of the Digital Personal Data Protection Act, 2023.
Tartan does not act as an employer, lender, financial institution, intermediary, agent, fiduciary, advisor or representative of any User, Customer, End User or Information Provider.
Where personal data of an End User is accessed or processed through the Technology Solutions, the Technology Solutions process the data strictly on the documented instructions of the Customer and solely to the extent technically necessary to enable the functioning of the Technology Solutions. The Customer shall be regarded as the data fiduciary for the purposes of the Digital Personal Data Protection Act, 2023 and other Applicable Laws, as the Customer determines the purpose and means of such processing.
Tartan does not independently determine the purpose or means of processing of personal data, does not verify the legality of data collection by the Customer, and does not assume responsibility for the Customer’s compliance with sector-specific, regulatory or statutory obligations, including obligations relating to consent, notice, retention or lawful use of personal data.
AUTHORITY TO ACCESS & REPRESENTATIONS
Access to the Technology Solutions is available only to persons who are competent to enter into legally binding contracts under Applicable Laws. The User represents, acknowledges and agrees that:
(a) the User or the entity on whose behalf access is sought is at least eighteen (18) years of age and duly authorised to contract;
(b) the User has the lawful authority and capacity to be bound by these Terms;
(c) all information provided during registration or access is true, accurate and complete;
(d) such information shall be kept accurate and up to date; and
(e) the User’s access to and use of the Technology Solutions shall not violate Applicable Laws.
Tartan reserves the right to suspend or terminate access where it reasonably believes that these conditions are not met.
Access to certain features of the Technology Solutions may require the creation of a User account (“Account”). The User may be required to provide registration details, including name, email address and contact information, and Tartan may request additional information as reasonably required for Account creation or access. The User consents to the collection and processing of such information strictly for access control, security and operational purposes.
Upon registration, the User or its authorised representative may be issued login credentials or access identifiers (“Access Credentials”). The Customer or its representative will be provided with a User ID and You will need to provide a password. The User shall ensure that Access Credentials are kept confidential and are used only by authorised personnel. Tartan shall not be responsible for any unauthorised access resulting from the User’s failure to safeguard Access Credentials.
The User acknowledges that it is solely responsible for all activity carried out using its Access Credentials and for restricting access to devices or systems through which the Technology Solutions are accessed. Tartan shall not be liable for any loss or damage arising from unauthorised use attributable to the User.
Tartan reserves the right, at its sole discretion, to refuse registration, suspend or terminate access where activities associated with an Account would or might: (a) violate these Terms;(b) infringe the rights of any third party or Applicable Laws; or (c) misrepresent your identity.
Subject to Applicable Laws, Tartan may restore access following suspension or restriction where the underlying issue has been resolved. Fees, if any, paid for access to the Technology Solutions are non-refundable unless expressly agreed otherwise in writing or required under Applicable Laws.
GRANT OF LICENSE AND ACCESS
Tartan grants the User a limited, revocable, non-exclusive, non-transferable and non-sublicensable license to access and use the Technology Solutions solely for lawful purposes and within the scope permitted under these Terms. No ownership or proprietary rights in the Technology Solutions are transferred to the User.
Where enabled as part of the Technology Solutions, the Customer may retrieve or download End User data strictly in accordance with these Terms and Applicable Laws. The Customer shall ensure that any access, use, disclosure or processing of such data is undertaken only for lawful purposes and pursuant to valid authority and, where required, explicit consent obtained from the relevant End User.
Any unauthorised access to or use of the Technology Solutions, or any misuse of data accessed through the Technology Solutions, shall result in immediate termination of the license granted herein, without prejudice to any other rights or remedies available to Tartan under law. The User shall not directly or indirectly use the Technology Solutions for any unlawful purpose or in breach of Applicable Laws.
DATA LICENSING
To the extent the User, Customer or any authorised entity provides, uploads, transmits or otherwise makes available any data, including personal data, through the Technology Solutions, such User grants Tartan a limited, non-exclusive, revocable and purpose-restricted permission to process such data solely to the extent technically necessary to enable, operate, maintain, secure and support the Technology Solutions, and strictly in accordance with these Terms and Applicable Laws.
For the avoidance of doubt:
(a) no ownership rights, intellectual property rights or proprietary interests in any data are transferred to Tartan;
(b) Tartan does not use, retain or process such data for any independent commercial purpose; and
(c) Tartan’s processing of data is incidental to providing licensed technological access and is carried out only on the documented instructions of the Customer acting as data fiduciary.
The User acknowledges that Tartan does not determine the purpose or means of processing of personal data and does not verify the legality, accuracy or completeness of data provided by or on behalf of the User.
Upon suspension or termination of access to the Technology Solutions, Tartan shall cease further processing of personal data, except to the extent required under Applicable Law. Subject to settlement of outstanding dues and upon written request of the Customer acting as data fiduciary, such data shall be returned or securely deleted within ninety (90) days, unless retention is required by Applicable Law.
USER REPRESENTATIONS, WARRANTIES & PERMITTED USE
Access to and use of the Technology Solutions is subject to the following representations and undertakings by the User:
The User shall access and use the Technology Solutions only through authorised and lawful means and strictly in accordance with these Terms and Applicable Law.
Any configuration, set-up or use of devices, systems, networks or infrastructure required to access the Technology Solutions shall be the sole responsibility of the User.
The User represents and warrants that all information, data and documents provided by or on behalf of the User in connection with access to or use of the Technology Solutions are true, accurate and complete in all respects, and Tartan shall be entitled to rely on the same for the purpose of enabling the Technology Solutions.
The User acknowledges that Tartan acts solely as a data processor and Technology Solutions provider and processes personal data strictly on the documented instructions of the Customer acting as data fiduciary. The Customer represents and warrants that it has obtained all necessary, valid and lawful consents, notices and authorisations from End Users for the access, processing, transmission and sharing of personal and non-personal data through the Technology Solutions in accordance with Applicable Law.
The User shall be solely responsible for (i) procuring and maintaining network connections and telecommunications links from their systems to Tartan’s data centres, and (ii) all problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to their network connections or telecommunications links or caused by the internet.
The User shall ensure that access to and use of the Technology Solutions, including any access to End User data, is undertaken solely for lawful purposes and within the scope of authority and consent obtained from the relevant End Users.
PROHIBITED USE
The User shall not, directly or indirectly, whether by itself or through any third party:
take any action that interferes with, degrades, disrupts or adversely affects the Technology Solutions, Tartan, or any systems, networks or infrastructure connected thereto;
use the Technology Solutions in any manner that is prohibited by Applicable Law, facilitates the violation of Applicable Law, disrupts the use of the Technology Solutions by any third party, or violates or compromises the security, integrity or availability of the Technology Solutions;use the Technology Solutions, or any portion thereof, to transmit, publish, upload, distribute or otherwise make available any content that is unlawful, misleading, deceptive, defamatory, obscene, abusive, harassing, harmful, or otherwise objectionable;
upload, post, transmit or otherwise make available any content that contains viruses, malware, malicious code or any other program or data designed to interrupt, damage, destroy or limit the functionality of any computer system, software, hardware or network, or to provide unauthorised access thereto;
use any automated means, including but not limited to robots, spiders, scrapers, offline readers or similar tools, to access, extract, monitor or copy any portion of the Technology Solutions except as expressly permitted in writing by Tartan;
attempt to gain unauthorised access to the Technology Solutions, Account, systems, servers or networks connected to the Technology Solutions, or to obtain any data or information through hacking, password mining or any means not intentionally made available by Tartan;
use, misuse or misappropriate the Technology Solutions or any data accessed through the Technology Solutions to develop, benchmark, support or assist in the development of any competing product, platform, technology solutions or service;
copy, reproduce, distribute, publish, transmit, display, create derivative works of, or otherwise exploit the Technology Solutions, including any customisations, modifications, enhancements, translations or localisations, except as expressly permitted under these Terms;
reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, underlying ideas, algorithms or structure of the Technology Solutions;
remove, obscure or alter any proprietary notices, trademarks, logos, copyrights or other intellectual property notices displayed on or in connection with the Technology Solutions;
make the Technology Solutions or any content thereof available through any shared or public communication system, including local networks, intranets, extranets, FTP servers, peer-to-peer networks, bulletin boards, forums or similar systems, or host the Technology Solutions on any server accessible via a public network;
rent, lease, sell, sublicense, assign, transfer or otherwise commercialise any rights in or to the Technology Solutions, or authorise any portion of the Technology Solutions to be copied onto another individual’s or entity’s device, except as expressly permitted under these Terms; or
use the Technology Solutions in any manner that infringes the intellectual property, privacy or other legal rights of Tartan or any third party.
The User shall not use the Technology Solutions to send, transmit, publish or otherwise communicate any messages or content that: (a) propose or facilitate national or international money transfers outside the scope of the permitted functionalities; (b) attempt to directly or indirectly engage with other Users by circumventing Tartan or the Technology Solutions; (c) promote, offer, solicit or market any products or services that are not expressly authorised by Tartan; or (d) constitute unsolicited advertising, marketing communications, spam or promotional material relating to external Technology Solutions, services or websites.
Further, while accessing or using the Technology Solutions, the User shall not: (a) post or transmit content in inappropriate categories or areas; (b) violate any Applicable Law, third-party rights, internal policies, or any provision of these Terms; (c) fail to make payments due for licensed access; (d) circumvent, manipulate or interfere with fee structures, billing mechanisms or charges; (e) upload or disseminate false, misleading, defamatory or libellous information, including personal data of any User; or (f) engage in conduct that undermines the integrity, operation or legitimate use of the Technology Solutions. Upon withdrawal of consent by an End User, the Customer shall immediately cease storing, processing, transmitting or otherwise using such End User’s personal data in accordance with Applicable Law.
Any violation of this clause shall constitute a material breach of these Terms and may result in immediate suspension or termination of access to the Technology Solutions, without prejudice to any other rights or remedies available to Tartan under law.
THIRD-PARTY SYSTEMS AND INFORMATION PROVIDERS
The Technology Solutions may enable connectivity, integration or interoperability with third-party systems, platforms or information providers, including but not limited to human resource management systems (HRMS), payroll systems, enterprise applications or bank-approved middleware, solely for the purpose of facilitating access to or processing of data as permitted under these Terms.
Tartan does not own, operate, manage or control any third-party systems or information providers and does not make any representation, warranty or assurance of any kind in relation to the availability, accuracy, completeness, legality, reliability or performance of such third-party systems or the data made available therefrom.
The User acknowledges that any data accessed through third-party systems may be subject to limitations, delays, inaccuracies, interruptions or errors inherent to such systems. Tartan shall not be responsible or liable for any loss, damage or issue arising from or attributable to the operation, performance or failure of any third-party system or Information Provider.
Any access to, reliance upon, or interaction with a third-party system or Information Provider shall be governed solely by the terms and arrangements between the User and such third party, and Tartan shall not be a party to, nor responsible for, any such relationship.
DATA PROTECTION & PROCESSING FRAMEWORK
Personal data processed through the Technology Solutions shall be handled in accordance with the Digital Personal Data Protection Act, 2023 and other Applicable Laws.
The User acknowledges and agrees that:
the User acts as the Data Fiduciary in respect of End User personal data, as it determines the purpose and means of processing of such personal data; and
the Technology Solutions Provider acts solely as a Data Processor, processing personal data strictly on the documented instructions of the User and only to the extent necessary to enable and operate the Technology Solutions.
The User shall be solely responsible for obtaining valid consent from End Users, providing requisite notices and disclosures, and ensuring lawful collection, use, retention, sharing and deletion of personal data.
The Technology Solutions Provider shall not determine the purpose or means of processing of personal data and shall have no obligation to verify, monitor or assess the legality, accuracy or compliance of any personal data or processing activities carried out by the User.
Upon suspension or termination of access to the Technology Solutions, the Technology Solutions Provider shall cease further processing of personal data, except to the extent required for compliance with Applicable Laws, dispute resolution or enforcement of the Technology Solutions Provider’s legal rights.
Subject to settlement of all outstanding dues and upon written request from the User acting as Data Fiduciary, personal data shall be returned or securely deleted within ninety (90) days, unless retention is required by law.
For the avoidance of doubt, no End User shall have the right to make such request directly to the Technology Solutions Provider.
The Technology Solutions Provider shall not be responsible or liable for any misuse, over-retention, unauthorised disclosure or unlawful processing of personal data by the User or any third party acting on its behalf.
Nothing in this Clause shall be construed as creating any fiduciary, joint controllership, agency or partnership relationship between the Technology Solutions Provider and the User.
CONSENT & END USER RIGHTS
The Customer represents and warrants that it has obtained, and shall at all times maintain, valid, free, informed, specific and revocable consent or other lawful basis under Applicable Laws for accessing, processing, transmitting or otherwise using the personal data of End Users through the Technology Solutions.
The Customer acknowledges that it acts as the Data Fiduciary in respect of End User personal data and shall be solely responsible for:
providing all notices required under Applicable Law;
enabling End Users to exercise their rights, including the right to withdraw consent; and
responding to any End User requests, grievances or claims relating to consent, data accuracy, access, correction, erasure or restriction of processing.
Tartan shall not be responsible for obtaining consent from End Users or for responding to End User requests except to the extent expressly required under Applicable Laws in its capacity as a Data Processor acting on instructions of the Customer.
Upon withdrawal of consent by an End User, the Customer shall immediately cease further access, use or processing of such End User’s personal data through the Technology Solutions.
Nothing in this clause shall be construed as requiring the Technology Solutions Provider to independently interact or communicate with End Users or to assess the validity, scope or sufficiency of any consent obtained by the User.
Tartan does not and shall not be responsible for addressing, resolving or managing any employment-related, contractual, service-related or personal grievances raised by employees, End Users or customers of the Customer or any other corporate entity. All such grievances, including those relating to employment terms, payroll decisions, benefits, access to data, consent withdrawal or internal policies, shall be solely the responsibility of the relevant employer, organisation or corporate entity, as applicable.
For the avoidance of doubt, no grievance, claim or dispute arising between a Customer and its employees, or between a corporate entity and its customers, shall be attributable to or imposed upon Tartan in its capacity as a Technology Solutions Provider or Data Processor
DISCLAIMER OF WARRANTIES
The User expressly agrees that access to and use of the Technology Solutions is undertaken at the User’s sole risk.
To the fullest extent permitted under Applicable Law, Tartan disclaims all warranties, whether express, implied, statutory or otherwise, and makes no representations, warranties or guarantees of any kind in relation to the Technology Solutions, any functionalities made available thereon, or any data, materials or content accessed, processed or transmitted through the Technology Solutions, including without limitation as to the quality, suitability, accuracy, truth, completeness or reliability of any information or material.
Unless otherwise expressly stated, and to the maximum extent permitted under Applicable Law, the Technology Solutions and all data, materials and information made available through the Technology Solutions, including information derived from End User accounts or provided by End Users, Customers or third parties, are provided on an “as is”, “as available” and “where is” basis, without any warranty of merchantability, fitness for a particular purpose, or non-infringement of third-party rights.
Tartan does not warrant or represent that the Technology Solutions or any data or information accessed through the Technology Solutions will be free from errors, mistakes, inaccuracies or omissions, nor does it provide any warranty against unauthorised access to or use of systems, servers or any personal, financial or other information stored therein, or against bugs, viruses, trojan horses or other harmful components that may be transmitted to or through the Technology Solutions by any third party.
Tartan does not warrant uninterrupted or error-free operation of the Technology Solutions and shall not be liable for any interruption, suspension, cessation or failure of transmission to or from the Technology Solutions, or for any defamatory, offensive or unlawful conduct of any third party, Customer, End User, service user, service provider or Information Provider.
The User acknowledges that Tartan does not control the transfer of data over communications facilities, including the internet, and that the Technology Solutions may be subject to inherent limitations, delays or technical issues. Tartan shall not be responsible for any delays, delivery failures or other damages arising from such limitations or from User-provided or third-party content.
Tartan makes no representation or warranty regarding the reliability, accuracy, completeness, correctness or usefulness of any third-party content, including data accessed from third-party databases or Information Providers, and disclaims all liability arising from or related to such third-party content.
The User further agrees that it is solely responsible for ensuring compliance with any third-party terms, guidelines, operating rules or policies applicable to the User’s use of the Technology Solutions, without any recourse to Tartan.
Tartan reserves the right, at any time and from time to time, in its sole discretion, to modify, suspend or discontinue the Technology Solutions or any part thereof, temporarily or permanently, with or without notice, and Tartan shall not be liable to the User or any third party for any such modification, suspension or discontinuance.
For avoidance of doubt, Tartan’s role is limited to enabling technological validation and processing workflows, and Tartan does not independently audit, verify or certify the source data provided by End Users or third parties. Any identification, investigation or audit of inaccuracies in such source data is outside the scope of the Technology Solutions.
CONFIDENTIALITY
The Technology Solutions may enable the submission, access to or transmission of information, data or content by Users, including business information, operational data, feedback and personal data of End Users (“Submitted Content”).
Each party acknowledges that, subject to Applicable Laws and these Terms, it shall maintain the confidentiality of any non-public, proprietary or confidential information disclosed by the other party in connection with the use of the Technology Solutions (“Confidential Information”) and shall not disclose such Confidential Information to any third party except as expressly permitted under these Terms or required under Applicable Law.
Notwithstanding the foregoing, Tartan may disclose Confidential Information, including personal data, where Tartan reasonably believes that such disclosure:
has been made pursuant to valid instructions or consent obtained by the Customer acting as Data Fiduciary;
is necessary to enable the operation or provision of the Technology Solutions in accordance with these Terms;
is required to comply with Applicable Law, a lawful order, court process or request of a governmental or regulatory authority;
is necessary to protect the rights, property or security of Tartan, Users or the public;
is required to enforce these Terms, the Privacy Policy or any related agreement; or
is necessary to prevent, investigate or address suspected fraud, security incidents or unlawful activity.
The User acknowledges that Tartan acts solely as a technology solution provider and data processor and does not assume responsibility for the confidentiality of Submitted Content once such content is accessed, downloaded or otherwise used by the Customer or any authorised third party in accordance with these Terms.
INTELLECTUAL PROPERTY RIGHTS
All intellectual property rights in and to the Technology Solutions, including the website, dashboards, interfaces, software, APIs, architecture, algorithms, workflows, documentation, text, graphics, logos, trademarks, service marks, designs, know-how, source code, databases (excluding Submitted Content), and all related proprietary materials (“Technology Solutions IP”), are owned by or licensed to Tartan.
Except for the limited licence expressly granted under these Terms, no right, title or interest in the Technology Solutions IP is transferred to any User. All rights not expressly granted are reserved by Tartan.
The Technology Solutions IP is provided to you solely for your internal business use in connection with the permitted use of the Technology Solutions and may not be copied, reproduced, distributed, transmitted, sublicensed, sold, modified, reverse engineered or otherwise exploited without Tartan’s prior written consent.
You shall not remove, obscure or alter any proprietary notices, trademarks, copyright notices or other intellectual property markings displayed on or in connection with the Technology Solutions.
For the avoidance of doubt, personal data and Submitted Content shall not be treated as intellectual property of Tartan.
DATA SECURITY & RETENTION
Tartan shall implement and maintain reasonable technical and organisational measures designed to protect the security, confidentiality and integrity of data processed through the Technology Solutions, taking into account the nature of the data, industry standards, and the requirements under Applicable Law.
Such measures shall be intended to safeguard data against unauthorised access, disclosure, alteration or destruction while the data is processed within the Technology Solutions. The User acknowledges that no system can be completely secure and that Tartan does not guarantee absolute security of data transmitted or stored through the Technology Solutions.
Tartan shall process and retain personal data only for such duration as is strictly necessary to enable the functioning of the Technology Solutions or to comply with Applicable Law. Tartan does not retain personal data for independent commercial or analytics purposes.
Upon suspension or termination of access to the Technology Solutions, or upon expiry of the applicable commercial or licensing arrangement, Tartan shall cease further processing of personal data, except to the extent required under Applicable Law. Subject to settlement of all outstanding dues and upon written request of the Customer acting as data fiduciary, such personal data shall be securely returned or permanently deleted within ninety (90) days, unless a longer retention period is required under Applicable Law.
The Customer acknowledges and agrees that it remains solely responsible for determining data retention periods under Applicable Law, responding to End User requests relating to deletion or withdrawal of consent, and ensuring that instructions provided to Tartan in relation to retention or deletion are lawful and compliant with Applicable Law.
Tartan shall not be responsible for any data retained, stored or processed by the Customer or any third party outside the Technology Solutions following retrieval or download of such data by the Customer.
LIMITATION OF LIABILITY
To the maximum extent permitted under Applicable Law, Tartan shall not be liable to the User for any direct, indirect, incidental, special, punitive, exemplary or consequential damages whatsoever, including without limitation loss of business, revenue, profits, goodwill, data, use or any other economic advantage, arising out of or in connection with the access to or use of, or inability to access or use, the Technology Solutions, whether based on contract, tort, negligence, strict liability or otherwise, and whether or not Tartan has been advised of the possibility of such damages.
In no event shall the aggregate liability of Tartan, its directors, officers, employees, affiliates or licensors, arising out of or relating to the Technology Solutions, Submitted Content or these Terms, exceed the total fees actually paid by the Customer to Tartan for access to the Technology Solutions during the two (2) month period immediately preceding the event giving rise to the claim.
Without prejudice to the foregoing, Tartan shall not be liable for any loss, damage or liability arising from or relating to:
any errors, omissions, mistakes or inaccuracies in data, content or information made available through the Technology Solutions, including data originating from End Users or Information Providers;
any personal injury, property damage or other harm resulting from the use of the Technology Solutions;
any acts or omissions of Users, Customers, End Users, Information Providers or other third parties;
any delay, interruption, suspension, degradation or failure of the Technology Solutions;
any loss or damage resulting from the User’s failure to comply with these Terms or Applicable Law;
any failure by the Customer to obtain valid, lawful and informed consent from End Users for the collection, access, processing, transmission or use of personal data;
any defamatory, offensive, unlawful or otherwise objectionable conduct of any User or third party;
any viruses, malware, harmful code or other technologically harmful components that may be transmitted to or through the Technology Solutions by any third party, notwithstanding reasonable security measures implemented by Tartan.
The User acknowledges and agrees that the entire risk arising out of (i) access to or use of the Technology Solutions, and (ii) reliance on any data or output made available therefrom, remains solely with the User.
Nothing in these Terms shall exclude or limit liability to the extent such exclusion or limitation is prohibited under Applicable Law.
INDEMNITY
The User agrees to defend, indemnify and hold harmless Tartan, its directors, officers, employees, affiliates, licensors, service providers, agents, consultants, successors and permitted assigns from and against any and all claims, demands, actions, proceedings, damages, losses, liabilities, costs and expenses (including reasonable legal fees and court costs) arising out of or in connection with:
the User’s access to or use of the Technology Solutions;
any breach of these Terms, the Privacy Policy or any other document incorporated herein by reference;
any violation of Applicable Laws by the User, including data protection, privacy or sector-specific regulatory obligations;
any infringement or alleged infringement of the rights of any third party, including intellectual property rights or privacy rights, arising from the User’s use of the Technology Solutions or Submitted Content;
any claim that Submitted Content provided by or on behalf of the User caused harm, loss or damage to any third party;
any failure by the Customer to obtain valid, lawful and informed consent from End Users for the collection, access, processing, transmission or use of personal data through the Technology Solutions; and
any acts or omissions of the User, its employees, agents or representatives in connection with access to or use of the Technology Solutions.
For the avoidance of doubt, Tartan shall not be responsible for, and the User shall indemnify Tartan against, any claims, penalties, regulatory actions, damages or losses arising from the Customer’s business operations, internal decision-making, employee grievances, or downstream use of data outside the Technology Solutions.
This indemnity obligation shall survive suspension or termination of access to the Technology Solutions and expiry of these Terms.
TERM & TERMINATION
These Terms shall come into effect on the date the User first accesses or uses the Technology Solutions and shall remain in force unless terminated or suspended in accordance with this Clause.
Termination by Tartan
Tartan may, at its sole discretion and without prior notice, suspend or terminate the User’s access to the Technology Solutions, deactivate any Account, or restrict access (in whole or in part), where:
the User breaches these Terms, the Privacy Policy, or any document incorporated herein by reference;
Tartan reasonably believes that the User’s access or use poses a legal, regulatory, security or reputational risk;
such suspension or termination is required under Applicable Laws or pursuant to a lawful direction of any governmental or regulatory authority;
Tartan elects to discontinue or materially modify the Technology Solutions or any part thereof; or
the User’s Account remains inactive for a continuous period of sixty (60) days.
Any such suspension or termination shall not entitle the User to any compensation, refund or damages, except to the extent required under Applicable Law.
Termination by the User
The User may terminate its relationship with Tartan at any time by discontinuing access to and use of the Technology Solutions and, where applicable, closing its Account.
Where the User is a Customer availing licensed or paid access, termination shall be subject to the notice period and payment obligations set out in the applicable commercial or licensing arrangement. Unless otherwise agreed in writing, the Customer shall remain liable for all fees accrued up to the effective date of termination.
Effect of Suspension or Termination
Upon suspension or termination of access to the Technology Solutions, whether in whole or in part:
all rights granted to the User under these Terms shall immediately cease, and the User shall immediately discontinue all access to and use of the Technology Solutions;
Tartan shall immediately cease all processing of personal data on behalf of the Customer, except to the limited extent required to comply with Applicable Laws or to effect the orderly suspension, return or deletion of data in accordance with lawful instructions of the Customer acting as data fiduciary;
upon written request of the Customer, and subject to settlement of all outstanding dues, all personal data processed through the Technology Solutions shall be returned to the Customer or securely deleted within ninety (90) days, unless a longer retention period is required under Applicable Law;
Tartan shall not retain, use or process any personal data following suspension or termination for any independent or commercial purpose; and
Tartan shall not be responsible for any data retained, stored or processed by the Customer or any third party outside the Technology Solutions following retrieval or download of such data by the Customer.
For the avoidance of doubt, upon suspension or termination of access to the Technology Solutions, Tartan does not and shall not continue any data processing activities on behalf of the Customer, except where such processing is expressly required under Applicable Law. Termination or suspension shall not affect any rights or obligations accrued prior to the effective date thereof. Provisions relating to data protection, confidentiality, intellectual property, limitation of liability, indemnity, governing law and dispute resolution, and any other provisions which by their nature are intended to survive, shall survive termination.
FORCE MAJEURE
Tartan shall not be liable for any delay or failure in performance under the Terms of Use arising out of reasons beyond its control and without its fault or negligence. Such causes may include, but are not limited to, fires, floods, earthquakes, pandemics, epidemics, strikes, unavailability of necessary utilities, blackouts, acts of God, acts of declared or undeclared war, acts of regulatory agencies, or national disasters or any other act that is beyond the control of Tartan.
MODIFICATION OF TERMS
The Technology Solutions Provider reserves the right to modify these Terms at any time. Continued use of the Technology Solutions following such modification shall constitute acceptance of the revised Terms.
VIOLATION OF THESE TERMS OF USE AND PRIVACY POLICY
You agree that any violation of this Terms of Use and Privacy Policy will constitute an unlawful and unfair business practice, and will cause irreparable harm to us, for which monetary damages would be inadequate, and You consent to us obtaining any injunctive or equitable relief that we deem necessary or appropriate. You agree that these remedies are in addition to any other remedies that we may have at law or in equity.
GOVERNING LAW & DISPUTE RESOLUTION
The Terms of Use shall be governed in all respects by the laws of India and any legal proceeding arising out of these Terms of Use will occur exclusively in the courts located in Mumbai, India.
If a dispute arises between You and the Company, our goal is to provide You with neutral and cost-effective means of resolving the dispute quickly. Accordingly, You and the Company hereby agree that we will resolve any claim or controversy at law and equity that arises out of or in relation to the Terms of Use, the Privacy Policy or the Technology Solutions will be resolved in accordance with the provisions contained herein. Prior to resorting to formal ways of dispute resolution, we strongly encourage You to first contact Tartan directly to seek a resolution as per the grievance redressal procedure set out here in below.
If not resolved with Tartan, any further dispute shall be settled amicably by the parties to the dispute within 30 (thirty) calendar days of the receipt of the notice of the existence of a dispute. In the event any dispute cannot be resolved within 30 (thirty) calendar days from notice of the dispute, either party may refer the dispute to be finally settled by arbitration in accordance with the Indian Arbitration and Conciliation Act, 1996 and the rules framed thereunder, as amended from time to time. The arbitration proceedings shall be conducted by a sole arbitrator mutually appointed by the parties. The venue and seat of arbitration shall be Mumbai, India and the arbitration proceedings shall be conducted in English language.
MISCELLANEOUS
These Terms of Use read with the Privacy Policy and other agreements entered into with You (if any), constitutes the entire agreement between You and the Company and governs Your use of the Technology Solutions, superseding any prior agreements between You and the Company with respect to the Technology Solutions.
If any of these conditions are deemed invalid, void, or for any reason unenforceable, the parties agree that the court should endeavour to give effect to the party's intentions as reflected in the provision, and the unenforceable condition shall be deemed severable and shall not affect the validity and enforceability of any remaining condition.
The Technology Solutions may contain advertising and sponsorship. Advertisers and sponsors are responsible for ensuring that material submitted for inclusion is accurate and complies with applicable laws. We will not be responsible for the illegality of or any error or inaccuracy in advertisers’ or sponsors’ materials or for the acts or omissions of advertisers and sponsors.
No waiver of any provision of these Terms of Use shall be deemed a further or continuing waiver of such term or any other term, and the Company's failure to assert any right or provision under these. Terms of Use shall not constitute a waiver of such right or provision.
The User shall not assign or transfer these Terms, in whole or in part, without the prior written consent of the Technology Solutions Provider. The Technology Solutions Provider may assign or transfer these Terms in connection with a merger, acquisition, corporate restructuring or transfer of business without prior notice to the User.
Nothing contained in these Terms shall be construed as creating any partnership, joint venture, agency, fiduciary or employment relationship between the User and the Technology Solutions Provider.
These Terms are for the sole benefit of the User and the Company. No End User or third party shall have any rights or remedies under these Terms.
Clauses relating to data protection, confidentiality, intellectual property, limitation of liability, indemnity, dispute resolution and any other provisions which by their nature are intended to survive shall survive termination or expiry of these Terms.
DEFINITIONS & INTERPRETATION
For the purposes of these Terms of Use, unless the context otherwise requires, the following capitalised terms shall have the meanings ascribed to them below:
“Applicable Laws” means all statutes, enactments, laws, rules, regulations, notifications, guidelines, circulars, directions, governmental approvals and judicial or regulatory orders applicable in India, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the rules made thereunder, as amended from time to time.
“Account” means the user account created by a User for accessing the Technology Solutions, together with the associated Access Credentials.
“Access Credentials” means the login credentials, identifiers, authentication keys, passwords or similar access mechanisms issued or enabled by Tartan to permit access to the Technology Solutions.
“Customer” means a business entity, financial institution, employer or other organisation that accesses the Technology Solutions pursuant to a commercial or licensing arrangement with Tartan and acts as the data fiduciary in respect of End User personal data.
“Data Fiduciary” shall have the meaning ascribed to it under the Digital Personal Data Protection Act, 2023.
“Data Processor” shall have the meaning ascribed to it under the Digital Personal Data Protection Act, 2023.
“End User” means an individual whose personal, employment, payroll or related information is accessed, transmitted or processed through the Technology Solutions pursuant to a lawful request of the Customer.
“Information Providers” means any third-party system, employer, payroll provider, HRMS provider, financial institution or other entity from which data is accessed or integrated into the Technology Solutions.
“Submitted Content” means any data, information, content or material uploaded, transmitted, submitted or otherwise made available by or on behalf of a User through the Technology Solutions.
“Technology Solutions” means the proprietary technological infrastructure, software modules, APIs, dashboards, interfaces, tools and related systems owned or licensed by Tartan and made available under these Terms.
“User” means any person or entity accessing or using the Technology Solutions, including a Customer, End User or any other visitor, as applicable.
CONTACT INFORMATION
All communications to Tartan relating to the Terms of Use, any instance of violation of Intellectual Property or breach of these Terms of Use shall be in writing and sent to the address set out below, or as otherwise communicated from time to time.
Address: WeWork, Vaswani Chambers, HD-015, Floor-2, Plot - 264/265, , Dr
Annie Besant Road, Worli Colony, Mumbai City MH 400030 IN
Email: support@tartanhq.com
All communications to You relating to these Terms of Use shall be sent to the registered phone number and email ID attached to Your Account, or as otherwise communicated by You from time to time or as available with Tartan.
Any feedbacks or comments about these Terms of Use are welcome and can be sent to the grievance officer mentioned below. We will employ all reasonable efforts to address the same.
Grievance Officer: In accordance with DPDP Act, 2023 and rules made there under, as amended from time to time, the name and contact details of the grievance officer are as follows:
Name of Grievance Officer: Meet Semlani
Email: support@tartanhq.com
Process of Grievance Redressal: Any person having a grievance regarding Submitted Content published, in relation to the Terms of Use may furnish the grievance, at any time, to the above-mentioned personnel.
An acknowledgment of the grievance will be issued and generated by the Company for the benefit of the complainant within 24 (twenty four) hours of it being furnished for information and record.
The manner of grievance redressal shall have the following arrangement:
the Company shall address the grievance and inform the complainant of its decision within 15 (fifteen) days of the registration of the grievance;
if the decision of the publisher is not communicated to the complainant within the stipulated 15 (fifteen) days, the grievance shall be escalated to Meet Semlani, which shall be conducted as per the rules and procedure of grievance redressal committee of the Company.
These Supplemental Terms of Use (herein after referred to as “HyperSync Terms”) govern the access to and use of the HyperSync product and related services (hereinafter referred to as “HyperSync”) made available by TartanHQ Solutions Private Limited (hereinafter referred to as “Tartan”, “we”, “us”, or “our”), a private limited company, having its corporate office at 6th floor, Spring House, Unitech Trade Centre, Sushant Lok Phase I, Sector 43, Gurugram-122022, Haryana.
These HyperSync Terms are in addition to, and shall be read together with, Tartan’s Terms of Use available on its website (herein after referred to as “Terms of Use”), updated time to time. In the event of any inconsistency, these HyperSync Terms shall prevail solely with respect to the HyperSync.
HyperSync service enables real-time, consent-driven synchronization of data across human resource information system, customer relationship management, and enterprise resource planning systems through unified APIs, facilitating automated workflows, integrations, onboarding, and accurate cross-platform data exchange. By accessing or using HyperSync, the user agrees to be bound by both the Terms of Use and these HyperSync Terms.
Following main parties are involved in the process of Hypersync:
Tartan’s Client/Customer – a party involved in providing corporate employee benefits, group insurance, etc. that instructs Tartan to obtain information from its corporate client. The client base of Tartan shall include, without limitation, banks, financial institutions, enterprises, and other similar entities.
Corporate/ Authorised Representative – the data fiduciary (typically an employer, organization, or institution) that intends to procure for its employees or workforce benefits (such as insurance, financial products, or HR services) from Tartan’s Client. Such person represents and warrants that it has the requisite legal authority and responsibility to collect, use, and share personal data of its personnel, and to provide such data to Tartan through Tartan’s Client for specified processing purposes. It acts on behalf of its employees or associated personnel and shall ensure that all necessary consents, notices, and applicable compliance requirements are duly fulfilled prior to such data sharing.
Tartan - data processor, that processes the personnel’s information basis documented instructions from Tartan’s Client. Tartan acts solely as a structured intermediary layer between the Data Principal, Customer, and Data Fiduciary for the purpose of standardising and presenting data in a usable format.
NATURE, PROCESS AND SCOPE OF HYPERSYNC SERVICES
HyperSync is a proprietary technology platform of Tartan that enables structured integration, synchronization, validation, verification, and exchange of data between enterprise systems, including but not limited to HRMS platforms, payroll systems, financial systems, enterprise databases, and related infrastructure.
HyperSync operates strictly as a technology intermediary that facilitates automated data exchange based on system integrations authorised by the Customer.
Tartan does not generate, modify, create, or independently validate source data originating from third-party systems. Tartan does not guarantee the completeness, accuracy, or authenticity of such third-party data.
HyperSync services may include APIs, dashboards, reporting layers, workflow tools, and integration infrastructure as contractually agreed.
Tartan may access authorised systems, APIs, portals or data sources through integrations and authenticated by the credentials lawfully provided by the Corporate, for the purpose of collecting and synchronising data.
Corporate shall act as an intermediary between the End User and Tartan’s Client and shall be responsible for ensuring that all data relating to the Data Principal is duly collected and provided to Tartan in accordance with the applicable consent and terms.
ELIGIBILITY AND AUTHORISATION
HyperSync may only be accessed by entities that have executed a valid commercial agreement with Tartan or Tartan’s Clients, as the case may be.
The Corporate/ Authorised Representative represents and warrants that:
it has full corporate authority to enter into the agreement;
it has lawful rights to transmit and process data through HyperSync;
it complies with all applicable data protection and privacy laws.
DATA AND CONSENTS
The Authorised Representative shall be solely responsible for obtaining all legally required consents, authorisations, notices, and approvals from end users, employees, contractors, or data subjects whose data is processed through HyperSync and thereafter provided to Customer via Tartan and provide such evidence to Tartan’s Clients.
Tartan’s Clients shall procure that Authorised Representative expressly represents and warrants that:
• all data shared with Tartan has been lawfully collected;
• adequate notice has been provided to data subjects;
• required consents under applicable law have been validly obtained.
Tartan shall be entitled to rely entirely on such representations and shall have no obligation to independently verify the legality of data collection or consent and shall be indemnified and held harmless against any claims, penalties, regulatory actions, or liabilities arising from failure to obtain valid consent or lawful basis for processing.
The data collected shall be utilised exclusively for the purposes of HyperSync and shall not be used for any other purpose without obtaining explicit consent. HyperSync provides “Real-time, consent-driven data sync across human resource information system, customer relationship management, and enterprise resource planning via unified APIs, enabling automated workflows, integrations, onboarding, and accurate cross-platform data exchange.”
Tartan shall process Data solely for the purpose of enabling secure data exchange, orchestration, validation and redirection to the Customer’s authorised onboarding or workflow journeys and for no independent or commercial purpose and redirecting the Employee to the Bank’s digital onboarding journey, and for no other purpose whatsoever.
Tartan shall not use, disclose, analyse, monetise, or process such Data for independent business purposes, profiling, analytics, or marketing.
Tartan shall process Data strictly in accordance with such lawful basis and documented instructions and shall not process Data beyond the scope of HyperSync.
Tartan shall process only the minimum Personal Data necessary to enable secure link generation and redirection to the Customer’s onboarding journey.
Tartan shall not collect, store, or process KYC documentation, financial credentials, banking passwords, authentication secrets, or any sensitive financial access information.
DATA RETENTION AND DELETION
Tartan shall retain data processed through HyperSync only for the duration necessary to fulfil the specific purpose of the authorised redirection, integration, and synchronisation process, or for such longer period as may be required under applicable law or contractual obligations. Upon completion of the redirection journey and subject to applicable legal or regulatory retention requirements, Tartan shall delete or anonymise such data within a reasonable and documented timeframe, and shall not retain such data indefinitely.
INFORMATION SECURITY AND BREACH NOTIFICATION
Tartan shall implement and maintain reasonable and appropriate technical and organisational security measures including encryption, access controls, audit logging, and incident response mechanisms designed to protect Personal Data against unauthorised access, disclosure, alteration, loss, or destruction, considering the nature, scope, and sensitivity of Personal Data processed through HyperSync.
In the event of any actual, suspected, or confirmed Data Breach affecting Data processed under these Terms, Tartan shall notify the Customer and/or Corporate/ Authorised Representative (including the relevant Tartan Client, where applicable) without undue delay and, in any event, promptly upon becoming aware of such breach. Such notification shall include reasonable details regarding (i) the nature and circumstances of the Data Breach, (ii) the categories and approximate volume of Data of Data Subjects affected, (iii) the likely consequences and impact, and (iv) the remedial actions taken or proposed to mitigate the breach and prevent recurrence.
Tartan shall further provide reasonable cooperation, information, and assistance as may be required to enable the Customer to comply with its obligations under applicable law in connection with such Data Breach.
DISCLAIMERS
HyperSync is provided on an “as-is” and “as-available” basis.
In the case of data that is being authorised to be transmitted over Tartan’s software, Corporate represents and warrants that it is duly authorised to share the data in compliance with applicable law. The obligation to verify such authority and obtain necessary consents rests solely with the Authorised Representative to Tartan’s Client. Tartan may rely on this representation and shall bear no liability for any lack of valid authorisation.
Tartan disclaims all express or implied warranties, including fitness for a particular purpose and non-infringement.
Tartan does not warrant that:
• HyperSync will meet specific business objectives;
• third-party integrations will remain continuously available;
• outputs will be error-free where source data is inaccurate.
These Supplemental Terms of Use (herein after referred to as “HyperVerify Terms”) govern the access to and use of the HyperVerify product and related services (hereinafter referred to as “HyperVerify”) made available by TartanHQ Solutions Private Limited (hereinafter referred to as “Tartan”, “we”, “us”, or “our”), a private limited company, having its corporate office at 6th floor, Spring House, Unitech Trade Centre, Sushant Lok Phase I, Sector 43, Gurugram-122022, Haryana.
These HyperVerify Terms are in addition to, and shall be read together with, Tartan’s Terms of Use available on its website (herein after referred to as “Terms of Use”), updated from time to time. These HyperVerify Terms do not replace or supersede the Terms of Use but apply specifically to the access and use of the HyperVerify Services.
Capitalised terms not defined in these HyperVerify Terms shall have the meanings assigned to them in the Terms of Use. All provisions relating to limitation of liability, indemnity, intellectual property, termination, and dispute resolution contained in the Terms of Use shall apply mutatis mutandis to the HyperVerify Services. In the event of any inconsistency, these HyperVerify Terms shall prevail solely with respect to the HyperVerify Services.
By accessing or using HyperVerify, the user agrees to be bound by both the Terms of Use and these HyperVerify Terms.
Following main parties are involved in the process of HyperVerify:
Tartan’s Client/Customer – a party involved willing to avail the service from Tartan to expediate KYC and customer journeys for lending, gaming, and investment platforms by verifying PII data, addresses, and mobile numbers in real-time;
Tartan - data processor, that processes the personnel’s information basis instructions from Tartan’s Client. Tartan acts solely as a structured intermediary layer between the Data Principal and Data Fiduciary for the purpose of verification of information.
NATURE, PROCESS AND SCOPE OF HYPERVERIFY SERVICES
2.1 HyperVerify is a proprietary technology platform of Tartan that enables real-time digital verification platform provided by Tartan that delivers automated identity, employment, address, income and business credential validation through a suite of unified application programming interfaces.
2.2 HyperVerify’s verification services are designed to streamline customer and vendor onboarding, strengthen risk assessment processes, enhance compliance, and reduce operational fraud using consent-based data verification from authoritative sources.
2.3 HyperVerify operates strictly as a technology intermediary that facilitates automated data exchange based on system verification authorised by the Data Fiduciary.
2.4 Tartan does not generate, modify, create, or independently validate source data originating from third-party systems and does not guarantee the completeness, accuracy, or authenticity of such third-party data. Tartan shall also not be responsible for any interruption, restriction, modification, or discontinuation of access to such third-party data sources due to regulatory changes or actions of the respective data providers.
2.5 HyperVerify operates by integrating with systems via APIs to execute verification workflows in real time. Upon receipt of End Individual consent, HyperVerify:
Accepts verification requests through API calls or a white-label dashboard;
Connects to trusted government, payroll, mobile, and corporate data sources to validate Personally Identifiable Information (“PII”), employment status, income records, business and contact details;
Orchestrates multiple checks — such as identity matching, data enrichment, and document cross-validation — in a single, consolidated response; and
Returns structured verification results to the Client’s systems for further use in onboarding, risk decisions, compliance reporting, or other business processes.
2.6 The process is designed for high availability, minimal latency, and scalable performance to support enterprise-level use cases with built-in audit logging, compliance controls, and fallback mechanisms in case of data source interruptions.
ELIGIBILITY AND AUTHORISATION
3.1 HyperVerify may only be accessed by entities that have executed a valid commercial agreement with Tartan or Tartan’s Clients, as the case may be.
3.2 The Data Fiduciary represents and warrants that:
it has full corporate authority to enter into the agreement;
it has lawful rights to transmit and process data through HyperVerify;
it complies with all applicable data protection and privacy laws.
DATA AND CONSENTS
The Data Fiduciary shall be solely responsible for obtaining all legally required consents, authorisations, notices, and approvals from end users, employees, contractors, or data subjects whose data is processed through HyperVerify and thereafter provided to Customer via Tartan and provide such evidence to Tartan’s Clients.
Tartan’s Clients shall procure that Data Fiduciary expressly represents and warrants that:
all data shared with Tartan has been lawfully collected;
adequate notice has been provided to data subjects;
required consents under applicable law have been validly obtained.
Tartan shall be entitled to rely entirely on such representations and shall have no obligation to independently verify the legality of data collection or consent and shall be indemnified and held harmless against any claims, penalties, regulatory actions, or liabilities arising from failure to obtain valid consent or lawful basis for processing. Tartan may request reasonable documentary evidence of such consent where required for compliance or regulatory purposes.
The data collected shall be utilised exclusively for the purposes of HyperVerify and shall not be used for any other purpose without obtaining explicit consent.
Tartan shall not use, disclose, analyse, monetise, or process such data for independent business purposes, profiling, analytics, or marketing.
Tartan shall process data strictly in accordance with such lawful basis and documented instructions and shall not process data beyond the scope of HyperVerify.
Tartan shall not collect, store, or process KYC documentation, financial credentials, banking passwords, authentication secrets, or any sensitive financial access information.
DATA RETENTION AND DELETION
Tartan shall retain data processed through HyperVerify only for the duration necessary to fulfil the specific purpose of the authorised redirection, integration, and synchronisation process, or for such longer period as may be required under applicable law or contractual obligations. Upon completion of the redirection journey and subject to applicable legal or regulatory retention requirements, Tartan shall delete or anonymise such data within a reasonable and documented timeframe, and shall not retain such data indefinitely.
INFORMATION SECURITY AND BREACH NOTIFICATION
Tartan shall implement and maintain reasonable and appropriate technical and organisational security measures designed to protect data against unauthorised access, disclosure, alteration, loss, or destruction, considering the nature, scope, and sensitivity of the data processed through HyperVerify.
In the event of any actual, suspected, or confirmed data breach affecting data processed under these Terms, Tartan shall notify the Customer without undue delay and, in any event, promptly upon becoming aware of such breach. Such notification shall include reasonable details regarding (i) the nature and circumstances of the data breach, (ii) the categories and approximate volume of data affected, (iii) the likely consequences and impact, and (iv) the remedial actions taken or proposed to mitigate the breach and prevent recurrence.
Tartan shall further provide reasonable cooperation, information, and assistance as may be required to enable the Customer to comply with its obligations under applicable law in connection with such data breach.
API INTEGRATION THROUGH THIRD PARTY
The Third Party shall implement and maintain industry-standard technical and organizational security measures to protect all data accessed or processed via the API. The Third Party shall comply with all applicable data protection laws and shall promptly within 2 (two) hours of coming in to knowledge, notify Tartan of any actual or suspected data breach and take remedial action at its own cost.
The Third Party shall keep all Tartan and customer data strictly confidential and use it solely for performing its obligations under this Agreement. No disclosure shall be made to any third party without prior written consent of Tartan. These obligations shall survive termination for 5 (five) years.
The Third Party shall obtain and maintain valid, informed consent from data subjects like the Customer for collection, use, and sharing of data through the API, where required by law. The Third Party shall not process data beyond the scope of such consent and shall provide proof of consent upon request.
The Third Party shall not use, sell, monetize, or otherwise exploit any data except as expressly permitted under the relevant Agreement, nor retain such data beyond the required period.
The Third Party shall not permit any subcontractor or affiliate to access data without prior written approval of Tartan and shall ensure equivalent obligations are imposed on such parties.
The Third Party shall indemnify and hold harmless Tartan against all losses, claims, and liabilities arising from any breach of data protection, confidentiality, or consent obligations, or any unauthorized use or disclosure of data.
Tartan may audit the Third Party’s compliance with these obligations upon reasonable notice, and the Third Party shall provide full cooperation.
Upon termination, the Third Party shall promptly return or securely delete all data and certify such deletion in writing.
The Third Party shall process personal data only for the limited purpose of providing the API integration services and shall not process, use, modify, disclose, or exploit such data for any other purpose without the prior written consent of Tartan.
The Third Party shall comply with all applicable data protection and privacy laws, including but not limited to the Information Technology Act, 2000 and rules thereunder, and any other applicable regulations. The Third Party shall ensure that its processing activities meet all legal and regulatory requirements applicable to a data processor.
The Third Party shall implement and maintain appropriate technical and organizational security measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure. Such measures shall be consistent with industry standards and commensurate with the nature and sensitivity of the data.
The Third Party shall not transfer personal data outside India without the prior written consent of Tartan and shall ensure that such transfers comply with applicable legal requirements and adequate safeguards.
The Third Party shall be fully liable for any breach of its obligations under this clause and shall indemnify, defend, and hold harmless Tartan, its affiliates, and their respective officers, directors, and employees from and against any losses, damages, claims, penalties, or liabilities arising out of or in connection with: (a) any breach of applicable data protection laws; (b) unauthorized or unlawful processing of personal data; or (c) any act or omission of the Third Party or its sub-processors.
The Third Party shall ensure that any data processed through the API is accurate, complete, and not misleading to the extent such accuracy depends on its systems or actions. The Third Party shall not alter, corrupt, or degrade data and shall be liable for any loss of integrity caused due to its acts or omissions.
The Third Party shall regularly test, assess, and evaluate the effectiveness of its technical and organizational measures, including conducting periodic vulnerability assessments and penetration testing. Any identified vulnerabilities impacting the API or data security shall be promptly remediated at the Third Party’s cost.
The Third Party shall regularly test, assess, and evaluate the effectiveness of its technical and organizational measures, including conducting periodic vulnerability assessments and penetration testing. Any identified vulnerabilities impacting the API or data security shall be promptly remediated at the Third Party’s cost.
The Third Party shall implement strict access controls on a need-to-know and least-privilege basis and ensure proper authentication mechanisms for all systems accessing the API.
The Third Party shall be liable for any unauthorized access resulting from weak or compromised access controls.
The Third Party shall ensure that all data is stored only in approved locations as specified by Tartan and shall not replicate or store data in unauthorized environments, including personal devices or unsecured systems.
The Third Party shall maintain adequate insurance coverage, including cyber liability and data breach insurance, with reputable insurers and shall provide proof of such coverage upon request.
DISCLAIMERS
HyperVerify is provided on an “as-is” and “as-available” basis.
In the case of data that is being authorised to be transmitted over Tartan’s software, Data Fiduciary represents and warrants that it is duly authorised to share the data in compliance with applicable law. The obligation to verify such authority and obtain necessary consents rests solely with the Authorised Representative to Tartan’s Client. Tartan may rely on this representation and shall bear no liability for any lack of valid authorisation.
Tartan does not warrant that:
HyperVerify will meet specific business objectives;
third-party integrations will remain continuously available;
outputs will be error-free where source data is inaccurate.
Tartan disclaims all express or implied warranties, including fitness for a particular purpose and non-infringement.
HyperVerify Terms constitutes the complete and exclusive statement of the terms between the Parties with respect to its subject matter and supersedes all prior or contemporaneous proposals, negotiations, representations, and communications, whether oral or written, relating thereto. In the event of any inconsistency or conflict between the HyperVerify Terms and any other document executed between the Parties, the terms of HyperVerify Terms shall prevail to the extent of such conflict.
