Records of Processing Activities (ROPA)
Last updated: April 2026
Maintained in accordance with Article 30 of the EU General Data Protection Regulation (GDPR). Prepared by AIQorex as Data Controller and Data Processor.
Part A — AIQorex as Data Controller
| Field | Detail |
|---|
| Data Controller | AIQorex (a sole proprietorship operated by Shivam Dixit) |
| Address | Fatehpur, Uttar Pradesh, India |
| Email | [email protected] |
| Privacy Lead | [email protected] |
| Primary Supervisory Authority | Data Protection Board of India (upon establishment under the DPDP Act, 2023). Until then: Ministry of Electronics and Information Technology (MeitY). |
| Additional supervisory authorities | For EU data subjects: the supervisory authority of the data subject's EU Member State of residence. For UK data subjects: the Information Commissioner's Office (ICO). |
A.2 Purposes and Legal Basis for Processing (Controller Activities)
A.2.1 Customer Account Management
| Field | Detail |
|---|
| Purpose | Register and manage customer accounts; provide access to the Platform |
| Categories of Data Subjects | Customers, prospective customers |
| Categories of Personal Data | Name, company name, job title, email address, phone number, account preferences, profile photo |
| Legal Basis | Contract performance (Art. 6(1)(b) GDPR) — necessary to provide the requested services |
| Retention Period | Duration of account + 2 years after deletion |
A.2.2 Order Processing and Fulfillment
| Field | Detail |
|---|
| Purpose | Process product purchases, subscriptions, and payments; deliver digital products; issue invoices |
| Categories of Data Subjects | Customers |
| Categories of Personal Data | Name, company, email, billing address, order history, payment data (processed by Stripe only) |
| Legal Basis | Contract performance (Art. 6(1)(b) GDPR) and legal obligation — tax record retention (Art. 6(1)(c) GDPR) |
| Retention Period | 7 years from transaction date (legal obligation for financial records) |
A.2.3 Customer Support and Enquiries
| Field | Detail |
|---|
| Purpose | Respond to product questions, technical support requests, and general enquiries |
| Categories of Data Subjects | Customers, prospective customers |
| Categories of Personal Data | Name, email, company, content of the enquiry, chat history |
| Legal Basis | Legitimate interest (Art. 6(1)(f) GDPR) — to respond to enquiries and provide support; or contract performance where the enquiry relates to an existing service |
| Retention Period | 3 years from last contact |
A.2.4 Marketing Communications
| Field | Detail |
|---|
| Purpose | Send promotional emails about products, features, and offers (only where consent has been obtained) |
| Categories of Data Subjects | Prospective customers (who have opted in), existing customers (soft opt-in for related products) |
| Categories of Personal Data | Name, email, company, marketing preferences, engagement data |
| Legal Basis | Consent (Art. 6(1)(a) GDPR) for promotional emails; legitimate interest (Art. 6(1)(f) GDPR) for soft-opt-in existing customer communications |
| Retention Period | Until consent is withdrawn or the data subject unsubscribes |
A.2.5 Analytics and Platform Improvement
| Field | Detail |
|---|
| Purpose | Analyse website and Platform usage to improve functionality, identify bugs, and understand user behaviour |
| Categories of Data Subjects | All users of the Platform |
| Categories of Personal Data | IP address, device type, browser, pages visited, time on page, referring URL, user interactions (anonymised/pseudonymised where possible) |
| Legal Basis | Consent (Art. 6(1)(a) GDPR) — analytics cookies set only with consent |
| Retention Period | 26 months (Google Analytics default) |
A.2.6 Security and Fraud Prevention
| Field | Detail |
|---|
| Purpose | Detect and prevent fraudulent activity, account takeover, and platform abuse |
| Categories of Data Subjects | All Platform users |
| Categories of Personal Data | IP address, device fingerprint, login activity, behavioural patterns |
| Legal Basis | Legitimate interest (Art. 6(1)(f) GDPR) — to maintain platform security and prevent fraud |
| Retention Period | 2 years from last activity |
A.2.7 Legal Compliance
| Field | Detail |
|---|
| Purpose | Retain records as required by applicable law; respond to regulatory requests |
| Categories of Data Subjects | All data subjects whose data AIQorex is required to retain |
| Categories of Personal Data | Financial records, transaction data, account data |
| Legal Basis | Legal obligation (Art. 6(1)(c) GDPR) |
| Retention Period | As required by applicable law (minimum 7 years for financial records) |
A.3 Recipients and Transfers (Controller Activities)
| Recipient | Purpose | Country | Safeguards |
|---|
| Supabase | Database and authentication | EU / US | SCCs for US transfers |
| Stripe | Payment processing | US | SCCs, PCI DSS Level 1 |
| Google Analytics | Website analytics (with consent) | US | SCCs, IP anonymisation |
| SMTP Provider (TBD) | Transactional email | EU | Data processing agreement |
| n8n (self-hosted) | Workflow automation | EU | No personal data stored |
| Law enforcement / regulators | When legally required | Any | Legal obligation basis |
Part B — AIQorex as Data Processor (Processing on Customer Instructions)
B.1 Processing on Customer Behalf
AIQorex acts as a Data Processor when it processes personal data on behalf of Customers in the course of delivering agreed Services (primarily the Maintenance SaaS and Consulting engagements).
| Field | Detail |
|---|
| Processing Description | Storage, use, and occasional disclosure of personal data provided by the Customer, solely for delivering the agreed Services |
| Purpose | As defined in the applicable Proposal or Statement of Work |
| Categories of Data Subjects | As determined by the Customer (typically the Customer's own customers, employees, or users) |
| Categories of Personal Data | As determined and provided by the Customer |
| Retention | Duration of the engagement + 90 days; then erasure or return per the DPA |
| Subprocessors | See Schedule A of the DPA |
B.2 Customer Responsibilities
As Data Controller, the Customer is responsible for:
- Determining the legal basis for the processing
- Ensuring all necessary data subject notices and consents are in place
- Ensuring no Special Category Data is submitted without appropriate safeguards agreed in writing
- Responding to data subject rights requests relating to their data
Part C — Technical and Organisational Measures (TOMs)
AIQorex implements the following technical and organisational security measures:
C.1 Access Control
- Role-based access control (RBAC) across all systems
- MFA required for administrative accounts
- Access logs retained for minimum 90 days
- Regular access reviews (quarterly)
C.2 Data Encryption
- TLS 1.2+ for all data in transit
- AES-256 encryption for data at rest (Supabase + own systems)
- Encrypted backups
C.3 System Availability and Resilience
- DDoS protection via CDN (Cloudflare or equivalent)
- Automated daily backups with off-site storage
- Disaster recovery plan with RTO/RPO targets
- Uptime monitoring (via Maintenance SaaS for deployed products)
C.4 Incident Response
- Written information security incident response procedure
- Data breach notification to Customers within 48 hours per the DPA
- Incident register maintained
C.5 Vendor Management
- All subprocessor agreements include appropriate data protection obligations
- Annual review of subprocessor security certifications
This ROPA is reviewed and updated at least annually or whenever a new processing activity is introduced. Last reviewed: April 2026.
