DPA Annex 1 — Processing Details
Annex 1 — Processing Details
Document ID: BRA-LEGAL-003A
Title: DPA Annex 1 — Processing Details
Version: 1.0
Last updated: 2026-10-24
Publisher: Timecampus Technologies Pvt. Ltd. (Burdenoff Group)
Canonical location: https://burdenoff.com/contracts/brainyrich/BRA-LEGAL-003A
Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the BrainyRich subgroup at https://burdenoff.com/contracts/brainyrich/. Every referenced contract is identified by its Document ID (BRA-LEGAL-### / BRA-PRICING-###) and incorporated by reference.
Status: Published v1.0 — effective 2026-10-24. Reviewed against the production platform and approved for publication on 2026-10-24 under the founder's delegated legal sign-off (India jurisdiction); outside-counsel review checkpoints are tracked in BRA-LEGAL-REG.
A. Subject-matter and duration
- Subject-matter: provision of the BrainyRich wealth-management platform (portfolio tracking, goal-based planning, advisory & rebalancing, proactive insights, internal communications, wealth analytics) to Customer.
- Duration: for the duration of the Subscription Term and any retention period under MSA §5.5 / DPA §4.7 (including statutory account / tax retention Customer instructs).
B. Nature and purpose of processing
Timecampus processes Personal Data to:
- authenticate users and manage tenants, roles and access;
- run portfolio tracking (financial accounts, holdings, the transaction ledger, net-worth aggregation);
- run goal-based planning (goals, fundings, honest projections, scenario inputs);
- operate advisory & rebalancing (client households, model portfolios, rebalance proposals and their reviewable lifecycle);
- once the services marketplace launches (it is not live as of 2026-10-24), operate it (advisor/firm profiles, proposals, engagement terms, milestones, settlement, ratings, research listings);
- generate proactive insights (typed, severity-ranked signals across drift, concentration, cash-drag, tax-opportunity and goal status);
- store and serve documents (IDs, account statements, KYC documents, contracts, tax documents);
- relay verification / KYC requests to providers Customer enables and store the results Customer commissions;
- provide AI-assisted insight and planning support and recommendations (assistive only; no autonomous decisions);
- deliver internal communications, notifications and channel events configured by Customer;
- generate audit logs, usage telemetry and analytics;
- provide customer support and respond to data principal requests;
- detect and prevent fraud, abuse and security incidents;
- comply with legal obligations.
C. Categories of data subjects
- Customer's Authorized Users, administrators (wealthtech, relationship managers, compliance/finance officers), and advisors.
- Investors and prospective clients onboarded into Customer's tenant.
- Client-household members and beneficiaries managed in Customer's tenant.
- Independent advisors and firms engaged through the Advisory Marketplace.
- Research authors and subscribers in Customer's research-content programmes.
- Beneficiaries, dependants, nominees and references (e.g., for estate or succession planning) mentioned within Customer Data, to the extent Customer provides them.
D. Categories of Personal Data
| Category | Examples |
|---|---|
| Identification & contact | Name, work and personal email, username, profile photo, phone, address |
| Account & authentication | Password hash (where local auth used), SSO subject ID, MFA factors |
| Authorisation | Roles, tenant memberships, RBAC assignments, advisor relationships |
| Investor / prospect data | Contact details, KYC inputs, risk-profile answers, financial objectives, review-meeting notes, insight results, engagement details |
| Client-household records | Household name, members and relationships, beneficiaries / nominees, contact details, residency, household objectives and constraints |
| Financial accounts & holdings data | Account balances, holdings, cost basis, transaction history, bank/brokerage identifiers, tax identifiers (PAN/equivalent) |
| Planning & goals | Goals, target amounts and dates, funding links to accounts/portfolios, projection inputs, scenario assumptions |
| Advisory & rebalancing | Model portfolios, target allocations, rebalance proposals and their reviewable lifecycle, drift and concentration metrics |
| Marketplace engagement | Independent advisor/firm profiles, proposals, engagement terms, milestones, ratings, research listings, payout records |
| Device & connection | IP address, user agent, OS, geolocation (city-level), device metadata |
| Usage data | Pages visited, features used, navigation, notification interactions, AI-assist metadata |
| Content & documents | Identity documents, KYC documents, account statements, contracts, tax documents, files uploaded, communications |
| Billing | Billing contact, billing address, GSTIN/PAN (Indian customers), VAT ID, tokenised card identifier (actual card data held by payment processor) |
| Support | Support ticket content, screen recordings (only if shared), call transcripts |
E. Sensitive personal data / Special categories
Timecampus does not require Customer to upload "sensitive personal data or information" under the SPDI Rules or special-category personal data under Article 9 GDPR. Customer shall not upload, and shall instruct Authorized Users not to upload, such categories (health data, biometric IDs, Aadhaar numbers, religion, caste, political opinions, sexual orientation, trade-union membership, or criminal-record data beyond lawful pre-KYC insight generation) unless expressly authorised under an Order Form with appropriate additional controls and a lawful basis. Where Customer commissions KYC checks / pre-KYC insight generation through an enabled verification provider, the results are processed strictly as Customer instructs.
F. Retention periods
- Account profile data: while account is active + 90 days, unless legal hold.
- Financial-account records (financial accounts, holdings, transactions, goals, households): for the Subscription Term on Customer's instructions; then export within 30 days and delete, subject to statutory financial-account/tax retention Customer directs.
- Documents in the file store: until deleted by Customer or account closure.
- Audit logs: per Plan (default 30 days; longer for Enterprise).
- Analytics events: per Plan; user-level up to 13 months.
- Backups: rolling 30 days hot, 90 days cold (default).
- Support tickets: 24 months after closure unless Customer requests earlier deletion.
- Billing records: 8 years (Indian tax/Companies Act retention).
G. Sub-processing
See Annex 3. Verification / KYC providers are added only when Customer enables them.
H. Transfer mechanisms
Default storage region(s) as specified on the Order Form (AWS ap-south-1, Mumbai, India, for all backend, database, object-storage and frontend hosting). International transfers under DPA §7 use SCCs/UK Addendum, DPDP-permitted destinations, and SPDI-equivalent contractual safeguards as applicable. Financial-data localisation as configured on the Order Form.
Reference and incorporation
All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (BRA-LEGAL-### or BRA-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.