Data Protection Addendum

Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025

This Data Protection Addendum (“Addendum”) forms part of, and is incorporated by reference into, the Mystore Terms of Use for Sellers. It applies from the date the Seller accepts those Terms of Use or continues to use the Platform, whichever is earlier, and no separate signature is required.

Terms used in this Addendum carry the meanings given to them under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”). “Seller Personal Data” means personal data of the Seller’s buyers and other Data Principals that Mystore Processes on the Platform in order to provide the services under the Terms of Use.

In the event of conflict between this Addendum and the Terms of Use on matters of personal data protection, this Addendum prevails.

1. Roles

The Seller is the Data Fiduciary in respect of Seller Personal Data. Hippo Innovations Private Limited, which owns and operates Mystore, is a Data Processor and Processes Seller Personal Data on the Seller’s behalf. This Addendum constitutes the contract required by Section 8(2) of the DPDP Act for the engagement of a Data Processor. Section 8(1) of the DPDP Act places responsibility for compliance on the Data Fiduciary, and nothing in this Addendum alters that responsibility.

2. Processing on Instructions

Mystore shall Process Seller Personal Data only to provide the services under the Terms of Use and on the Seller’s instructions, and shall not Process it for any other purpose, except where required by law.

3. Reasonable Security Safeguards

Mystore shall take reasonable security safeguards to prevent a personal data breach, as required by Rule 6 of the DPDP Rules, including encryption, obfuscation, masking or the use of virtual tokens; appropriate measures to control access to the computer resources used; visibility on the accessing of Seller Personal Data through appropriate logs, monitoring and review; reasonable measures for continued processing where personal data is destroyed, lost or otherwise compromised, such as by way of data backups; and retention of such logs and personal data for a period of one year unless compliance with any other law for the time being in force requires otherwise.

4. Sub-processors

Mystore may engage sub-processors to deliver the services and shall, by contract, require each such sub-processor to take reasonable security safeguards equivalent to those set out in Clause 3. 

5. Personal Data Breach

Mystore shall notify the Seller of any personal data breach affecting Seller Personal Data without delay, and in any event within Seventy-two (72) hours of becoming aware of it, with the particulars known at that time. Mystore shall provide the Seller with the information reasonably required to enable the Seller to give intimation to the Data Protection Board of India and to affected Data Principals within the timelines prescribed under Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules.

6. Erasure

On the Seller’s instruction, on withdrawal of consent by a Data Principal, or on expiry or termination of the Terms of Use, Mystore shall erase the relevant Seller Personal Data and shall cause its sub-processors to erase it, except where retention is required under Rule 6(1)(e) of the DPDP Rules or under any other law for the time being in force.

7. Cross-border Transfer

Mystore shall not transfer Seller Personal Data to any country or territory restricted by the Central Government under Section 16 of the DPDP Act, and shall comply with any restriction or condition notified under the DPDP Law in relation to such transfer.

8. Seller Obligations

The Seller shall serve notice to Data Principals and obtain and maintain valid consent, or establish a legitimate use, for all Processing carried out through the Platform. The Seller shall issue only lawful instructions to Mystore, and shall inform Mystore promptly of any withdrawal of consent or Data Principal request that requires action on the Platform.