1. Purpose and application of this notice

DaanVeda Private Limited considers requests to locate specified customer information and service activities within an agreed country or geographic area. A residency arrangement is established for a defined service, organization, and category of information. It is assessed against the requested processing activities, the available provider locations, applicable legal requirements, and the operational arrangements needed to support the service.

Data residency describes where information is stored or processed within the agreed scope. It is distinct from the location of the customer, the nationality or ownership of a provider, and the legal rules governing access or international transfers. Selecting a hosting country does not, by itself, determine where every supporting activity takes place or which laws apply.

This notice explains the process for agreeing a residency arrangement. The applicable order form, data processing agreement, and residency schedule establish the specific obligations, permitted locations, exceptions, and effective date for a customer. An existing subscription or a residency enquiry does not automatically change those arrangements.

2. Cloud providers and the functions they support

DaanVeda uses Google Cloud for application hosting and customer information management, and Amazon Web Services (AWS) for certain information storage, file handling, delivery, and communication functions. Selected AI features also involve Google Cloud or Microsoft Azure. Which providers participate in a particular workflow depends on the service and features used.

A country-specific proposal identifies the relevant cloud provider and its service functions, including application operation, information storage, document handling, recovery, and supporting processing. The review considers the actual locations available for those functions rather than assuming that a provider offers every function in every country.

Provider participation is assessed alongside any other recipients involved in the service. Our provider directory gives wider context; the customer-specific processing and residency schedules identify the providers, responsibilities, and locations applicable to an agreed arrangement.

3. Submitting a residency requirement

An authorized representative may prepare a data residency enquiry or contact privacy@daanveda.com. Please identify the organization, the requested country or area, the services and account scope concerned, and the date by which an arrangement is needed. Explain whether the requirement comes from law, a regulatory obligation, a customer contract, a funding condition, or an internal policy.

The initial enquiry should describe the categories of information and individuals concerned, any sensitive or regulated information, and restrictions on processing, access, or transfers outside the requested area. Where relevant, identify requirements for backups, disaster recovery, support personnel, customer users, and connected services.

Do not attach live datasets, identity documents, access credentials, or confidential records to the initial enquiry. If detailed evidence is needed, the parties can agree a suitable exchange method and any confidentiality arrangements before it is provided. Sending an enquiry starts a discussion; it does not activate a deployment or establish an implementation deadline.

4. Feasibility and due diligence

The assessment considers the requested location, the proposed use of the service, relevant provider availability, and the dependencies required to operate and support the requested features. It also considers whether the requirement concerns storage alone or extends to processing, recovery, administration, and access by people located elsewhere.

Any proposal needs to distinguish functions that can be included within the requested boundary from functions requiring a separate arrangement, a permitted exception, or a change to the features available. If the complete requirement cannot be supported, the proposal should identify that limitation so the customer can assess a narrower scope, an alternative location, or a different service configuration before proceeding.

Feasibility, implementation timing, and commercial terms are confirmed through the agreed proposal. A provider location appearing in public material, or an assessment being undertaken, is not a representation that a particular customer environment has already been established there.

5. Defining the geographic and information scope

The written residency schedule should identify the customer organization, covered accounts or workspaces, service functions, categories of information, and permitted geographic locations. It should distinguish customer-provided records and files from account administration, billing information, security records, support correspondence, and independently sourced research information where those activities have different processing arrangements.

The schedule should address primary processing and storage, additional copies, backups, recovery environments, temporary working information, search and retrieval functions, operational records, and administrative access. Any excluded information, activity, provider, or location should be expressly identified, together with its purpose and the conditions that apply.

A commitment relating to one account, feature, or information category does not automatically extend to every DaanVeda service. The agreed scope should make clear how information entering or leaving the covered environment is handled, including customer exports, downloads, messages, and transfers to connected services.

6. Contractual terms, responsibilities, and separate billing

Country-specific residency is arranged through a separate written scope and is separately billed. The applicable proposal or order form identifies any setup, migration, recurring operation, support, or exit charges, the responsibilities of each party, and the conditions for commencement. No residency service is purchased or activated merely by submitting the enquiry form.

The contractual documents should address processing instructions, confidentiality, access restrictions, approved providers and locations, permitted transfers, retention, security, incident handling, and return or deletion. They should also identify any agreed service levels, evidence requirements, notification procedures, remedies, and limits on changes to the arrangement.

An executed data processing agreement governs its processing scope, while a residency schedule records the additional location commitments. The parties should resolve the order of precedence between their documents before implementation. Mandatory law and enforceable individual rights continue to apply; a commercial arrangement cannot waive them. See our data processing agreement overview.

7. Implementation, migration, and acceptance

Once the arrangement is agreed, implementation follows the approved scope and change plan. The plan establishes the provider locations to be used, the functions to be enabled, access responsibilities, handling of existing information, and the checks required before the arrangement becomes effective.

Where an existing service is being moved, the migration plan should identify the information to be transferred, the authorized transfer method, expected service interruption, reconciliation checks, the period during which old and new copies may coexist, and the procedure for resolving a failed or incomplete move. Temporary copies and any fallback to the previous environment need to be considered within the agreed location and transfer conditions.

Acceptance should be based on the agreed verification criteria, which may include confirmation of the configured provider locations, review of access arrangements, reconciliation of migrated records and files, recovery checks, and identification of remaining exceptions. The customer and DaanVeda should record the effective date and outstanding actions. Provisioning resources or copying information alone does not establish that the full residency scope has been met.

8. Personnel access, support, and lawful disclosure

A location requirement needs to address who may access covered information, the purposes for which access is permitted, and the countries from which customer users, DaanVeda personnel, and provider personnel may act. Information stored in one country may still be accessed or made available elsewhere during administration, troubleshooting, or customer-directed activity.

The agreed arrangement should specify the approval and oversight of support access, the treatment of support attachments and diagnostic records, and any restrictions on access from outside the permitted area. Requirements concerning authorization, confidentiality, authentication, access review, and records of access should be documented at the level appropriate to the service and information involved.

Hosting location does not create immunity from lawful governmental or judicial demands. The agreement should address handling of legally binding disclosure requests, notification where permitted, and the scope of any assistance or challenge process. A particular outcome, exemption from legal process, or restriction binding an independent authority should not be assumed from the choice of country.

9. Backups, recovery, retention, and deletion

The residency scope should identify where recovery copies are held and where restoration may occur. It should state whether the location commitment covers routine backups, additional copies, emergency recovery, and information created during a restoration exercise. Recovery arrangements should be considered alongside the agreed availability requirements so that continuity expectations do not conflict with the permitted locations.

Retention and deletion terms should distinguish active information from protected recovery copies and records that must be retained for a lawful purpose. The schedule should describe applicable retention periods or criteria, the treatment of copies remaining after migration or termination, and any agreed evidence of completion. Removal from the active service should not be described as immediate erasure from every backup.

Where retained recovery information cannot be individually removed immediately, the agreed procedure should address restricted use, expiry, and the handling of information that is restored. Any continuing retention must have a stated purpose and applicable safeguards; a residency arrangement does not authorize indefinite retention.

10. Connected services and feature-specific processing

AI assistance, research and enrichment, payment processing, email delivery, bookings, analytics, and customer-enabled integrations can involve recipients and processing locations different from those used for the main hosted environment. A commitment concerning primary storage does not automatically include those separate activities.

The assessment should identify which features are required, what information they receive, the provider role, relevant processing and retention arrangements, and any onward disclosure. Where a feature cannot meet the requested boundary, the proposal should record whether it will be excluded, restricted, replaced where feasible, or used only under an expressly agreed transfer arrangement.

Customer-directed exports, connected accounts, and access by the customer’s own personnel also need to be considered. Each party remains responsible for its applicable obligations and instructions. A customer’s request to connect a service does not, by itself, remove mandatory privacy requirements or expand the agreed residency commitment.

11. International transfers and applicable legal requirements

A residency arrangement is one part of a wider data protection assessment. It does not, by itself, establish a lawful basis for processing, determine the parties’ roles, satisfy every sector-specific requirement, or certify compliance. The assessment must consider the information, individuals, recipients, activities, and jurisdictions involved.

European Economic Area. Where the GDPR’s international-transfer rules apply, transfers require an applicable legal mechanism, such as an adequacy decision within its scope or appropriate safeguards. Relevant assessments and additional safeguards must be considered where required. A hosting choice or a signed processing agreement alone does not complete that assessment. See the EDPB’s international transfer guidance.

United Kingdom. Where UK restricted-transfer rules apply, the responsible parties must identify a permitted transfer route and complete any required assessment. UK requirements need to be considered separately rather than assuming an EEA arrangement is sufficient. See the ICO’s international transfer guidance.

India. India-related requirements are assessed against applicable sector-specific localisation rules and the DPDP framework in accordance with the relevant commencement dates, government notifications, and transfer conditions. An agreed country does not displace a binding restriction applicable to the processing. See MeitY’s data protection framework and official notifications.

California. Where the CCPA / CPRA applies, processing purposes, recipient roles, contractual restrictions, notices, and individual rights remain relevant alongside location. A residency purchase is not a substitute for applicable rights or service-provider obligations. See the California Attorney General’s CCPA guidance.

Additional financial, health, public-sector, contractual, or other sector-specific requirements may need separate assessment. The customer should identify such requirements during the enquiry so that their application and the proposed allocation of responsibilities can be addressed before restricted information is provided.

12. Ongoing changes, incidents, and exit

The agreed governance process should address changes to providers, permitted locations, service functions, and access arrangements. Any required advance notice, authorization, objection procedure, or review should be set out in the applicable agreement. A proposed change outside the agreed scope needs to be assessed against those terms before implementation, subject to applicable law and any expressly agreed emergency provisions.

The arrangement should also identify how a suspected location deviation or security incident is investigated, escalated, documented, and communicated. Relevant legal and contractual notification duties apply according to the circumstances; a residency schedule should not be read as promising a notification period that has not been agreed or imposed by law.

On expiry or termination, the exit plan should address authorized return or export, the destination selected by the customer, any continuing access, deletion of active information, expiry of retained recovery copies, and legally required retention. The format, assistance, timing, and any charges for exit should be agreed. Any completion statement should describe its scope and outstanding retention exceptions accurately.

13. Documentation, enquiries, and individual rights

Organizations evaluating a residency arrangement can request a proposed processing scope, the applicable provider and location schedule, a statement of exceptions, implementation and acceptance criteria, and the relevant contractual documents. The evidence to be supplied, review arrangements, and any confidentiality restrictions should be agreed for the particular service; public website material is not a customer-specific attestation.

To begin, prepare a residency enquiry or email privacy@daanveda.com. Our website form prepares a draft for you to send; it does not submit an order, accept a contract, or initiate a migration. You may instead write to us directly in your own words.

Individual requests for access, correction, deletion, objection, or other applicable privacy rights are separate from a commercial residency request. Exercising those rights does not require purchasing a residency arrangement or another paid feature. See our privacy notice and privacy request options.