Subprocessor List and Subprocessor Policy

1. Purpose of this Document 

The purpose of this Subprocessor List and Subprocessor Policy is to provide transparency about third parties that may process Customer Data or Personal Data on behalf of Treewalker Digital Private Limited while delivering Galla.app services. 

This document explains: 

1. What subprocessors are. 
2. Why Galla.app uses subprocessors. 
3. Categories of subprocessors used by Galla.app. 
4. Types of data that may be processed. 
5. Product-specific subprocessors for Retail, POS, WMS, WhatsApp Marketing, Ecommerce, Integrations, APIs, and Support. 
6. How we evaluate and manage subprocessors. 
7. How customers are notified of subprocessor changes. 
8. How customers may object to new subprocessors. 
9. How third-party integrations selected by customers are handled. 
10. Current or intended subprocessor register format. 

2. Definitions 

For the purpose of this policy: 

“Customer” means a business, organisation, company, firm, proprietorship, partnership, or legal entity that subscribes to or uses Galla.app. 

“Customer Data” means all data, content, files, records, documents, product data, inventory data, billing data, customer data, vendor data, employee data, warehouse data, ecommerce data, communication data, reports, logs, and other information submitted, uploaded, imported, generated, transmitted, stored, or processed by or on behalf of the Customer through Galla.app. 

“Personal Data” means any information relating to an identified or identifiable individual, including data relating to customers, users, employees, vendors, ecommerce buyers, WhatsApp recipients, delivery recipients, and business contacts. 

“Subprocessor” means a third-party service provider engaged by Treewalker Digital Private Limited to process Customer Data or Personal Data on behalf of Galla.app for the purpose of providing Galla.app services. 

“Third-Party Integration” means a third-party platform, system, service, API, or application connected to Galla.app by or on behalf of the Customer, such as ERP, accounting software, ecommerce platform, marketplace, payment gateway, logistics system, WhatsApp Business provider, SMS provider, email provider, analytics tool, or custom API. 

“Processing” means any operation performed on data, including collection, storage, hosting, transmission, retrieval, access, synchronisation, analysis, reporting, backup, support, deletion, or security monitoring. 

3. What is a Subprocessor? 

A subprocessor is a third-party provider that may process Customer Data or Personal Data on behalf of Treewalker Digital Private Limited to help us deliver Galla.app. 

Examples may include: 

1. Cloud hosting providers. 
2. Database and storage providers. 
3. Backup providers. 
4. Email delivery providers. 
5. SMS providers. 
6. WhatsApp Business service providers. 
7. Payment gateways. 
8. Analytics providers. 
9. Error monitoring tools. 
10. Customer support tools. 
11. Security monitoring tools. 
12. Ecommerce platforms. 
13. Logistics or shipping integration providers. 
14. API infrastructure providers. 
15. Professional implementation or support partners. 

Subprocessors are different from third-party integrations selected directly by the Customer. Third-party integrations may process data under their own terms and privacy policies. 

4. Why Galla.app Uses Subprocessors 

Galla.app may use subprocessors to: 

1. Host the SaaS platform. 
2. Store Customer Data securely. 
3. Deliver transactional emails. 
4. Deliver SMS or WhatsApp messages. 
5. Process payments or subscription billing. 
6. Provide customer support and ticketing. 
7. Monitor platform performance. 
8. Detect and resolve errors. 
9. Provide analytics and product insights. 
10. Secure the platform. 
11. Maintain backups and disaster recovery. 
12. Enable integrations with third-party platforms. 
13. Support ecommerce development and managed services. 
14. Provide implementation, migration, or support assistance. 
15. Comply with legal, tax, audit, security, and operational requirements. 

5. Customer Authorisation

By using Galla.app, entering into a service agreement, accepting our Terms of Service, or signing a Data Processing Addendum, the Customer authorises Treewalker Digital Private Limited to use subprocessors as reasonably necessary to provide Galla.app services. 

Treewalker Digital Private Limited remains responsible for ensuring that subprocessors engaged by us are subject to appropriate contractual, privacy, confidentiality, and security obligations. 

7. Categories of Subprocessors

Categories of Subprocessors

8. Cloud Hosting and Infrastructure Providers 

 Cloud Hosting and Infrastructure Providers 

Purpose 

1. Hosting Galla.app. 
2. Running application servers. 
3. Storing Customer Data. 
4. Operating databases. 
5. Providing compute and network infrastructure. 
6. Supporting scalability and availability. 
7. Providing backup and disaster recovery infrastructure. 
8. Supporting security and monitoring. 

Data Processed 

Depending on usage, this may include: 

1. Customer Data. 
2. User account data. 
3. Retail and POS data. 
4. Warehouse data. 
5. Inventory data. 
6. Ecommerce data. 
7. Integration data. 
8. Support logs. 
9. System logs. 
10. IP addresses. 
11. Device and browser metadata. 
12. Backup data. 

9. Email Delivery Providers

These providers help Galla.app send transactional, service, security, onboarding, support, billing, and notification emails. 

Purpose 

1. Sending account verification emails. 
2. Sending password reset emails. 
3. Sending product notifications. 
4. Sending invoice or billing emails. 
5. Sending support updates. 
6. Sending onboarding and training communication. 
7. Sending service alerts. 
8. Sending legal or policy notices. 

Data Processed 

1. Name. 
2. Email address. 
3. Company name. 
4. Email subject and content. 
5. Delivery metadata. 
6. Open/click metadata, if enabled. 
7. Bounce and unsubscribe status. 

10. sms Providers

These providers help Galla.app send OTPs, alerts, service messages, or customer communication through SMS, if enabled. 

Purpose 

1. OTP delivery. 
2. Login verification. 
3. Account security. 
4. Transactional alerts. 
5. Order notifications. 
6. Service updates. 
7. Customer communication, if enabled. 
8. Support notifications. 

Data Processed 

1. Name, where applicable. 
2. Mobile number. 
3. Message content. 
4. Delivery status. 
5. Message metadata. 
6. Timestamp. 
7. Campaign or notification category, where applicable. 

11. WhatsApp Business and Messaging Providers 

These providers support WhatsApp marketing, customer communication, business messaging, templates, delivery reports, and campaign workflows. 

Purpose 

1. WhatsApp Business messaging. 
2. WhatsApp template submission and delivery. 
3. Campaign execution. 
4. Customer communication. 
5. Message delivery tracking. 
6. Message status tracking. 
7. Opt-out and communication status management, where configured. 
8. Integration with WhatsApp Business Platform or authorised providers. 

Data Processed 

1. Recipient name. 
2. Recipient mobile number. 
3. WhatsApp message content. 
4. Template content. 
5. Campaign name. 
6. Campaign audience. 
7. Message delivery status. 
8. Read status, where available. 
9. Failed delivery status. 
10. Response data. 
11. Opt-out status, where configured. 
12. Consent status, where configured. 
13. WhatsApp Business Account metadata. 
14. Phone number metadata. 

Important Customer Responsibility 

Customers using WhatsApp marketing features are responsible for: 

1. Obtaining lawful recipient consent. 
2. Maintaining opt-in records where required. 
3. Not uploading purchased, scraped, unauthorised, or unlawful contact lists. 
4. Following WhatsApp Business terms and messaging policies. 
5. Managing unsubscribe or opt-out requests. 
6. Ensuring message content is lawful and not misleading. 
7. Handling recipient complaints. 
8. Complying with applicable marketing and data protection laws. 

12. Payment Gateway and Billing Providers

These providers support subscription payments, invoices, recurring billing, payment links, refunds, payment status, and financial transaction workflows. 

Purpose 

1. Subscription payments. 
2. Payment gateway processing. 
3. Payment links. 
4. Recurring billing. 
5. Invoice payment tracking. 
6. Refund status. 
7. Payment failure alerts. 
8. Tax invoice payment reconciliation. 
9. Customer billing records. 

Data Processed 

1. Customer name. 
2. Company name. 
3. Email address. 
4. Phone number. 
5. Billing address. 
6. GSTIN, where applicable. 
7. Invoice amount. 
8. Payment status. 
9. Transaction reference number. 
10. Payment mode. 
11. Refund status. 
12. Limited payment metadata. 

Treewalker Digital Private Limited does not intentionally store full card numbers or sensitive payment authentication data unless specifically required, lawfully permitted, and contractually agreed. 

13. Analytics and Product Usage Providers 

These providers help Galla.app understand product usage, website traffic, feature usage, user journeys, performance, conversions, and product improvement opportunities. 

Purpose 

1. Website analytics. 
2. Product usage analytics. 
3. Feature adoption analysis. 
4. Conversion tracking. 
5. Funnel analysis. 
6. Performance improvement. 
7. Customer experience improvement. 
8. Marketing source attribution. 
9. Error and behaviour analysis.

Data Processed 

1. IP address. 
2. Device information. 
3. Browser information. 
4. Page visits. 
5. Click events. 
6. Session data. 
7. Referrer data. 
8. User activity metadata. 
9. Approximate location. 
10. Product usage data. 
11. Feature usage metadata. 
12. Account or user identifiers, where configured. 

14. Customer Support and Ticketing Providers

These providers help Galla.app manage customer support, issue resolution, onboarding, service requests, troubleshooting, and customer communication. 

Purpose 

1. Support ticket management. 
2. Helpdesk operations. 
3. Chat support. 
4. Customer issue tracking. 
5. Implementation support. 
6. Onboarding assistance. 
7. Bug reporting. 
8. Remote troubleshooting. 
9. Customer communication history.

Data Processed 

1. Name. 
2. Email address. 
3. Phone number. 
4. Company name. 
5. Support query. 
6. Ticket content. 
7. Screenshots or attachments. 
8. Error details. 
9. Account details. 
10. Product usage information. 
11. Communication history. 
12. Support status. 

15. Error Monitoring and Performance Monitoring Providers 

These providers help Galla.app detect bugs, errors, crashes, latency, downtime, performance issues, and system stability problems. 

Purpose 

1. Error detection. 
2. Bug tracking. 
3. Crash reporting. 
4. Performance monitoring. 
5. Downtime monitoring. 
6. API performance monitoring. 
7. Application health monitoring. 
8. Security and reliability improvement. 

Data Processed 

1. Error logs. 
2. Device data. 
3. Browser data. 
4. IP address. 
5. User session metadata. 
6. API logs. 
7. Application logs. 
8. Stack traces. 
9. Performance data. 
10. Limited account or user identifiers, where configured. 

16. Security, Logging, and Fraud Prevention Providers 

These providers help protect Galla.app from unauthorised access, abuse, attacks, suspicious activity, fraud, spam, bot traffic, and security incidents. 

Purpose 

1. Platform security. 
2. Firewall protection. 
3. Bot protection. 
4. Abuse prevention. 
5. Suspicious activity detection. 
6. Security logging. 
7. Vulnerability monitoring. 
8. Access monitoring. 
9. Fraud prevention. 
10. Incident investigation. 

Data Processed 

1. IP address. 
2. Device information. 
3. Browser information. 
4. Login metadata. 
5. Request metadata. 
6. Security logs. 
7. Access logs. 
8. Event logs. 
9. Account identifiers. 
10. Suspicious activity indicators. 

17. Ecommerce Platform and Managed Ecommerce Providers 

Galla.app may provide ecommerce development, managed ecommerce services, ecommerce setup, store management, plugin configuration, payment gateway setup, marketplace connection, and order workflow setup. 

Where the Customer chooses or approves an ecommerce platform or provider, those platforms may process ecommerce-related data. 

Purpose 

1. Ecommerce website development. 
2. Product catalogue hosting. 
3. Shopping cart functionality. 
4. Customer checkout. 
5. Payment gateway integration. 
6. Order management. 
7. Shipping and logistics setup. 
8. Customer account functionality. 
9. Ecommerce analytics. 
10. Marketplace integration. 
11. Plugin or theme functionality. 

Data Processed 

1. Buyer name. 
2. Email address. 
3. Phone number. 
4. Billing address. 
5. Shipping address. 
6. Order details. 
7. Product details. 
8. Payment status. 
9. Return and refund data. 
10. Cart data. 
11. Website visitor data. 
12. Ecommerce account data. 
13. Support or complaint data. 

Customer Responsibility 

The Customer is responsible for: 

1. Ecommerce privacy policy. 
2. Ecommerce cookie policy. 
3. Return/refund policy. 
4. Shipping policy. 
5. Payment gateway terms. 
6. Marketplace terms. 
7. Consumer protection compliance. 
8. Product content legality. 
9. Product claims, images, pricing, and warranties. 
10. Customer-facing consent and communication compliance. 

18. ERP, Accounting, and Business System Integrations 

Galla.app may integrate with ERP systems, accounting software, Tally or similar platforms, business applications, or customer-specific systems. 

These systems are generally selected or authorised by the Customer and may be treated as Third-Party Integrations rather than Galla-appointed subprocessors.  

Purpose 

1. Syncing invoices. 
2. Syncing purchase data. 
3. Syncing sales data. 
4. Syncing stock data. 
5. Syncing customer or vendor data. 
6. Syncing payment status. 
7. Syncing order data. 
8. Generating reports. 
9. Connecting business workflows. 

Data Processed 

1. Customer records. 
2. Vendor records. 
3. Invoice data. 
4. Product data. 
5. Stock data. 
6. GST/tax fields. 
7. Payment status. 
8. Order records. 
9. Purchase and sales data. 
10. Integration logs. 

19. Logistics and Shipping Providers 

Galla.app may integrate with logistics, shipping, courier, transport, or delivery providers as part of warehouse, ecommerce, dispatch, or order fulfilment workflows. 

Purpose 

1. Dispatch management. 
2. Shipping label generation. 
3. Delivery tracking. 
4. Order fulfilment. 
5. Delivery status update. 
6. Return shipment processing. 
7. Logistics cost calculation. 
8. Proof of delivery workflows. 

Data Processed 

1. Recipient name. 
2. Recipient phone number. 
3. Shipping address. 
4. Order number. 
5. Product shipment details. 
6. Delivery status. 
7. Tracking number. 
8. Return status. 
9. Logistics metadata. 

20. Marketplace Integrations 

Galla.app may integrate with marketplaces selected by the Customer for ecommerce, inventory, order, billing, and fulfilment workflows. 

Purpose 

1. Product listing. 
2. Order sync. 
3. Inventory sync. 
4. Price sync. 
5. Dispatch update. 
6. Return and refund update. 
7. Sales reporting. 
8. Customer communication, where permitted. 

Data Processed 

1. Buyer data. 
2. Order data. 
3. Product data. 
4. Inventory data. 
5. Payment status. 
6. Shipment details. 
7. Return and refund data. 
8. Marketplace account metadata. 

21. Professional Services, Implementation, and Support Partners 

Treewalker Digital Private Limited may engage authorised partners, contractors, consultants, or implementation teams to assist with onboarding, configuration, migration, customisation, development, training, and support. 

Purpose 

1. Customer onboarding. 
2. Data migration. 
3. Configuration. 
4. Custom development. 
5. Integration support. 
6. Training. 
7. Report setup. 
8. Troubleshooting. 
9. Ecommerce implementation. 
10. Warehouse or POS rollout support. 

Data Processed 

1. Customer account data. 
2. Configuration data. 
3. Product and inventory data. 
4. POS and billing data. 
5. Warehouse data. 
6. Ecommerce data. 
7. Support tickets. 
8. Integration logs. 
9. Limited Personal Data required for support. 

22. Customer-Selected Third-Party Integrations 

Some third-party services are selected, authorised, connected, or controlled by the Customer. These may not be direct subprocessors of Treewalker Digital Private Limited. 

Examples include: 

1. Customer’s ERP system. 
2. Customer’s accounting software. 
3. Customer’s Tally account. 
4. Customer’s ecommerce platform. 
5. Customer’s marketplace account. 
6. Customer’s payment gateway account. 
7. Customer’s logistics provider. 
8. Customer’s WhatsApp Business Account. 
9. Customer’s SMS or email provider. 
10. Customer’s analytics tool. 
11. Customer’s custom API. 
12. Customer’s cloud storage or reporting system. 

When the Customer connects a Third-Party Integration: 

1. The Customer authorises Galla.app to send data to and receive data from that third party. 
2. The Customer is responsible for reviewing that third party’s privacy policy, terms, security, pricing, and data processing practices. 
3. The Customer is responsible for maintaining valid accounts, licenses, API keys, approvals, and permissions. 
4. Treewalker Digital Private Limited is not responsible for third-party downtime, data loss, API changes, policy changes, account suspension, pricing changes, security incidents, or misuse by such third party. 
5. Data shared with such third party may be governed by that third party’s terms and privacy policy. 

23. Product-Specific Subprocessor Mapping 

The following table shows the types of subprocessors that may be relevant to each Galla.app product module. 

24. Data Shared with Subprocessors 

Depending on the service used, subprocessors may process one or more of the following categories of data: 

1. Customer business name. 
2. Customer legal entity name. 
3. Admin user details. 
4. User name. 
5. User email address. 
6. User phone number. 
7. Login metadata. 
8. IP address. 
9. Device and browser data. 
10. Customer records. 
11. Vendor records. 
12. Employee or staff user records. 
13. Product data. 
14. Inventory data. 
15. Warehouse transaction data. 
16. POS billing data. 
17. Invoice data. 
18. Payment status. 
19. Ecommerce buyer data. 
20. Order data. 
21. Shipping data. 
22. WhatsApp recipient data. 
23. Message content. 
24. Campaign metadata. 
25. Support tickets. 
26. Screenshots and attachments. 
27. API logs. 
28. Error logs. 
29. Security logs. 
30. Analytics events. 
31. Backup data. 

Treewalker Digital Private Limited aims to share only the data necessary for the subprocessor to provide its service. 

25. International Processing and Data Location 

Subprocessors may process or store data in India or other countries depending on: 

1. Cloud infrastructure region. 
2. Subprocessor location. 
3. Third-party provider architecture. 
4. Integration settings. 
5. Support location. 
6. Customer-selected service. 
7. WhatsApp/Meta processing location. 
8. Payment gateway or ecommerce platform architecture. 

Where required by applicable law or contract, Treewalker Digital Private Limited will use reasonable safeguards for international data transfers, such as contractual protections, data processing agreements, security measures, and vendor due diligence. 

Customers with specific data residency requirements should contact Treewalker Digital Private Limited before deploying Galla.app or enabling integrations.

26. Subprocessor Due Diligence

Before engaging important subprocessors, Treewalker Digital Private Limited may review relevant factors such as: 

1. Nature of service. 
2. Type of data processed. 
3. Security posture. 
4. Privacy policy. 
5. Data processing terms. 
6. Confidentiality commitments. 
7. Infrastructure reliability. 
8. Data location. 
9. Access controls. 
10. Incident response commitments. 
11. Compliance certifications, where available. 
12. Business criticality. 
13. Availability of support. 
14. Contractual protections. 

The level of review may vary depending on the risk, service type, data sensitivity, and business impact. 

27. Contractual Safeguards 

Treewalker Digital Private Limited will take reasonable steps to ensure that subprocessors are subject to appropriate contractual obligations, which may include: 

1. Confidentiality obligations. 
2. Data protection obligations. 
3. Security obligations. 
4. Restricted use of Customer Data. 
5. Incident notification obligations. 
6. Subprocessing restrictions, where applicable. 
7. Return or deletion obligations, where applicable. 
8. Compliance with applicable law. 
9. Access control obligations. 
10. Cooperation obligations. 

28. Changes to Subprocessors 

Treewalker Digital Private Limited may add, replace, or remove subprocessors from time to time due to: 

1. Product changes. 
2. Infrastructure changes. 
3. Security improvements. 
4. Cost optimisation. 
5. Vendor performance. 
6. Customer requirements. 
7. New features. 
8. Integration requirements. 
9. Legal or regulatory changes. 
10. Vendor discontinuation. 
11. Business continuity reasons. 
12. Operational improvements. 

We may update this Subprocessor List when material changes occur. 

29. Customer Notice of Subprocessor Changes  

Treewalker Digital Private Limited may notify customers of material subprocessor changes through one or more of the following methods: 

1. Updating this webpage. 
2. Email notice. 
3. Dashboard notification. 
4. Account manager communication. 
5. Contractual notice. 
6. Update to the Data Processing Addendum. 
7. Update to the Trust Center. 

Customers are encouraged to review this Subprocessor List periodically. 

30. Customer Objection Process 

If a Customer has a reasonable privacy or security objection to a new subprocessor, the Customer may submit a written objection to: 

Legal Email: legal@trewwalkerlabs.com

The objection must include: 

1. Customer name. 
2. Account details. 
3. Name of the objected subprocessor. 
4. Specific privacy or security concern. 
5. Relevant facts supporting the objection. 
6. Proposed resolution, if any. 

The objection must be submitted within 15 days of receiving notice or publication of the updated Subprocessor List. 

Treewalker Digital Private Limited will review the objection in good faith and may: 

1. Provide additional information. 
2. Explain the safeguards in place. 
3. Offer an alternative configuration, where available. 
4. Disable the affected optional feature, where feasible. 
5. Use an alternative provider, where commercially reasonable. 
6. Allow the Customer to terminate the affected service as per the Agreement, if the concern cannot be resolved. 

Objections cannot be used to avoid payment obligations for services already delivered. 

31. Emergency Subprocessor Changes 

Treewalker Digital Private Limited may add or replace a subprocessor without prior notice if urgent action is required for: 

1. Security. 
2. Service continuity. 
3. Legal compliance. 
4. Disaster recovery. 
5. Platform stability. 
6. Prevention of data loss. 
7. Replacement of a failing vendor. 
8. Customer support emergency. 
9. Compliance with third-party platform requirements. 

In such cases, we will update the Subprocessor List or notify affected customers as soon as reasonably practicable. 

32. Removal of Subprocessors 

Treewalker Digital Private Limited may remove a subprocessor if: 

1. The service is no longer required. 
2. The vendor is replaced. 
3. The vendor creates security or compliance risk. 
4. The vendor is discontinued. 
5. The feature is discontinued. 
6. The Customer no longer uses the relevant module. 
7. The vendor fails to meet contractual or operational expectations. 
8. There is a legal, regulatory, or business reason to discontinue use. 

33. Responsibility for Subprocessors

Treewalker Digital Private Limited remains responsible for subprocessors engaged by us to process Customer Data on our behalf, to the extent required by applicable law and the Agreement. 

However, Treewalker Digital Private Limited is not responsible for third-party services that are: 

1. Selected by the Customer. 
2. Contracted directly by the Customer. 
3. Controlled by the Customer. 
4. Connected through Customer-provided credentials. 
5. Used independently by the Customer outside Galla.app. 
6. Governed by separate agreements between the Customer and the third party. 

34. Subprocessors and WhatsApp Marketing 

For WhatsApp Marketing, certain subprocessors or third-party platforms may be required, including: 

1. Meta / WhatsApp. 
2. WhatsApp Business Solution Providers. 
3. Cloud hosting providers. 
4. Campaign delivery infrastructure. 
5. Analytics tools. 
6. Support tools. 
7. Logging and monitoring tools. 

Customers must understand that WhatsApp messaging is subject to WhatsApp/Meta’s own terms, policies, pricing, approval rules, message categories, quality ratings, and account restrictions. 

Treewalker Digital Private Limited is not responsible for: 

1. WhatsApp policy changes. 
2. Template rejection. 
3. Message delivery failure. 
4. WhatsApp account suspension. 
5. WhatsApp Business Account restrictions. 
6. Phone number quality restrictions. 
7. Pricing changes. 
8. Recipient complaints caused by Customer campaigns. 
9. Unlawful use of WhatsApp Marketing by the Customer. 

35. Subprocessors and POS Billing 

For POS Billing, subprocessors may support: 

1. Hosting. 
2. Database. 
3. Backup. 
4. Email invoice delivery. 
5. Payment gateway integration. 
6. Analytics. 
7. Error monitoring. 
8. Support ticketing. 
9. Security logging. 

Personal Data may include buyer contact details, invoice data, payment status, billing address, and user activity logs. 

The Customer is responsible for correct tax, GST, invoice, HSN/SAC, product, pricing, and statutory configuration. 

36. Subprocessors and Warehouse Management 

For Warehouse Management, subprocessors may support: 

1. Hosting. 
2. Storage. 
3. Backup. 
4. ERP integration. 
5. Logistics integration. 
6. Error monitoring. 
7. Support tools. 
8. Security logging. 
9. Reporting. 

Data may include warehouse user data, dispatch contacts, delivery recipient data, vendor contacts, inventory logs, stock movement, barcode/QR/RFID records, and integration logs. 

The Customer is responsible for warehouse process control, physical stock verification, scanner usage, hardware maintenance, and staff training. 

37. Subprocessors and Ecommerce Services 

For Ecommerce Development and Managed Ecommerce Services, subprocessors or third-party services may include: 

1. Ecommerce platform. 
2. Website hosting. 
3. Payment gateway. 
4. Logistics provider. 
5. Marketplace provider. 
6. Analytics provider. 
7. Marketing tools. 
8. Email/SMS/WhatsApp tools. 
9. Customer support tools. 
10. Theme, plugin, or app providers. 

Customers are responsible for their own ecommerce privacy policy, cookie policy, refund policy, shipping policy, product claims, consumer compliance, payment gateway approvals, marketplace approvals, and lawful processing of buyer data. 

38. Subprocessors and APIs 

For APIs, webhooks, and integrations, subprocessors may support: 

1. API hosting. 
2. API gateway. 
3. Logging. 
4. Monitoring. 
5. Security. 
6. Error tracking. 
7. Cloud infrastructure. 
8. Customer-authorised third-party systems. 

Data may include API payloads, authentication tokens, logs, endpoint metadata, IP addresses, and integration data. 

Customers are responsible for securing API keys, access tokens, credentials, endpoints, and connected systems. 

39. Data Retention by Subprocessors 

Subprocessors may retain Customer Data or Personal Data only as needed to provide the relevant service, unless longer retention is required by law, contract, security, billing, audit, backup, dispute resolution, or technical necessity. 

Retention periods may vary by subprocessor and service category. 

Treewalker Digital Private Limited will use reasonable efforts to ensure that subprocessors return, delete, or restrict data in accordance with applicable agreements and operational requirements. 

40.Security Incidents Involving Subprocessors 

If Treewalker Digital Private Limited becomes aware of a confirmed security incident involving a subprocessor that affects Customer Personal Data, Treewalker Digital Private Limited will take reasonable steps to: 

1. Investigate the incident. 
2. Coordinate with the subprocessor. 
3. Assess impact on affected customers. 
4. Contain and mitigate the incident. 
5. Notify affected customers where required by law or contract. 
6. Provide available information reasonably required for customer compliance. 
7. Take remediation steps where commercially and technically feasible. 

Notification of a security incident does not constitute an admission of fault or liability

41. Recommended Internal Vendor Register 

Treewalker Digital Private Limited should maintain an internal vendor register with more detailed information than the public Subprocessor List. 

Recommended internal fields: 

1. Vendor name. 
2. Vendor category. 
3. Business owner inside Galla. 
4. Purpose of use. 
5. Product module affected. 
6. Data types processed. 
7. Personal Data involved. 
8. Sensitive data involved. 
9. Data location. 
10. Contract owner. 
11. Agreement signed date. 
12. Data processing agreement status. 
13. Security review status. 
14. Privacy review status. 
15. Risk rating. 
16. Renewal date. 
17. Exit plan. 
18. Backup vendor, if any. 
19. Incident contact. 
20. Last review date. 

42. Recommended Public Notice Text 

Galla.app may use the following notice on its Trust Center: 

“Treewalker Digital Private Limited uses trusted subprocessors to provide, secure, support, and improve Galla.app. Subprocessors may support cloud hosting, messaging, email delivery, payment processing, analytics, customer support, security monitoring, ecommerce workflows, and third-party integrations. We evaluate subprocessors based on service requirement, data sensitivity, security posture, and contractual safeguards. Customers may review our current Subprocessor List below and contact us for privacy or security questions.” 

43. Contact information

For questions about this Subprocessor List or to raise a privacy/security objection to a new subprocessor, contact: 

Treewalker Digital Private Limited
Product: Galla.app
Registered Office: Vikas Plaza.38/ 1A (4), Kanappana Agrahara, Hosur Rd, Phase II, Electronic City, Bengaluru, Karnataka 560100
Legal Email: legal@treewalkerlabs.com
Support Email: support@treewalkerlabs.com
Phone: +91-6366-740-274
CIN: U72900KA2021PTC153840
GSTIN: 29AAICT9733E1ZX 

44. Related Policies

This Subprocessor List should be published together with: 

1. Terms of Service. 
2. Privacy Policy. 
3. Cookie Policy. 
4. Data Processing Addendum. 
5. Security Policy. 
6. Data Retention and Deletion Policy. 
7. Acceptable Use Policy. 
8. WhatsApp Marketing Policy. 
9. SLA and Support Policy. 
10. Responsible Disclosure Policy. 
11. Incident Response Policy.