Terms and Conditions of Use

1. Definitions

• “Agreement” means these Terms, applicable Order Forms, SOWs, DPAs, SLAs, the AUP and product-specific terms.
• “Authorised User” means a Customer employee, contractor, consultant or agent authorised to use a Platform.
• “Background IP” means pre-existing or independently developed intellectual property, including tools, frameworks, libraries, templates, methodologies, know-how, software, models, prompts, utilities and documentation.
• “Customer Data” means data, content, records, files, personal data or information submitted to, stored in, transmitted through or otherwise made available for the Services by or for Customer.
• “Deliverables” means work products expressly identified as deliverables in a signed SOW.
• “Order Form” means an order, proposal, subscription order, quote or similar document accepted by both parties.
• “Platform” means a Megamax SaaS product or hosted application, including the Kasturi Suite where applicable.
• “SOW” means a statement of work signed by authorised representatives of both parties.

2. Contract Hierarchy

If there is a conflict, the following order prevails solely for the subject matter expressly covered: (a) a signed DPA, for personal-data processing and security; (b) a signed SLA, for service levels and credits; (c) a signed Order Form or SOW, for scope, fees, Deliverables, timelines, assumptions and engagement-specific terms; (d) product-specific terms and the AUP; and (e) these Terms. A lower-ranking document does not amend a higher-ranking document unless it expressly identifies the amended provision and is accepted in the required manner.

3. Website Licence and Restrictions

Subject to these Terms, Megamax grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable right to access and display the Website for legitimate evaluation of Services. All content, trademarks, software, designs, materials and other intellectual property remain owned by Megamax or its licensors.

You must not sell, reproduce, modify, mirror, frame, scrape, crawl except as expressly permitted by robots.txt, systematically extract, publish, commercially exploit, reverse engineer or create derivative works from Website content without Megamax’s written consent. Downloaded material remains subject to proprietary notices and separate licence terms.

4. Professional and Managed Services

Engagement. Professional, managed IT, cloud, cybersecurity, development, AI/data engineering, DevOps, infrastructure, connectivity, IBM i/AS400, staff augmentation, VAPT and similar Services are provided under an applicable Order Form or SOW. No scope change is binding unless agreed in writing by authorised representatives.

Customer responsibilities. Customer shall provide timely, accurate requirements, lawful access, environments, credentials, dependencies, approvals, test data, third-party licences and an authorised decision-maker. Delays or failures may change timelines, fees and dependencies. Deliverables are deemed accepted if Customer does not report material non-conformity within the SOW review period or, if none is stated, within 10 business days after delivery.

Payment. Invoices are payable within 30 days of invoice date unless the Order Form states otherwise. Undisputed overdue amounts may accrue interest at 1.5% per month or the maximum lawful rate, whichever is lower. Invoice disputes must be notified in writing within 15 days with reasonable details. Fees exclude applicable GST and other indirect taxes. Customer may deduct TDS where legally required and shall provide the applicable certificate, including Form 16A where applicable, within the statutory period.

Staff augmentation. Personnel supplied under a Hire Experts or staff-augmentation engagement remain Megamax employees or contractors. Customer shall not directly employ, solicit or engage those personnel during the engagement and for 12 months thereafter, except with Megamax’s written consent or the placement fee stated in the SOW; if none is stated, six months’ gross remuneration of the relevant individual.

VAPT and security testing. Customer represents that it owns or has written authority to authorise testing of all in-scope systems. Before testing, the parties shall agree a written scope, testing window, contacts, exclusions, emergency-stop procedure and rules of engagement. Megamax may suspend testing if it reasonably believes activity could cause material harm or is unauthorised.

5. SaaS Platforms and Kasturi Suite

This section applies where Customer uses a Megamax Platform, including Kasturi HRMS, Kasturi Assist, Kasturi IntelliDocs, Kasturi AI ATS, AI HR Assistant, AI Data Migration, HR Document Automation or successor products. Product-specific terms available through the relevant Platform apply in addition to these Terms.

Licence. Megamax grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable right for Authorised Users to use the Platform for Customer’s internal business purposes during the subscription term, subject to agreed subscription limits and timely payment.

Subscription limits. Customer shall not share credentials, circumvent user, device, storage, feature, transaction or API limits, or use pooling, multiplexing or similar techniques to avoid fees. Megamax may measure use and invoice excess usage at agreed or then-current rates after reasonable notice.

Trials. Trials are provided “as is” and may be changed, limited or withdrawn at any time. Unless otherwise agreed, trial data must be exported before expiry and may be deleted 30 days after expiry.

Renewal and termination. Subscriptions renew for the applicable renewal term unless Customer gives at least 30 days’ written notice before renewal for monthly subscriptions and 60 days’ written notice before renewal for annual subscriptions, unless the Order Form states otherwise. Fees are non-refundable except where required by law or expressly agreed in writing.

Availability. Megamax targets 99.9% monthly availability for the Platform, excluding planned or emergency maintenance, force majeure, Customer systems, third-party services not controlled by Megamax and events outside Megamax’s reasonable control. This target is not a service-credit commitment unless a signed SLA or Order Form expressly provides credits.

API and integrations. API access and third-party integrations are limited to authorised use, documented endpoints, agreed quotas and applicable third-party terms. Megamax may apply reasonable rate limits, security controls and technical changes. Customer is responsible for authorising integrations and data flows enabled at its direction.

6. Data Protection, Privacy, DPDP and GDPR

6.1 Scope and incorporation

This Section 6 governs personal-data processing under these Terms. It must be read with: (a) the Megamax Privacy Policy, as updated from time to time; (b) any signed Data Processing Agreement (DPA); and (c) applicable data-protection law. This includes, where applicable, the Digital Personal Data Protection Act, 2023 (DPDP Act), the Digital Personal Data Protection Rules, 2025 (DPDP Rules), Regulation (EU) 2016/679 (GDPR), and the UK GDPR. Where there is a conflict, the DPA prevails for personal-data processing and security obligations to the extent it expressly states.

6.2 Roles of the parties

Roles may differ by processing activity. For personal data Customer submits to a Megamax Platform or Service, including employee, worker, contractor or applicant data, Customer generally determines purpose and means and is the Data Fiduciary under the DPDP Act and controller under the GDPR/UK GDPR. To the extent Megamax processes such Customer Data solely on Customer’s documented instructions, Megamax acts as a Data Processor under the DPDP Act and processor under the GDPR/UK GDPR. Megamax may act as an independent Data Fiduciary or controller for account administration, billing, security, fraud prevention, support, service analytics, legal compliance and business-contact data processed for Megamax’s own purposes.

6.3 Customer obligations and lawful basis

Customer is responsible for: (a) establishing a valid lawful basis, including consent or another lawful ground, for personal data submitted to Megamax; (b) issuing legally required notices to data principals or data subjects; (c) obtaining necessary consents, permissions, parental or guardian approvals for children’s data, and other authority; (d) configuring and using Services in compliance with employment, anti-discrimination, consumer-protection, data-protection, AI and sectoral laws; (e) responding to data-principal or data-subject requests in its capacity as fiduciary or controller; and (f) ensuring Customer Data does not contain regulated, sensitive, biometric, health, payment-card or children’s data unless the relevant Service, DPA and SOW expressly support it and necessary safeguards are in place.

6.4 Megamax obligations and security

Megamax shall process personal data in accordance with applicable law and maintain reasonable technical and organisational security measures appropriate to the nature of the data and risks involved. Measures may include encryption in transit, access controls, authentication, logging and monitoring. Megamax shall engage sub-processors only under written obligations no less protective than these Terms and, where applicable, the DPA. A current list of material sub-processors is available on request from legal@megamaxservices.com.

6.5 Security incidents

If Megamax confirms a security incident involving Customer Data, Megamax shall notify Customer without undue delay and provide reasonably available information to support Customer’s assessment and response, including the nature of the incident, affected systems or data where known, containment measures and recommended actions. Detailed incident-notification periods, cooperation, regulatory communications and allocation of costs are governed by the DPA. Where legally permitted, Megamax shall consult Customer before making a regulatory notification that identifies Customer.

6.6 Data retention, export and deletion

On expiry or termination, Megamax shall make Customer Data available for export for 30 days in a structured, commonly used, machine-readable format unless a different period is agreed in an Order Form, SOW or DPA. Thereafter, Megamax may delete Customer Data, subject to legal retention obligations, security backups, disaster-recovery cycles, archived logs and unresolved disputes, claims or investigations. Data retained under an exception remains protected and will not be used for operational purposes except as required for that exception.

6.7 Cross-border transfers

Where personal data is transferred outside India, the EEA, the United Kingdom or another data subject’s jurisdiction, Megamax and its group companies and sub-processors shall implement safeguards required by applicable law. Such safeguards may include contractual arrangements, the EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, the UK International Data Transfer Agreement or UK Addendum, binding corporate rules or another valid transfer mechanism. Transfer details, where applicable, are set out in the DPA.

6.8 DPDP compliance

Where the DPDP Act and DPDP Rules apply, each party shall comply with its respective statutory obligations as and when the applicable provisions become effective. Customer, as Data Fiduciary for Customer Data, is responsible for providing clear notices, maintaining valid consent or other lawful basis, enabling withdrawal of consent and rights/grievance mechanisms as applicable. Megamax shall provide reasonable assistance in its role as Data Processor, subject to the DPA and the Services. Nothing in these Terms limits any non-waivable right or statutory obligation under the DPDP Act or DPDP Rules.

6.9 GDPR

Where the GDPR applies: (a) each party shall comply with its respective obligations; (b) where Megamax acts as processor, the DPA shall include the processing terms required by Article 28 GDPR and comparable UK GDPR requirements, including documented instructions, confidentiality, security, sub-processor controls, assistance with data-subject rights, breach support, DPIAs, audits and deletion or return; (c) Customer shall provide all legally required privacy information to data subjects and establish an appropriate lawful basis for processing; (d) Megamax shall assist Customer, taking account of the nature of processing and information available, with Customer’s obligations under Articles 32 to 36 GDPR and comparable UK GDPR provisions; and (e) nothing in these Terms limits data-subject rights or the powers of competent supervisory authorities.

6.10 Data-subject rights and grievances

Data principals and data subjects may have rights of access, correction or rectification, erasure, restriction, objection, portability, grievance, nomination, withdrawal of consent and complaint, subject to applicable law. Requests and grievances may be sent to legal@megamaxservices.com. Where Megamax acts as processor, it shall provide reasonable technical assistance to Customer. Where Megamax acts as an independent Data Fiduciary or controller, it shall respond directly in accordance with applicable law.

6.11 Indemnity and liability

Customer shall indemnify Megamax against third-party claims, regulatory penalties, losses and reasonable legal costs arising from: (a) Customer’s failure to establish a lawful basis, issue notices, or obtain necessary consent or other authority; (b) Customer Data that infringes rights or violates law; or (c) Customer’s instructions or use of Services causing Megamax to breach applicable data-protection law, except where the breach is solely caused by Megamax’s failure to comply with DPA obligations as processor. Megamax’s liability for data-protection claims is subject to the limitation-of-liability provisions in these Terms, except where the DPA expressly provides otherwise or where liability cannot lawfully be limited.

6.12 Privacy Policy and DPA

The Privacy Policy describes Megamax’s collection, use and disclosure of personal data as an independent Data Fiduciary or controller. It does not limit Customer’s obligations under this Section 6 or the DPA. For B2B and SaaS engagements, the parties shall execute a DPA where required by law or reasonably requested by either party. The DPA governs detailed processor obligations, sub-processing, transfers, security, breach notification, audit, retention and deletion.

7. Acceptable Use

Customer and Authorised Users shall comply with the AUP, incorporated into these Terms. Customer shall not use Services unlawfully; interfere with security or availability; introduce harmful code; obtain unauthorised access; send spam; infringe rights; upload unlawful or unauthorised data; conduct unauthorised testing; or use Services to facilitate fraud, harassment, discrimination or unlawful conduct.

8. Artificial Intelligence

AI features produce probabilistic outputs that may be inaccurate, incomplete, biased or unsuitable for a particular purpose. AI outputs are decision-support tools only and are not legal, financial, medical, employment or other professional advice. Customer is responsible for independent review and all decisions made using AI features.

Customer shall maintain meaningful human oversight of consequential decisions, including employment-related screening, hiring, promotion, performance, termination or similar decisions. Customer is solely responsible for compliance with applicable employment, anti-discrimination, consumer-protection, data-protection, AI and sectoral laws, including EU AI Act obligations where use has an EU nexus.

9. Intellectual Property

Subject to full payment, Megamax assigns Customer the Deliverables expressly identified in a signed SOW as assigned Deliverables, excluding Background IP, open-source components, third-party materials and generic developments. Megamax retains Background IP. To the extent Background IP is incorporated in assigned Deliverables, Megamax grants Customer a non-exclusive, royalty-free, perpetual licence to use it solely as embedded in and necessary to use the Deliverables for Customer’s internal business purposes.

Services and Deliverables may include open-source components subject to their respective licence terms. Customer’s use is governed by the applicable open-source licence. Megamax’s IP indemnity does not apply to claims caused by Customer modifications, combinations not supplied by Megamax, Customer Data, Customer instructions, or use contrary to the Agreement.

10. Confidentiality

Each party shall protect the other party’s Confidential Information using at least reasonable care, use it only for the Agreement, and disclose it only to personnel and subcontractors with a need to know and equivalent confidentiality obligations. Confidential Information excludes information publicly available without breach, previously known without confidentiality obligation, independently developed or lawfully received from a third party. These obligations survive for five years after termination and indefinitely for trade secrets, subject to applicable law.

Unsolicited information submitted through the public Website, other than Customer Data or information submitted under a signed engagement, is not confidential. Do not submit confidential information through public Website forms unless Megamax expressly requests it for a contracted purpose.

11. Third-Party Services and Links

Third-party services, integrations, content and websites are governed by relevant third-party terms and privacy practices. Megamax does not control and is not responsible for third-party services or content. Customer is responsible for authorising data flows to third parties enabled at Customer’s direction. Alliance partner references or logos do not constitute endorsement of Megamax or any specific deployment outcome.

12. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE WEBSITE, SERVICES, PLATFORMS, THIRD-PARTY CONTENT AND AI OUTPUTS ARE PROVIDED “AS IS” AND “AS AVAILABLE”. MEGAMAX DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AVAILABILITY, SECURITY AND ERROR-FREE OPERATION. NOTHING IN THIS SECTION EXCLUDES WARRANTIES THAT CANNOT LAWFULLY BE EXCLUDED.

13. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE OR CONSEQUENTIAL DAMAGES, OR LOST PROFITS, REVENUE, SAVINGS, GOODWILL, BUSINESS INTERRUPTION OR LOSS OF DATA, ARISING FROM OR RELATING TO THE AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT SHALL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO MEGAMAX UNDER THE RELEVANT ORDER FORM OR SOW IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. FOR A FREE SERVICE, MEGAMAX’S TOTAL LIABILITY SHALL NOT EXCEED INR 10,000.

The exclusions and cap do not apply to fraud or fraudulent misrepresentation, death or personal injury caused by negligence where liability cannot be excluded, payment obligations, Customer’s breach of licence restrictions or misuse of Services, or liabilities that cannot lawfully be excluded. Liability for confidentiality and data-protection obligations is subject to the cap unless the DPA or SOW expressly provides otherwise.

14. Indemnities

Customer shall indemnify Megamax and its affiliates, personnel and contractors against third-party claims, losses, damages, penalties, costs and reasonable legal fees arising from Customer Data, Customer’s or an Authorised User’s unlawful use, breach of the Agreement or law, unauthorised testing, or failure to obtain lawful basis, notices, consents or other authority for Customer Data. Megamax shall promptly notify Customer and permit Customer to control the defence, provided Customer may not settle a claim imposing liability or admission on Megamax without consent.

Megamax shall defend Customer against a third-party claim alleging that unmodified Deliverables or a Platform, used in accordance with the Agreement, infringe a third party’s intellectual-property rights, and pay final damages or settlements approved by Megamax. Megamax may procure continued use, modify or replace the affected item, or terminate the affected Service and refund prepaid unused fees. This is Customer’s exclusive IP-infringement remedy.

15. Suspension and Termination

Megamax may suspend access where reasonably necessary to address security risk, unlawful use, material breach, non-payment or legal requirement. Except in an emergency or where prohibited by law, Megamax will provide notice and a reasonable opportunity to cure. Megamax will use reasonable efforts to limit suspension to the affected account, feature or activity and restore access after resolution.

Either party may terminate an Order Form or SOW for material breach not cured within 30 days after written notice, or immediately if the other party becomes insolvent or subject to winding-up proceedings, to the extent permitted by law. Customer remains liable for accrued fees and non-cancellable commitments stated in the Order Form or SOW.

16. Force Majeure

Neither party is liable for delay or failure, other than accrued payment obligations, caused by events beyond reasonable control, including natural disaster, epidemic, war, terrorism, civil unrest, government action, labour disruption, widespread internet or cloud-infrastructure failure, or third-party service-provider failure. The affected party shall provide prompt notice and use commercially reasonable efforts to resume performance. If the event continues for more than 60 consecutive days, either party may terminate the affected Service without further liability except accrued obligations.

17. Publicity, Export Controls and Compliance

Megamax may identify Customer by name and logo in customer lists and marketing materials only with Customer’s prior written consent, unless a signed Order Form expressly grants consent. Customer may withdraw prospective consent by written notice to legal@megamaxservices.com.

Each party shall comply with applicable anti-bribery, anti-corruption, anti-money-laundering, export-control and sanctions laws. Customer shall not export, re-export, transfer, access or use Megamax technology, software, Deliverables or Services in violation of applicable law or for a sanctioned person, entity, territory or prohibited end use.

18. Changes, Notices and General

Megamax may update these Terms. For material changes adversely affecting a paid subscription, Megamax will give at least 30 days’ prior notice by email, Platform notice or prominent Website notice, unless a shorter period is required for legal, security or emergency reasons. Continued use after the effective date constitutes acceptance. If Customer does not accept a material adverse change to a paid subscription, Customer may terminate the affected subscription before the change takes effect and receive any remedy required by law or expressly stated in the Order Form.

Legal notices to Megamax must be sent to legal@megamaxservices.com. Legal notices to Customer must be sent to the legal or notice address in the Order Form or SOW. Notices are deemed received on the next business day after transmission unless the sender receives a delivery-failure notice. Operational notices may be sent through the Platform or to the registered account administrator.

Customer may not assign the Agreement without Megamax’s prior written consent. Megamax may assign the Agreement to an affiliate or in connection with a merger, acquisition, reorganisation or sale of substantially all relevant assets, on notice. The Agreement creates no employment, agency, partnership or joint venture. If a provision is unenforceable, remaining provisions remain effective. A waiver must be in writing. English prevails over translations. Provisions which by nature should survive, including payment, IP, confidentiality, privacy, disclaimers, liability, indemnities, dispute resolution and general provisions, survive termination.

19. Governing Law and Dispute Resolution

The Agreement is governed by Indian law, without regard to conflict-of-law rules. The parties shall first attempt in good faith to resolve disputes through senior-management negotiation within 30 days after written notice. If unresolved, the dispute shall be finally resolved by arbitration under the Arbitration and Conciliation Act, 1996, as amended, by one arbitrator appointed by mutual agreement within 30 days; failing agreement, appointment shall occur under the Act through the competent court or institution. The seat of arbitration is New Delhi, India, and the language is English.

Courts at Delhi/New Delhi have exclusive jurisdiction for interim, conservatory, supervisory or enforcement relief related to arbitration. Nothing prevents either party from seeking urgent protective relief from a court of competent jurisdiction. Any claim must be brought within the period permitted by applicable law; nothing limits a mandatory statutory limitation period.