Confidentiality

1. Mutual protection and permitted purpose

These proposed terms protect confidential information disclosed by either party while discussing or delivering One IT Plan services. They become contractual only when incorporated into an accepted agreement with the identified legal provider. A separately signed NDA prevails if it conflicts with this page. Neither a website visit nor a test subscription signs an NDA.

2. What is confidential

Confidential information includes nonpublic business plans, pricing, customer and employee records, ERP data, credentials, configurations, security findings, source code and other information that is marked confidential or reasonably understood to be confidential. It can be written, oral, electronic or observed through authorized system access. Each party retains its ownership rights.

Information is excluded only to the extent the receiving party can demonstrate that it was already lawfully known without restriction, became public without breach, was independently developed without using the confidential information, or was lawfully received from a third party without a confidentiality duty.

3. Limited access and reasonable safeguards

The receiving party may use information only to evaluate or perform the agreed work, not for unrelated commercial use, publication or disclosure to competitors. Access is limited to personnel and approved service providers who need it and are bound by confidentiality duties appropriate to their role. Each party must use reasonable care, at least the care it uses for its own similar information, and remains responsible for the people it authorizes.

Before access, agree named accounts where practical, minimum permissions, secure credential sharing, approved transfer methods and access revocation. The appropriate safeguards depend on the system and data. Do not send passwords, full payment card details or sensitive records through initial email or WhatsApp conversations.

4. Service teams, providers and AI tools

Standard ERPNext hosting uses managed cloud server infrastructure and large-file storage uses cloud file storage. Approved access locations, hosting regions and provider responsibilities must be recorded before processing customer data. The parties must address any required data-processing agreement, cross-border transfer terms or regulated-data safeguards before access.

Customer confidential information must not be submitted to an external AI tool without approval of the tool and intended use. The provider’s retention, training-use settings and access terms must be reviewed first. These proposed terms prohibit using customer confidential data to train general-purpose models without separate written permission; they do not claim that every AI vendor offers the same controls.

5. Legally required disclosure

If disclosure is legally required, the receiving party may disclose only what is required. Where legally permitted, it will notify the other party promptly and reasonably cooperate with lawful efforts to seek confidential treatment or limit disclosure. Nothing requires a party to violate law or a valid legal order.

6. Suspected loss or unauthorized access

Each party must notify the other without undue delay after becoming aware of a confirmed unauthorized disclosure of the other party’s confidential information, and cooperate on containment and remediation. Credible suspected incidents should be raised promptly for investigation. Notices should explain known facts, affected information and corrective steps as they become available. Applicable law and any signed data-processing agreement control mandatory reporting deadlines.

7. Return, deletion and duration

On written request or termination, the receiving party must return or delete information it no longer needs for the agreed purpose, using the agreed export and deletion process. Limited copies required by law or routine backups may remain for documented retention periods with access restricted and confidentiality maintained. Backup removal may follow the agreed rotation schedule rather than immediate selective deletion.

The proposed confidentiality duty continues for three years after the agreement ends. Trade secrets remain protected for as long as they qualify as trade secrets under applicable law. Personal data remains subject to applicable law and the agreed retention and data-processing terms. A signed NDA may establish a different duration.

8. Request an NDA or report a concern

Email info@oneitplan.com with your company name and a brief description of the required agreement or concern. Do not include the sensitive material itself in the initial message. We will agree the appropriate channel and contact before you share it.