Contributed By ANA Law Group
India's IT outsourcing industry is still considered one of the largest exporters of IT and business process outsourcing (BPO) services ‒ something that has been on an increasing growth curve throughout the past several decades. Information technology and BPO services reportedly constitute approximately 60% of India's service exports and are estimated to be the largest component of India's service exports.
While the early days may have been focused on catering to businesses that reached out to India for cost reduction or to address manpower concerns, the current scenario is significantly different from how it started. IT outsourcing to India currently encompasses anything that one can relate to any kind of advanced technology development. The world reaches out to India for its outsourcing industry’s advanced skills and capabilities for support across the globe. Today, Indian captive subsidiaries and third-party vendors support most of the emerging and advanced technology for multinational corporations in the areas of AI, cloud computing, and blockchain.
The BPO market is steadily expanding with technological advancements, especially in developing countries like India. Although the COVID-19 situation created confusion among businesses globally, it surprisingly worked to the advantage of the Indian IT industry. India's domestic consumption for IT services over the past few years has experienced unprecedented growth, from remote working platforms and spreading to e-commerce, followed by the increased demand for outsourced support of various kinds to global businesses.
One of the key factors behind this development is the high-quality technical skills that today's Indian IT industry offers in the fields of AI, medical devices and pharmaceuticals, gaming, movies, robotics, etc. Another positive trend is that many large global corporations now consider India the preferred location to set up their global capabilities centres (GCCs) to support cloud management, data analytics and other high-tech services (as well as traditional services such as software development testing and support). Over the past few years, more than 150 MNCs have set up their GCCs in India.
Further, remote work that began during the pandemic ‒ followed by the hybrid working model ‒ became very common globally and is expected to continue as a preferred working model for employees as well as employers; hence, the demand for technological solutions to support these work models will further increase. Post-pandemic, two of COVID-19's major footprints (the work-from-home/hybrid work models) have kept the Indian IT outsourcing companies busy developing solutions and support for a variety of businesses across the globe.
Additionally, with the adoption of new technologies such as AI and IoT (Internet of Things), the BPO market in India is steadily evolving. Businesses in India are adapting to more technological advancements to stay relevant in the market and considering models that involve customers, employees, and other stakeholders. The technology also makes it possible for businesses to connect and outsource worldwide.
New technologies have had a very positive impact on the outsourcing industry. While some of these technologies are intended to reduce human interface and operate as an internal solution for various business functions, the development in the new technology sector has been exponential and continues as an ever-expanding ecosystem. It has opened up new opportunities for research, development, support and maintenance of the new technologies.
The large and highly qualified talent pool available in India can handle all kinds of requirements in the field of new technology and has positioned India as the most preferred jurisdiction for global clients. The language skills, time zone advantage, well-established common-law-based legal system, and geopolitical acceptance also help India attract global companies. The Indian IT outsourcing industry also supports large Indian corporations, some of which are globally appreciated innovators and leading businesses in their respective sectors.
However, the ability to deploy insourced AI and automation for various technology solutions results in companies assessing whether certain kinds of IT services should be outsourced to a third-party service provider. Notwithstanding, the scale and coverage of new technologies are likely to keep the Indian service providers engaged.
Further, there has been a lot of interest in the field of cloud-based outsourcing services as businesses have been looking for cost-effective options, along with a need-based increase in capacity. AI-based technologies have had an impact all across the IT and outsourcing industry. The industry is focused on developing AI technologies for both Indian and international corporations. Sectors like data analytics greatly benefit from AI. Outsourced service providers are actively involved in licensing these technologies from established companies and creating solutions to enhance their overall efficiency.
Virtual reality and metaverse technologies have created new service demands, presenting an opportunity for first-mover advantage and "Make in India" initiatives, particularly in healthcare, education, and gaming. With the growing network in outsourcing, several gaming platforms are generating revenues by offering courses or seminars on their platforms and by outsourcing their services to educational institutions that are transitioning their campuses to the metaverse.
IT outsourcing to India has progressed greatly from its origins as a cost-saving alternative. Currently, all kinds of industries (including IT and manufacturing) and professional service providers such as accounting and law firms utilise the services of the Indian outsourcing industry. The nature of outsourced services varies from support services to high-end search and product development. The services outsourced to India include traditional software development and testing, cloud services, blockchain, analytics, digital transformation, call centre/customer services, human resources, legal and accounting process outsourcing, back-office support, digital marketing, and many more.
There are no general regulatory restrictions on technology transactions or outsourcing in India. However, when it comes to outsourcing in Indian banking or the financial sector, India's central bank (the Reserve Bank of India)'s regulations mandate certain compliances concerning the functions that can be outsourced (eg, outsourcing of core functions) and security measures will apply for the appropriate use of contracts and technology. India's insurance and capital markets regulators have similar regulations applicable to outsourcing in their respective sectors.
A major industry-specific regulation in the financial sector is the Reserve Bank of India's Master Direction on Outsourcing of Information Technology Services 2023 (the "RBI Outsourcing Directions"). These guidelines apply to the outsourcing of IT services by banks and financial institutions, subject to certain exceptions. These guidelines have been introduced to ensure the protection of customer interests as well as regulatory compliance. The major compliance requirements are:
The banks also have certain reporting obligations with regard to the outsourcing of some functions. There are similar compliance requirements for cross-border outsourcing as well.
Similarly, the Securities and Exchange Board of India (SEBI) and the Insurance Regulatory and Development Authority of India (IRDAI) have also issued sector-specific guidelines for IT outsourcing to ensure confidentiality, data safety, and security. These regulations also restrict the outsourcing of core functions.
India also recently enacted its data privacy legislation, the Digital Personal Data Protection Act 2023 (DPDPA). Various provisions of the DPDPA are expected to be enforced in a phased manner, and the legislation will seek compliance from large technology companies in the initial stages. Although no specific timelines have been prescribed, the smaller companies will likely receive more time for total compliance. This law will apply to almost all kinds of data processing in India.
The statute mandates a data subject's specific and express compliance (except in the case of excluded legitimate-use categories). Further, a data controller will be responsible for ensuring reasonable technical and security measures to prevent data breaches. Additionally, the data controllers must report all types of data breaches or cyber-incidents to a government authority ‒ namely, the Indian Computer Emergency Response Team (CERT-In or ICERT). The timelines prescribed for reporting cyber-incidents are also sector-specific (ie, a shorter timeline is prescribed for the banking and financial sectors). Other businesses also find the reporting timelines very short, and it is difficult to determine what kind of incidents should be mandatorily reported. Given that almost all businesses in India can be exposed to cybersecurity or other kinds of cyber incidents on a daily basis, businesses are adopting a case-to-case-based approach to deciding about such reporting.
Although the transfer of personal data out of India is permitted subject to the prescribed compliances, the government can restrict such data transfers to specific (blacklisted) countries under the DPDPA. However, the government has not as yet prepared such a list of countries.
Regarding children's data, parental consent is mandatory, irrespective of whether the data controller is engaged in a business or activity specifically targeting children.
The foregoing provisions of the DPDPA will apply to international businesses operating in India or through their outsourced providers when processing Indian personal data. In terms of compliance, given that all the major corporations (as well as the large Indian outsourced service providers) already implemented GDPR compliance measures several years ago, a comparative analysis of compliance requirements may be appropriate from the DPDPA perspective.
The standard contract models follow either a third-party service provider outsourcing, a captive unit, or a Build-Operate-Transfer (BOT) model. Many international businesses initially began outsourcing to India through third-party service providers.
A captive unit is normally established by setting up a wholly owned subsidiary in India. Although setting up a captive unit and the associated compliances involve more effort for a customer, they can ultimately be in charge of the complete operations of its India captive outsourcing centre. This model provides more transparency, protects confidential information and IP, and allows the implementation of a customer's own protocols within its captive Indian outsourcing centre.
Another preferred outsourcing model in India is the BOT model, which is chosen more for the outsourcing of a company's core functions. A BOT model is suitable for companies unsure of their long-term outsourcing plans, enabling them to use a facility developed in India according to their specifications. It also offers the flexibility to either acquire the facility at a specified date or opt-out. However, this model comes with its own set of challenges. For instance, operational costs can be higher than those associated with third-party outsourcing and may be comparable to those of a captive centre. Once the BOT centre is transferred to the customer, they must comply with various Indian regulations concerning real estate, taxation, employment, and other relevant legislation.
A BOT model may also be perceived as a collaborative advantage to clients as well as suppliers. For example, the client seeking to work with experts while suppliers seeking to participate on account of higher margins is a cooperative outcome for both. However, in the years to come, the companies might adopt a hybrid approach wherein the client outsources to a third party and also operates as a captive for others.
Additionally, as opposed to the initial perception that the IT outsourcing industry involves projects outsourced from overseas jurisdictions, domestic outsourcing is also a significant part of today's industry. Domestic companies across all industry sectors contribute to a large number of onshore outsourcing projects in India.
Similarly, many international companies (as well as Indian companies) frequently adopt the staff augmentation model whenever there is a need for additional resources. Companies consider this a more cost-effective and easy-to-manage model than dedicated team-based outsourcing unless their products are of a long-term nature.
Project-based outsourcing models are also very popular in India. A clear, well-drafted contract that clearly identifies the terms and conditions, remedies in case of default or delays, audit rights, and a reputable outsourcing partner can make the project-based models easy and effective.
A joint venture between a customer and the service provider establishes an outsourcing service centre while allowing for equal participation and control to a customer. However, this is not a very commonly used model for outsourcing to India, as most India-bound outsourcing transactions aim to procure services for a customer's own consumption. This model may be more appropriate if the customer and service provider want to operate jointly and sell their services to outside entities in addition to their own consumption.
A fixed-price outsourcing contract is normally established where the client transfers its in-house activities to the vendor by receiving the expected output in return for a fixed amount. This model guarantees that the vendor receives a fixed amount from the client, ensuring financial stability. It allows both parties to budget effectively without concerns about fluctuating expenses and is suited for well-defined projects with clear deliverables.
Multi-sourcing models can be suitable, ie, when outsourced services can be obtained from different vendors without the need for synchronised outputs among them. While this approach allows for procuring services from multiple vendors, it can lead to challenges in coordinating their efforts and managing project timelines effectively. Given that the other existing outsourcing models have been tested and well-established over several years, multi-sourcing is not commonly used.
Digital transformation, including the adoption of cloud computing, software as a service (SaaS), and infrastructure as a service (IaaS), had a significant impact on outsourcing contract models in India.
Introducing these platforms has persuaded businesses to adopt service-based models instead of traditional labour-based ones. Companies appear to be more comfortable with pay-per-use arrangements as opposed to outsourcing based on full-time resources. Similarly, businesses are adopting pay-per-use pricing models in outsourcing contracts, where clients pay only for the resources they use, thereby creating cost-effective outsourcing models in India.
Digital transformation has necessitated more flexible and industry-responsive outsourcing contract models in India. These new and evolving models focus more on services, data security, and adaptability to meet the changing needs of the business landscape. The international customers outsourcing to India, as well as the Indian companies adopting the digital transformation, may have to focus more on their contract negotiations in order to benefit from the digital transformation.
In the past few years, the Indian outsourcing industry has witnessed significant growth in the development and support of digital solutions, mainly because of the businesses' demand for digital transformation in order to reach out to consumers in a more attractive, cost-effective and interactive manner. Social media content creation and management, app development, data analytics, etc, contribute as a sizeable complement to digital transformation initiatives.
Businesses prefer outsourcing models for digital transformation because the key resources within an organisation need not be fully involved in the management of such projects. Therefore, while an organisation's human resources focus on core competencies, an expert outsourced service provider can add a lot more value to a business's requirements in the field of digital transformation – often at a much lower cost and with a faster turnaround.
Technology transactions and outsourcing are largely governed by the contract law in India. At the outset, customer protection can be ensured through a well-drafted contract of international standards; thus, the remedies can be availed through contractual, statutory, and common law provisions.
The key contractual provisions are representations and warranties from the vendor, confirming its:
Further, the following provisions form part of an outsourcing contract to ensure the protection of a customer’s rights:
Customers should be vigilant in maintaining an arm's length relationship with the service provider by structuring the outsourcing contract on a principal-to-principal basis. It is also essential to include adequate provisions to ensure that the service provider's employees are treated in a way that prevents them from being able to claim an employment relationship with the customer.
It may also be prudent for a customer to insist that the service provider should not further subcontract the services or should not do so without the customer's prior written approval. While India has a large talent pool of resources working in the IT outsourcing industry, there is also significant attrition. This results in vendors trying to subcontract their projects to other service providers, which may not always work in the best interests of a customer.
Customer’s Rights/Protections in IP developed
As India has been a favourite destination for global companies for IT activities, research and development, resulting in a variety of IP developments, the companies must understand the legal and practical aspects to ensure effective ownership of IP developed in India.
In a typical project, the overseas customers ("customers") execute agreements ("development agreements") with their Indian service providers ("service providers") before the commencement of the projects. In most of these agreements, the service providers confirm that they have assigned and/or agree to assign all service provider-developed IP rights.
However, based on the applicable Indian law and also the practices followed in India, development agreements alone may not ensure the customer's ownership of India-developed IP rights. Therefore, an outsourcing contract must address some practical concerns, such as:
The IP ownership in India varies under different IP laws ‒ for instance, in the case of an employee-developed copyright, the employer will be the first owner of the copyright. Therefore, the service provider will own its employee-developed copyright. However, this will not apply to independent contractor-developed copyrights. Regarding patents, the inventor will be the first owner, regardless of whether they are employees or contractors.
In most cases, the standard templates of development agreements normally provide that:
However, the important legal and practical concern in cases where the service provider promises that its employees and contractors will assign the IP rights to the customer is whether it is advisable to make such assignments directly with the customer and create such contractual relationships between the customer and the service provider's employees and contractors. Further, when the service provider promises to assign the IP rights to the customer, the concern is whether the service provider owns all the IP rights in the work product developed by its employees and contractors.
Unless extremely necessary and supported by detailed agreements and documentation, a customer should avoid direct IP assignment and the creation of contract relationships with the service provider's employees and contractors. Therefore, a better option is for the service provider to assign the IP rights to the customer under a two-level IP assignment process. The first level will be between the service provider and its employees and contractors to ensure that the service provider owns the IP in the work product developed. The second level will be between the service provider and the customer, under which the service provider will assign the IP rights obtained from its employees and contractors.
Further, the customer and the service provider must agree in the development agreement to execute specific deeds of assignment to assign all the IP rights. A format of the deed of assignment must be agreed upon, and preferably, a draft should be annexed to the development agreement, broadly identifying the development work to be carried out by the service provider. This will act as prima facie proof of the kind of IP rights that may be developed, and the parties have validly agreed that the customer will own such service provider's developed IP.
After ensuring that the service provider owns the IP rights developed by its employees and contractors, the customer must ensure that the service provider executes the deeds of assignment in the customer's favour to assign any copyright, invention, patent, design rights and all other IP developed. In order to achieve this, the development agreement between the customer and the service provider should clearly make the service provider liable to ensure that the service provider's contracts with its employees have the above-mentioned provisions for IP protection.
Under the development agreement, the Indian vendor is required to provide a power of attorney to the customer (ie, in case the vendor is not available to complete the assignment). This document will authorise the customer to take the necessary steps to acquire the intellectual property rights that the Indian vendor has developed and agreed to assign. Similarly, the vendor should also obtain a similar power of attorney from its employees.
The absence of a deed of assignment from the employees and independent contractors to the vendor can cause greater challenges if the vendor’s personnel leave the employment in the middle of a partly developed project. This is why there must be a deed of assignment at the beginning of the project, which will broadly identify the nature of work handled by the employees and their agreement to assign this. Thereafter, when the work product/project is complete, the key employees involved in the project must execute another deed of assignment assigning all the IP rights in such work product to the vendor.
Further, in the case of a breach of IP or confidentiality obligations by the service provider personnel, the general dispute resolution provisions of the outsourcing contract may not suffice. The customer should obtain specific assurances from the service provider with regard to initiating legal actions against the service provider personnel and providing adequate information and support in case the customer decides to take charge of such proceedings.
Performance and service level provisions must be approached seriously. The service provider must agree that the performance of the services will meet or exceed each of the service levels, as may be applicable. Further, service-level credits must be defined as separate from liquidated damages or penalties ‒ although they can finally be offset against any damages if the customer initiates any proceedings and damages awarded.
Business Continuity and Disaster Recovery
As part of the outsourcing agreement, the service provider must prepare and provide a detailed disaster recovery plan for crisis management and business continuity. The disaster recovery plan must be based on industry practices and include remote performance capabilities for the provision of services in case of a disaster. The parties may also agree to mock disaster recovery exercises once every year.
Data breaches can cause irreparable harm to a customer and it may be difficult to estimate the damages in monetary terms - hence, the customer should have the right to seek injunctive relief, irrespective of whether arbitration or another dispute resolution mechanism is in the agreement. If any personnel from the service provider breach or threaten to breach any terms or conditions of the outsourcing agreement, the customer has the right to seek injunctions against those personnel and take legal action for the breach. This right is in addition to the service provider's right to prosecute their own personnel. The service provider must agree to provide all the required assistance to the customer in this regard.
The service provider must agree that any deliverable materials or other software/hardware provided as part of the services will not infringe the IP rights of any third party.
The service provider must agree that it will not directly or indirectly participate in any act that constitutes a violation of the United States Foreign Corrupt Practices Act (FCPA), Mexican local laws regarding anti-corruption (eg, the Ley Federal Anticorrupcion en Contractataciones Publicas), the UK Bribery Act, and all other applicable national and local laws and regulations relating to the subject matter hereof, including both the anti-bribery and accounting provisions of the FCPA.
It is critical to get an agreement from the service provider regarding its key personnel. The parties typically designate a group of service provider employees as critical to the services under an agreement and also ensure such key personnel's consistent quality and availability in providing the services as a material provision.
To the extent permitted by applicable law, the customer should conduct detailed background investigations of service provider personnel engaged in providing the services. This can be done practically through the service provider, based on a detailed policy and a reputed vendor. The agreement should have detailed provisions confirming that the service provider's employees will not be considered the customer's employees under any circumstances.
Further, the agreement should also specify that the service provider will be responsible for the payment of compensation (including employment-related taxes, federal, state, and local income taxes, and workers' compensation) associated with their employees' employment.
One of the major grounds for termination is the material breach of contract. There are practical limitations to comprehensively defining what constitutes material breaches, and, as a result, termination on the grounds of certain material breaches ends up in long discussions. Depending on the nature and scale of the contract, some provide for termination for convenience with reasonable notice or by payment of termination payout in a pre-determined amount.
Other standard grounds for termination include bankruptcy, a force majeure event, a change of control, a change of any applicable laws that may impact the rendition of services under the agreement, any adverse regulatory actions against the service provider, and service-level defaults.
The outsourcing agreements normally provide exhaustive post-termination provisions, such as transitioning the services to a new service provider. In case the services have to be transitioned because of the service provider's default, many customers do succeed in obtaining an agreement from the service provider to bear the costs for such transitioning. Other provisions include the return of customer materials and information.
In case a service provider breaches the contract, the customer can seek and obtain damages for any direct losses caused as a result of such breach. However, the customer will not be able to succeed in a claim for indirect or consequential damages or loss of profits. Notwithstanding, the parties are free to agree on a quantum of liquidated damages with respect to various breaches or consequences anticipated under the contract. Liquidated damages are a more practical and preferred option and can be obtained, irrespective of whether the party proves that it has suffered actual damage or loss. In many cases, the liquidated damages are quantified based on the fees paid to the service provider or the value of a certain kind of project.
In India, no implied terms are relevant to technology transactions or outsourcing.
Please refer to 2.3 Restrictions on Data Processing or Data Security. Additionally, depending on the nature and size of the outsourced operations, customers demand a variety of cybersecurity and data protection safeguards from the service providers. The service agreements normally include extensive provisions mandating the service provider's obligations to ensure that the customer's confidential information, trade secrets, business plans, and information regarding IP are handled with utmost care and only in the manner and as required for the provision of services as specified in the services agreement. Customers also require that the service provider's personnel execute non-disclosure agreements to confirm their compliance with the service provider's confidentiality and security obligations under the services agreement.
Regarding business continuity in cyber-incidents, any service providers with alternate arrangements and locations maintain unrestricted provision of services. This has almost become a standard requirement in large-scale outsourcing contracts.
Further, the majority of the Indian outsourcing service providers' customers include any subsidiaries of multinational companies as well as large Indian corporations. These businesses include e-commerce, healthcare companies, financial institutions, technology solution providers, and social media platforms. All these businesses will be involved in processing the personal data of Indian customers, and therefore, the outsourcing companies will also have to comply with the various requirements of the DPDPA/SPDI Rules.
Regarding data localisation requirements, even though the new legislation reverses the requirement of data localisation, the government has the power to restrict the transfers to certain countries. Additionally, the new legislation does not want to interfere with sector-specific localisation requirements, such as the ones introduced by India's central bank.
India is adapting to securing data through encryption processes, which helps mitigate data breaches on a large scale. Several data protection methods are applicable in cloud computing, such as access control, data masking, integrity checking, etc. Cloud service providers work to ensure that users have access to only authorised and required data. Suppliers conducting personal and periodic security training for all stakeholders may ensure customers' business continuity.
Benchmarking, a comprehensive SLA, periodic audits, remedies for deficiency in the quality of services or performance timelines, and disaster recovery and business continuity options are the most common contractual clauses that help the customer manage and measure the supplier’s performance in technology transactions and outsourcing.
Although a customer can draft a comprehensive outsourcing contract and have it executed by the service provider, the customer's ultimate remedy in the case of the service provider's poor performance or breach of agreement will be to initiate legal actions, which is a challenging solution. Therefore, apart from a good contract, the customer should also approach the outsourcing relationship in a practical manner.
Performance management and measurement is a process that must commence from the initial stages of an outsourcing engagement. The customer must conduct a thorough due diligence and capability assessment of the service provider. Thereafter, the customer must carry out periodic audits of the services, structured in such a manner that it does not create a permanent establishment or employment claims from the service provider personnel against the customer. The outsourcing agreement should include provisions enabling the customer to seek removal of certain service provider personnel in case of non-performance and underperformance, contrary to the agreement.
There are no major differences if the outsourcing is cloud-based. However, customers generally tend to exercise more caution in including provisions to address breaches of confidentiality and data privacy, as well as remedies, including liquidated damages for such breaches. In many cases, customers insist that – unless the customer expressly consents – the service provider will not provide the services from, within or through the use of a public, community or hybrid "cloud" or on virtual servers not directly owned or leased and controlled by the service provider.
Indian labour laws do not permit the automatic transfer of employees from one entity to another unless such transfer arises from a transfer of ownership to another entity. Thus, outsourcing does not change the entity's structure in terms of its employees unless the transaction involves the acquisition or is operated as a BOT model. Further, from a practical perspective, most companies obtain employee consent for the transfer to a new entity to avoid future conflicts.
In case of lack of transparency concerning how the service provider has managed the employee-related compliances, it is advisable for a customer to hire such employees after they formally terminate their relationship with the service provider and the service provider gives appropriate warranties and indemnities to protect the customer from any past claims initiated by the employees. Additionally, in terms of social security benefits such as gratuity and provident funds managed through government organisations, the transferee may have to continue maintaining those benefits by making contributions from the date of onboarding such transferred employees.
Historically, trade union activities in India have been limited to the traditional sectors. The unions primarily focused on wage and benefits issues. However, as part of the development of the economy and diversity in employment roles, the trade unions have also been focusing on more areas to ensure the workforce’s overall welfare.
Further, the trade unions have also become active in the IT/BPO sectors during the past few years. Although there have not been any major negative impacts, trade unions in key cities such as Bangalore, Pune and Kolkata have been very active participants in the IT industry.
As regards other sectors, workers' council consultation can be based on the nature of changes introduced by outsourcing, ie, if outsourcing alters the job conditions or causes loss of employment, the employers will have to consult the workers' council.
There have not been any organised approaches in this respect. The customer preference in respect of onshore, offshore, or nearshore outsourcing can be regarded as more of a needs-based choice. However, the goal of offshore outsourcing in India has evolved from simply cutting costs to boosting efficiencies.
Further, outsourcing activities in India are currently wider than just data processing or call centre activities. Therefore, the structuring of transactions in this respect is normally based on the assessment of the most beneficial location or model.
India does not have any specific laws governing remote working. However, certain legislations related to workers' compensation and payment of wages may be interpreted to apply to remote-working employees, requiring the company to compensate for any injury caused during such remote work and to ensure payment of wages to remote employees on or before the due date. In some Indian states, the place of remote work can be considered as a commercial establishment even if it is not one. Legal provisions, such as minimum wage requirements, may also be applicable to remote workers to ensure they receive the applicable minimum wages.
7th Floor
Keshava
Bandra Kurla Complex
Bandra East
Mumbai 400 051
India
+91 22 6112 8484
mailbox@anaassociates.com www.anaassociates.com