1. Roles and scope
The School is the data fiduciary and determines the purpose and means of processing personal data entered into the platform. We process that personal data only as a data processor, and only in accordance with the School’s documented instructions, including those set out in this DPA and in the Terms and Conditions.
This DPA covers the categories of data listed in our Privacy Policy, and the processing activities reasonably necessary to deliver the Services, including storage, retrieval, display, transmission, backup, and generation of reports and certificates.
2. Our obligations
- Process personal data only on the School’s instructions and only for the purposes of providing the Services.
- Ensure that personnel authorised to process personal data are bound by appropriate confidentiality obligations.
- Implement and maintain the technical and organisational security measures described in our Privacy Policy.
- Assist the School, so far as reasonably possible, in responding to requests from data principals exercising their rights under the Digital Personal Data Protection Act, 2023.
- Assist the School in ensuring compliance with its obligations relating to security, breach notification and data protection impact assessments.
- Delete or return personal data at the end of the provision of Services, in accordance with the retention provisions in the Terms and Conditions.
3. School obligations
- Provide accurate and lawful instructions for the processing of personal data.
- Obtain and maintain all consents and provide all notices required to permit the processing contemplated by the agreement.
- Ensure that the personal data it uploads is accurate, relevant and limited to what is necessary.
- Not instruct us to process personal data in a manner that would breach applicable law.
4. Sub-processors
The School provides general authorisation for us to engage sub-processors to support the delivery of the Services, including cloud hosting and infrastructure providers, email providers and payment processors. A current list is available on request.
We will: (a) enter into a written agreement with each sub-processor imposing data protection obligations no less protective than those in this DPA; (b) remain liable to the School for the performance of our sub-processors’ data protection obligations; and (c) notify the School of any intended change to sub-processors so that the School may object on reasonable data protection grounds.
Infrastructure data is stored in the Mumbai (ap-south-1) region. Any transfer of personal data outside India will be carried out in accordance with applicable law.
5. Security measures
We maintain, at a minimum:
- encryption of personal data in transit and at rest;
- role-based access controls enforced at the application and database level;
- storage of passwords only as one-way cryptographic hashes;
- audit logging of sensitive actions;
- regular backups and tested recovery procedures;
- restriction of internal access on a need-to-know basis; and
- a process for identifying and remediating security vulnerabilities.
6. Personal data breach
We will notify the School without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting the School’s data, providing sufficient information for the School to meet its own notification obligations. We will take reasonable steps to mitigate the breach and to prevent recurrence, and will cooperate with the School and any regulator in relation to the incident.
7. Audits
We will make available to the School such information as is reasonably necessary to demonstrate compliance with this DPA. Where a School requires further assurance, we will cooperate with a reasonable audit, subject to: at least 30 days’ written notice; the audit being conducted during business hours and not more than once in any 12-month period (unless required by a regulator or following a material breach); the audit being carried out by an independent auditor bound by confidentiality; and the auditor not accessing data belonging to any other School.
8. Liability and governing law
Liability under this DPA is subject to the limitations set out in the Terms and Conditions. This DPA is governed by the laws of India, and disputes are subject to the dispute resolution and jurisdiction provisions of the Terms and Conditions.