Data Processing Agreement

This Data Processing Agreement ("DPA" or "Agreement") forms part of the services agreement or Terms of Service (the "Principal Agreement") between the following parties, collectively referred to as the "Parties":

1. Purpose and Scope

The purpose of this DPA is to reflect the Parties' agreement regarding the processing of Personal Data in accordance with applicable Indian data protection laws, primarily the Digital Personal Data Protection Act, 2023 ("DPDPA") and the Information Technology Act, 2000.

The Processor agrees to process Personal Data on behalf of the School solely to deliver the administrative, academic, financial, and analytical services described in the Principal Agreement, through the SchoolTeams platforms: the school website, the cloud ERP management software, and the integrated mobile applications.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including the students, parents, guardians, and staff of SHREE VAGEESHWAREE VIDHYA MANDIR SENIOR SEC SCHOOL.
• "Data Principal" means the individual to whom the Personal Data relates; for a student under 18, this includes the student's parent or lawful guardian.
• "Processing" means any operation or set of operations performed on Personal Data, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, or destruction.
• "Sub-processor" means any third party appointed by or on behalf of the Processor to process Personal Data on behalf of the School.

3. Obligations of the School

The School shall:

1. Lawful basis and notice: Ensure that all Personal Data entered into the SchoolTeams platform is obtained through valid, itemized, and explicit notices as required by Indian law.
2. Consent for minors: Because the platform processes data of individuals under 18, the School bears sole responsibility for obtaining verifiable consent from parents or lawful guardians before creating student accounts, as required by Section 9 of the DPDPA.
3. Accuracy of data: Ensure that the data entered into the software is accurate, up to date, and complete.

4. Obligations of the Processor

The Processor shall:

1. Process strictly on instructions: Process the Personal Data only on documented, written instructions from the School, unless required to do otherwise by applicable law. The Processor will never use this data for behavioral profiling, targeted commercial advertising, or third-party data trading.
2. Confidentiality: Ensure that all personnel authorized to handle the School's data, such as engineers, cloud architects, and support agents, are bound by legally enforceable non-disclosure agreements.
3. Security measures: Implement appropriate technical and organizational measures to protect the Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including:
   • hosting the Personal Data on servers located within India;
   • encrypting data in transit over public networks with TLS; and
   • keeping each school's data logically isolated, with encryption of stored data.
4. Sub-processing: Not engage any Sub-processor, such as an SMS or messaging gateway, without binding it to data protection obligations equivalent to those in this DPA.
5. Assistance with Data Principal rights: Provide tools in the SchoolTeams administrative dashboards and mobile applications that help the School respond to requests from parents, staff, and students who have turned 18 to access, correct, or erase their data. For example, when a parent asks for their child's profile to be erased, the School's administrator can carry out the erasure.
6. Data breach notification: Notify the School's registered administrator without undue delay, and in any event within 48 hours of becoming aware of a Personal Data breach. The notification will describe the data affected and the immediate mitigation steps. The Processor shall contain the breach, assist the School in investigating and mitigating it, and, together with the School, report it to the Data Protection Board of India and CERT-In within the timelines prescribed by law.
7. Return and deletion of data: On expiry or termination of the Principal Agreement, follow the process in Section 8.

5. Details of Data Processing

• Subject matter: The provision of the SchoolTeams school website, cloud ERP management software, mobile applications, and SMS and messaging alerts to the School.
• Duration: The term of the Principal Agreement, and afterwards until the data is returned or deleted under Section 8.
• Categories of Data Principals, types of Personal Data, and purposes:

6. Audit and Inspection

The Processor shall make available to the School the information necessary to demonstrate compliance with this DPA, including executive summaries of its periodic security compliance checks and Vulnerability Assessment and Penetration Testing (VAPT) reports.

Where a formal compliance audit is requested by the School or by an Indian regulatory body, it shall be scheduled with at least thirty (30) business days' prior written notice, conducted during off-peak hours, and carried out by a mutually agreed independent auditor.

7. Liability

Each Party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations of liability set out in the Principal Agreement.

8. Termination and Data Erasure

• Extraction window: For fifteen (15) calendar days after the Principal Agreement ends, the Processor will keep a secure, read-only copy of the School's database, from which the School can download its complete student and financial records in CSV or Excel format.
• Permanent erasure: After this window, the Processor will permanently erase the School's Personal Data from all web portals, databases, and application caches.
• Statutory retention: Billing records, transaction histories, and tax invoices relating to the Processor's own services to the School will be retained securely for the period required by Indian tax and accounting laws.

9. Governing Law and Jurisdiction

This DPA shall be governed by the laws of India. Any disputes arising from or in connection with this DPA that cannot be settled amicably shall be subject to the exclusive jurisdiction of the competent courts of Bikaner, Rajasthan.