Data Processing Summary for Schools

This summary explains how Eduvedha processes personal data on behalf of the schools that use it. It forms part of the Terms of Service and is the contract between the school (the Data Fiduciary) and Eduvedha (its Data Processor) that Section 8(2) of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) requires. [A signed Data Processing Agreement is available on request.]

1. Roles

• The school is the Data Fiduciary. It decides why and how the personal data of its students, parents, guardians and staff is processed, and is answerable to them and to the Data Protection Board of India.
• Eduvedha is the Data Processor. It processes that data only on the school’s behalf, to provide the Service.
• For the school’s own account holders’ sign-in and billing data, Eduvedha acts as a separate Data Fiduciary, as described in the Privacy Policy.

2. Details of the processing

3. What Eduvedha commits to

• Instructions: we process Customer Data only on the school’s documented instructions — the Terms, the school’s set-up and use of the Service, and written instructions from an authorised administrator. If we believe an instruction breaks the law, we tell the school.
• Purpose limitation: we do not use Customer Data for our own purposes, sell it, use it for advertising, or use it to track or profile children.
• Confidentiality: our personnel with access are bound by confidentiality and access only what they need, for example to handle a support request the school has raised.
• Security: we maintain the reasonable security safeguards described in section 5, as Rule 6 of the DPDP Rules requires.
• Sub-processors: we engage them only under written contracts with equivalent data-protection terms, and remain responsible for them (section 6).
• Data Principal requests: the Service lets the school view, correct, export and delete records. If a student, parent or staff member contacts us directly, we forward the request to the school within [7] days and do not answer it ourselves unless the school asks us to.
• Breaches: we notify the school as described in section 7.
• End of contract: we return and delete Customer Data as described in section 8.
• Demonstrating compliance: we give the school the information reasonably needed to show compliance with this summary, for example by answering a security questionnaire [once a year]. [Audits by the school or its independent auditor with [30] days’ notice, at the school’s cost and under confidentiality.]

4. What the school commits to

• Have a lawful basis for each processing activity and give clear notices to students, parents, guardians and staff.
• Obtain verifiable consent from a parent or lawful guardian before processing a child’s personal data, unless an exemption under the DPDP Act or DPDP Rules applies to the processing.
• Enter only the data needed for its purposes, and keep it accurate.
• Manage its users: give each person only the role they need, keep credentials confidential, and remove access promptly when someone leaves.
• Use integrations it connects (payment gateway, SMS or WhatsApp provider, e-mail server) lawfully and under its own agreements with those providers.
• Respond to requests and grievances from its Data Principals, and inform the Data Protection Board and affected people of breaches involving its data.
• Give only lawful instructions.

5. Security measures

• Encryption: HTTPS/TLS for all connections to the Service; integration secrets (payment-gateway keys, SMS and WhatsApp credentials, push-notification keys, backup-destination credentials) encrypted at rest; passwords stored only as salted one-way hashes.
• Access control: each school’s data is kept separate from other schools’ data; role-based permissions inside each school; rate-limited sign-in; production access restricted to authorised personnel.
• Visibility: audit trails of important changes and sign-in logs, used to detect and investigate unauthorised access, and kept for [1 year].
• Continuity: regular database backups [with off-site copies] and a tested restore procedure.
• Organisational: confidentiality obligations, need-to-know access, and data-protection terms in contracts with sub-processors.

6. Sub-processors

Eduvedha currently uses the following sub-processors for Customer Data:

• We give at least [30] days’ notice (by e-mail or on this page) before adding or replacing a sub-processor that processes Customer Data. If the school objects on reasonable data-protection grounds and we cannot resolve the objection, the school may terminate the affected part of the Service [with a pro-rata refund of prepaid fees].
• Providers that a school connects with its own account (its payment gateway, SMS or WhatsApp provider, or e-mail server) act for the school, not for us, and are not our sub-processors.

7. Personal data breach notification

• We notify the school without undue delay, and in any case within [24] hours of becoming aware of a personal data breach affecting its data.
• The notice includes what we know at the time: the nature, extent, timing and location of the breach, its likely impact, the measures taken and recommended, and a contact person. We update the school as we learn more.
• The school, as Data Fiduciary, informs the Data Protection Board of India and the affected Data Principals. We provide the information the school needs to send the Board its detailed report within 72 hours, as the DPDP Rules require.
• We contain, investigate and remedy the breach, and report it to CERT-In where we are required to.

8. Retention, return and deletion

• During the subscription the school decides what to keep and can delete records in the Service. Records that are archived rather than removed are permanently deleted at the end of the subscription, or earlier on the school’s request.
• At the end of the subscription the school can export its data for [30] days. We then delete Customer Data from live systems within [30] days, and backup copies are overwritten within [90] days. On request, we confirm deletion in writing.
• We keep only what the law requires us to keep (for example invoices, and security logs for [1 year]), protected and used only for that purpose.

9. Location and transfers

Customer Data is hosted in [India - hosting region]. Some sub-processors listed above may process data outside India; transfers take place only as permitted by Section 16 of the DPDP Act and any restrictions notified by the Central Government.

10. Contact