Data Processing Addendum

Version 1.0 · Effective 12 October 2026

This Addendum forms part of the Terms of Service. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, the Customer is the Data Fiduciary and we are the Data Processor.

1. Instructions. We process personal data only on the Customer’s instructions. These instructions are the Terms of Service, this Addendum, and the settings the Customer chooses within the Services. The data and purposes are listed in Schedule 1.
2. No use for our own purposes. We will not sell personal data, use it for advertising or marketing, build profiles of individuals, track or monitor children’s behaviour, or use identifiable data to train software models. We may create aggregated statistics that identify no Customer or individual.
3. Our staff. Only staff who need access to support the service can access personal data, and they are bound by confidentiality.
4. Security safeguards. We maintain reasonable safeguards, including:
   • encryption of data in transit and at rest;
   • regular, encrypted backups; and
   • periodic security testing.
5. Sub-processors. The Customer authorises us to use service providers in the categories listed in Schedule 2. We will tell the Customer on request which providers we use. We bind each sub-processor to obligations equal to these and remain responsible for them.
6. Location of data. Data is hosted with established cloud service providers, primarily in data centres in India or elsewhere in Asia. Some processing, such as service analytics or backups, may take place in other regions depending on the provider’s availability. We will only use countries not restricted by the Government of India, and will comply with any restriction it notifies.
7. Personal data breach. If we become aware of a breach affecting the Customer’s data, we will:
   1. inform the Customer without undue delay;
   2. describe its nature, extent, timing, likely impact and the steps taken to contain it;
   3. help the Customer notify the Data Protection Board and affected individuals, including the detailed report due within 72 hours; and
   4. make any report we must make ourselves, such as to CERT-In.
8. Rights requests. We will help the Customer respond to requests to access, correct or erase personal data, and to grievances. Any request we receive directly will be passed to the Customer within a reasonable time.
9. Retention. The Customer manages its records within the Services, including adding, updating and removing them. We keep usage and security logs for the periods in Schedule 1. When the Customer stops using the Services, we will act on its written instructions about its data, unless the law requires us to keep it.
10. Information and audit. Once a year, or after a breach, we will give the Customer reasonable information to show compliance with this Addendum, such as a summary of our security measures and our latest security test.
11. Liability. Liability under this Addendum is subject to the limits in the Terms of Service, clause 11. We are not responsible for a breach caused by the Customer or its users, such as shared or compromised login details, or caused by following the Customer’s instructions. The Customer will tell us promptly about any suspected breach it becomes aware of and help limit its impact.

Schedule 1: Processing details

The individuals whose data is processed depend on the Services the Customer uses: for example students, parents and staff for school management, or employees, customers and suppliers for business applications. Some of them, such as students, may not be users themselves; their data is entered and managed by the Customer.

Usage analytics do not include names, contact details, records entered by the Customer, or screen recordings.

Schedule 2: Sub-processors

We use established providers in these categories. A current list is available on request.