This Data Processing Agreement ("DPA") is between Eduiey ("Eduiey"), an education software service run from Sector 27, Gurugram, Haryana 122002, India, and the institution on whose behalf it is accepted, including all its organisations on Eduiey (the "Institution"). It forms part of the Eduiey Terms of Service (the "Terms").
1. Acceptance
1.1 An administrator of the Institution accepts this DPA in Eduiey on the Institution's behalf. By accepting, the administrator confirms that they are authorised to bind the Institution.
1.2 Eduiey records each acceptance: the administrator's name, the time, the IP address and device, and the version accepted, with a fingerprint of its exact text. The parties agree that this electronic acceptance binds the Institution as if the DPA had been signed. One acceptance covers all the Institution's organisations on Eduiey.
1.3 When Eduiey publishes a new version that must be accepted, an administrator is asked to accept it. Section 15 applies to changes.
2. Definitions
2.1 "Act" means the Digital Personal Data Protection Act, 2023, and "Rules" means the Digital Personal Data Protection Rules, 2025, each as amended. "Personal data", "Data Principal", "Data Fiduciary", "Data Processor", "processing", "personal data breach", "child" and "Board" have the meanings given in the Act.
2.2 "Service" means Eduiey: its apps, web app, the Institution's public page if used, and the AI assistant if in the Institution's plan.
2.3 "Institution Personal Data" means personal data that Eduiey processes on the Institution's behalf to provide the Service, as described in section 3.
2.4 "Sub-processor" means a third party that Eduiey engages to process Institution Personal Data (section 8).
3. The processing
3.1 The Institution is the Data Fiduciary for Institution Personal Data, and Eduiey is its Data Processor.
3.2 Subject matter and purpose: providing the Service, so that the Institution can manage its people and its academic, administrative, financial, communication, admissions, campus and placement records, and each user can see and act on what they are allowed to.
3.3 Duration: while the Terms apply, and afterwards until deletion under section 12.
3.4 Nature: collection (through the Service and the Institution's public page), storage, display to authorised users, calculation (attendance, marks, grades, fees, salaries), producing documents, delivering messages and notifications, the AI assistant, passing transaction data to the Institution's own payment providers, export and deletion.
3.5 Data Principals: students and learners, including children; parents and guardians; staff; the Institution's administrators; applicants; contacts at placement companies; and visitors to the Institution's public page.
3.6 Personal data, depending on the features used: identity and contact details (name, phone, email, date of birth, gender, address, photo, admission or employee number, role); details the Institution defines for each role, which may include sensitive information such as health details; sign-in data; academic records; family links; fee and payment records; staff attendance, salary and payout records, and bank account or UPI ID; messages, notices and notifications; admissions applications and documents; library, hostel, meal and ID card records; placement records; uploaded files; AI assistant chats; and the audit trail of actions, with IP address and device.
4. Instructions
4.1 Eduiey processes Institution Personal Data only on the Institution's instructions. These are: this DPA and the Terms; the Institution's configuration and use of the Service (the people it adds, the roles and settings it chooses, and what its users do); and other reasonable written instructions from its authorised administrators.
4.2 If Eduiey believes an instruction breaks the law, it will say so and need not follow it.
4.3 Eduiey will not sell Institution Personal Data, use it for advertising, profile individuals for its own purposes, use it to train AI models, or track, monitor the behaviour of or target advertising at children.
4.4 Eduiey's platform administrators may view users' records across institutions only to give support and investigate faults. Eduiey does not yet keep a record of these views.
4.5 On the Institution's written request, Eduiey will switch the AI assistant off for the roles the Institution names, such as students or parents.
5. The Institution's duties
5.1 The Institution has a lawful basis under the Act for all Institution Personal Data. It gives Data Principals the notices the Act requires, including its own privacy notice published in the Service and notice to people whose data it held before the Act applied, and it answers their requests and complaints.
5.2 Children. The Institution obtains verifiable consent of a parent or guardian before a child's data is processed, where the Act and Rule 10 require it. The Service provides tools: a linked parent's approval in the app, recording a consent the Institution holds (method and date), a declaration that all its learners are 18 or older, and a grace period after which a child without consent is locked out. The Institution is responsible for accurate dates of birth and parent links, for whether its records satisfy Rule 10, and for making the 18-or-older declaration only if it is true.
5.3 The Institution is responsible for the accuracy of its data, the access it gives its staff, the security of its administrator accounts, deactivating people who should no longer have access, and data its users export.
5.4 The Institution tells Eduiey who its data protection contact is and keeps it up to date. Eduiey sends notices to that contact and to the Institution's administrators in the app.
6. Confidentiality and security
6.1 Eduiey ensures that the people it allows to access Institution Personal Data (its team and the platform administrators it appoints) are bound by confidentiality and use that access only to provide and support the Service.
6.2 Eduiey maintains these measures:
- all traffic encrypted in transit (HTTPS/TLS);
- passwords stored only as bcrypt hashes;
- bank account numbers, UPI IDs and payment-gateway secrets encrypted (Fernet) and shown only masked;
- every request checked against the signed-in account's institution, keeping institutions apart;
- role-based access to each page, enforced on the server; students and parents see only their own or their child's records; the AI assistant follows the same rules and needs the user's confirmation before any change;
- sign-in rate limits and account lockout; sessions end on deactivation or password change, and can be revoked;
- an append-only audit trail of changes, sign-ins and downloads of reports and documents, and an append-only consent log, both enforced by the database; the audit trail is kept for at least one year;
- uploaded files kept private and served only to people allowed to see them;
- photos re-encoded to remove location data.
6.3 The Institution acknowledges that the Service does not currently offer multi-factor authentication, and that Eduiey does not itself encrypt all stored data (only what section 6.2 lists), does not keep encrypted or regularly tested backups, holds no security certification, has not commissioned penetration tests, and does not monitor the Service round the clock. Eduiey will tell the Institution when any of this changes. Eduiey may change its measures but will not reduce the overall protection.
7. Personal data breaches
7.1 Eduiey will tell the Institution's contact and administrators about a personal data breach affecting Institution Personal Data without delay, and in any case within 24 hours of becoming aware of it.
7.2 The notice will give, as far as then known, what the Institution needs under Rule 7: what happened (nature, extent, timing and location); the likely consequences for the people affected; which people and records are affected, and roughly how many; what has been done and is planned to contain it and reduce harm; what is known of the cause and of who caused it; steps to prevent a repeat; and a contact at Eduiey. Eduiey will send updates so that the Institution can inform the Board without delay and send its detailed report within 72 hours.
7.3 Eduiey will contain and investigate the breach, preserve evidence and keep the Institution informed.
7.4 Eduiey can send an in-app notice to every user of the Institution's organisations, recording who was sent it and when. It will send the Institution's notice at the Institution's request. If the Institution has not said how its users should be told within 24 hours of Eduiey's notice, the Institution authorises Eduiey to send them a factual notice: what happened, the likely consequences, what has been done, what they should do, and whom to contact. Eduiey cannot yet send email or SMS, so users who don't sign in must be reached through the Institution's own channels.
7.5 Eduiey will make any report the law requires of it, including to CERT-In within 6 hours, and will tell the Institution. Eduiey will report to the Board on the Institution's behalf only if the Institution asks in writing. A notice under this section is not an admission of fault.
8. Sub-processors
8.1 The Institution authorises these Sub-processors:
- Railway (Railway Corporation): hosting of the application, database, cache and server logs; all Institution Personal Data; Singapore.
- Cloudflare, Inc.: storage of uploaded files (R2) and domain names; uploaded files; a region Cloudflare selects, not yet fixed to one country.
- Vercel Inc.: delivers the web app; IP address, browser and requested addresses; global network.
- Google LLC: fonts and web-app files, and Eduiey's email (Google Workspace); IP address and browser, and email exchanged with Eduiey; global.
- Anthropic, PBC: the AI assistant, if in the plan; questions, attached files, the records the assistant reads, and the user's first name, role and institution; United States. Under Anthropic's commercial terms this data is not used to train its models.
8.2 These are not Sub-processors: the Institution's own payment providers (Razorpay, Stripe, RazorpayX), which act under the Institution's own agreements with them; speech recognition on a user's own device or browser, if the user speaks to the AI assistant; and maps and videos the Institution embeds on its public page.
8.3 Eduiey engages each Sub-processor on terms that protect personal data as far as they fit its service, and remains responsible to the Institution for them.
8.4 Eduiey will give at least 30 days' notice before adding or replacing a Sub-processor, in the app or by email, and will update the Privacy Policy. If the Institution objects on reasonable data protection grounds within that time and the parties cannot resolve it, the Institution may end its use of the Service and receive a refund of fees paid for the period after the end.
9. Processing outside India
Institution Personal Data is stored in Singapore, uploaded files are stored as section 8 states, the AI assistant processes data in the United States, and Eduiey's personnel access the Service from India. Eduiey will not transfer Institution Personal Data to a country restricted under section 16 of the Act, will follow any requirement made under Rule 15, and will tell the Institution and move or stop the affected processing if a restriction applies.
10. Helping with Data Principals' requests
10.1 The Service gives the Institution these tools: each person's own pages (Profile, My details and the "My …" pages); correcting details (by the Institution, and by people for the details it allows); consent records, with export and PDFs; recording a parent's consent or a withdrawal; erasing a person's personal details, where attendance, marks, fees and receipts stay attached to the erased record and the consent log keeps proof of the consents and of the erasure; and nominees named by its people.
10.2 Where the tools don't cover a request, such as a full copy of one person's data, Eduiey will help within 30 days of the Institution's written instruction. This is done by hand.
10.3 If a Data Principal sends Eduiey a request about Institution Personal Data, Eduiey will pass it to the Institution within 5 working days and tell the person it has done so. Eduiey will not answer the substance unless the Institution asks it to.
11. Legal requests
If an authority requires Eduiey to disclose Institution Personal Data, Eduiey will tell the Institution first unless the law forbids it, and will disclose only what is required.
12. Retention and the end of the agreement
12.1 While the Institution uses the Service, Eduiey keeps Institution Personal Data, except what the Institution or its users delete or erase. Files attached to AI chats are deleted after 7 days, and spreadsheet-import working copies after 30 days. A chat a user deletes is hidden, and its content is deleted when that person is erased or the Institution's data is deleted.
12.2 The Institution may ask for a copy of its data within 30 days after the end. Eduiey will provide it within 30 days of the request, in common formats (such as CSV or JSON, with the uploaded files).
12.3 Eduiey will delete Institution Personal Data within 60 days after the end, and backup copies within 90 days, except: consent records, kept as proof of consent; the audit trail, kept for one year after the end and then deleted; and anything the law requires Eduiey to keep. Eduiey's team does this by hand and will confirm it in writing on request. Records the Institution must keep by law are its responsibility, and it should take its copy.
13. Information and audits
Once a year on request, or after a breach or when an authority requires it, Eduiey will give the Institution the information reasonably needed to show compliance with this DPA, including a written description of its measures and answers to a reasonable security questionnaire. Any further audit must be agreed in advance, at the Institution's cost, without access to other institutions' data and under confidentiality.
14. Eduiey's own data
Eduiey is a Data Fiduciary in its own right for: consent records, kept as proof; the platform's activity log; counts of AI questions (kept 35 days) and of AI use by institution and role, which never name anyone or include what was asked; feedback sent to Eduiey; and its contacts at the Institution. Eduiey will not use these to contact or profile the Institution's students or their families.
15. Liability, term, changes and transfer
15.1 Liability under this DPA is subject to the limits in the Terms, which apply to the Terms and this DPA together.
15.2 This DPA lasts as long as the Terms and then for as long as Eduiey holds Institution Personal Data. Sections 7, 11, 12 and 15 survive the end.
15.3 Eduiey may update this DPA for changes in the law or the Service. For a change that materially reduces the Institution's protection, it will give at least 30 days' notice, and the Institution may object as in section 8.4.
15.4 Eduiey may transfer this DPA, and the processing under it, to a company or LLP set up to run Eduiey, which will take on the same obligations. Eduiey will tell the Institution in writing or in the app. If the Institution objects, it may end its use of the Service by telling Eduiey within 30 days of the notice.
16. Precedence, language and law
16.1 On the protection of personal data, this DPA prevails over the Terms.
16.2 This DPA may also be shown in Hindi and Bengali. If a translation and the English version differ, the English version prevails.
16.3 This DPA is governed by the laws of India, and the courts at Gurugram, Haryana have exclusive jurisdiction. Nothing in it limits a Data Principal's right to complain to the Board.
17. Contacts
Eduiey: Anirban De, Grievance Officer, support@eduiey.com, +91-9383169659, Sector 27, Gurugram, Haryana 122002, India. Breach and other notices are sent from support@eduiey.com.
The Institution: the data protection contact it gives under section 5.4.