Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between ZEVIQ SOFTWARES PRIVATE LIMITED ("Data Processor") and the educational institution or organisation subscribing to the Scholva platform ("Data Controller"). It sets out the terms on which Scholva processes personal data on behalf of the Data Controller.

For the purposes of this DPA:

• "Applicable Data Protection Law" means the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000 and the rules made thereunder (including the SPDI Rules, 2011), the EU GDPR (Regulation 2016/679) where applicable, and any other applicable data protection legislation.
• "Personal Data" has the meaning given in Applicable Data Protection Law.
• "Processing" has the meaning given in Applicable Data Protection Law.
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates, including students, parents, and staff members.

This DPA applies to all Personal Data processed by Scholva in the course of providing services under the main Terms of Service.

The Data Controller determines the purposes and means of processing. The Data Processor shall process Personal Data only on the documented instructions of the Data Controller, unless required to do so by applicable law.

Categories of data subjects: Students, parents/guardians, teachers, administrative staff.

Categories of personal data: Identity data (names, dates of birth), contact details, educational records (attendance, grades, assessments), health data (where provided by the school for safeguarding or accessibility purposes), financial data (fee records), and behavioural data.

Special categories of data: Health and medical information may be processed where necessary for safeguarding or statutory obligations. The Data Controller is responsible for ensuring a lawful basis exists for such processing.

Processing activities: Storage, retrieval, organisation, structuring, transmission to authorised users within the institution, generation of reports, and deletion upon instruction.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, Scholva implements the following technical and organisational measures:

• Encryption: All Personal Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Database backups are encrypted before offsite storage.
• Access Control: Role-based access control (RBAC) ensures that individuals can only access data necessary for their role. Privileged access to production systems requires multi-factor authentication.
• Audit Logging: All access to and modification of Personal Data is logged with timestamps and user identifiers. Logs are retained for 12 months.
• Incident Response: We maintain a documented incident response plan and conduct regular drills. All staff with access to Personal Data receive annual data protection training.
• Availability: Our infrastructure is deployed across multiple availability zones. We maintain a 99.9% uptime SLA and daily encrypted backups with a 30-day retention period.
• Vendor Assessment: All sub-processors are assessed for security compliance before engagement and are reviewed annually.

The Data Controller provides general authorisation for Scholva to engage sub-processors. Scholva shall inform the Data Controller of any intended changes to sub-processors with at least 14 days' notice, providing the Data Controller the opportunity to object.

Current sub-processors engaged by Scholva include:

• Cloud infrastructure providers: Secure data-centre hosting of the platform and its databases.
• Razorpay Software Private Limited: Payment processing (subject to Razorpay's own data protection terms and PCI DSS compliance).
• ZeptoMail (Zoho Corporation): Transactional email delivery.
• Firebase (Google LLC): Mobile push notifications (device tokens only; no student data transmitted).
• Offsite backup providers: Encrypted offsite backup storage.

Scholva imposes data protection obligations on all sub-processors that are no less onerous than those in this DPA. Scholva remains liable for the acts and omissions of its sub-processors to the same extent as if performing the services directly.

Where Scholva receives a request from a data subject to exercise their rights (access, rectification, erasure, restriction, portability, or objection), Scholva shall promptly forward the request to the Data Controller and provide reasonable technical assistance to enable the Data Controller to fulfil its obligations.

The Data Controller is solely responsible for determining the appropriate response to data subject requests. Scholva will not respond directly to data subjects regarding Personal Data processed on behalf of the Data Controller without the Data Controller's prior authorisation, except where required by law.

Scholva provides self-service tools in the platform to allow the Data Controller to export, correct, or delete Personal Data. For requests not supported by self-service tools, Scholva will provide assistance within commercially reasonable timescales.

In the event of a Personal Data breach affecting data processed on behalf of the Data Controller, Scholva shall:

• Notify the Data Controller without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
• Provide, where known, information including: the nature of the breach, categories and approximate number of data subjects affected, categories and approximate number of records affected, likely consequences of the breach, and measures taken or proposed to address the breach.
• Cooperate with the Data Controller in any investigation, notification to supervisory authorities, and communication to affected data subjects.

The Data Controller retains responsibility for any notifications to supervisory authorities or data subjects as required by Applicable Data Protection Law.

Upon termination or expiry of the main Services Agreement, or upon written request from the Data Controller, Scholva shall:

• Make all Personal Data available for export by the Data Controller in a standard machine-readable format (CSV or JSON) for a period of 30 days following termination.
• After the export period, securely delete all Personal Data from live systems and ensure deletion from backup systems within 90 days.
• Upon request, provide written confirmation that deletion has been completed.

Scholva may retain Personal Data beyond these periods only where required to do so by applicable law, and only to the minimum extent necessary to satisfy that legal obligation. Any such retained data will not be used for any other purpose.

Questions about this DPA or data processing activities should be directed to:

• Data Protection Officer: dpo@scholva.com
• General Privacy Enquiries: privacy@scholva.com
• Company: ZEVIQ SOFTWARES PRIVATE LIMITED

For grievances under the Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer at privacy@scholva.com.