Data Processing Agreement.

1. Parties

This Data Processing Agreement ('DPA') forms part of the agreement between ARZAQ INSIGHTS ('Processor') and the educational institution using Arzavo ('Controller').

2. Purpose

The Processor processes personal data only to provide, maintain, secure and support the Arzavo platform.

3. Scope of Processing

Processing may include collection, storage, organization, retrieval, transmission, backup, deletion and other operations necessary to provide the Services.

4. Categories of Data

Data processed under this agreement includes details relating to:

• Institution administrators
• Teachers and staff
• Students
• Parents/guardians
• Admissions and enquiry records
• Attendance, examinations and academic records
• Billing and payment information

5. Controller Responsibilities

The institution (Controller) is responsible for determining the purposes and lawful basis for processing personal data, obtaining required consents where applicable, and ensuring the accuracy of submitted information.

6. Processor Responsibilities

ARZAQ INSIGHTS (Processor) will process personal data only on documented instructions from the Controller except where required by applicable law. Appropriate technical and organizational measures will be implemented to protect personal data.

7. Security Measures

Data is hosted on AWS infrastructure in the Mumbai region. Tenant databases are logically isolated. Access controls, logging and other reasonable security measures are used to protect customer information.

8. Subprocessors

The Processor may use trusted third-party providers (such as cloud infrastructure, payment processors, communication providers and analytics providers) to deliver the Services. These providers are required to protect personal data appropriately.

9. Data Subject Requests

Where technically feasible, ARZAQ INSIGHTS will reasonably assist the Controller in responding to lawful requests relating to access, correction or deletion of personal data.

10. Data Retention & Deletion

Data retention and deletion are governed by the Arzavo Data Retention & Deletion Policy. Upon tenant deletion, operational data may be removed while legally required financial and compliance records may be retained.

11. Incident Notification

Where appropriate and required by applicable law, the Processor will notify the Controller of confirmed personal data security incidents without unreasonable delay.

12. International Transfers

Arzavo currently operates in India. If international data transfers become necessary, appropriate safeguards will be implemented where required by applicable law.

13. Governing Law

This DPA is governed by the laws of India and should be interpreted together with the Terms of Service and Privacy Policy.