Data Processing Addendum (DPA)
Version v2026.1 • Effective Date: October 2026 • Enforceable between PrinciDesk and Subscribing Educational Institutions.
Statutory Legal Relationship & Data Classification
Data Fiduciary / Data Controller
Determines the purpose, lawful grounds, and means of collecting personal data of students, parents, faculty, and applicants.
Data Processor / Intermediary
Processes institutional data strictly on behalf of and per the documented instructions of the Subscribing School under Section 8(1) of DPDP Act 2023.
1. Scope, Purpose & Duration of Processing
This Data Processing Addendum (“DPA”) supplements the PrinciDesk Terms of Service and Master Subscription Agreement. It governs the processing of Personal Data entered into the PrinciDesk multi-tenant ERP and CMS platform by the Subscribing Educational Institution (“Customer”).
- Subject Matter: Provision of cloud school management, gradebook, attendance, admissions, fees, and communication services.
- Duration: From tenant provisioning until the termination of Customer's subscription and completion of the data deletion cycle.
- Categories of Data Principals: Minor students, parents/legal guardians, school teachers, staff, and admission applicants.
2. Special Safeguards for Processing Minor / Children's Data (DPDP Act 2023 Section 9)
Under Section 9 of the Digital Personal Data Protection Act, 2023:
Customer Representation & Warranty: The Subscribing School represents, warrants, and undertakes that it has established and documented verifiable parental/guardian consent before uploading or processing the personal data of any child (individual below 18 years of age).
Platform Non-Monetization Pledge: PrinciDesk shall never track children's behavioral activity, serve targeted advertisements, or process pupil records in any manner that causes detrimental effect on children.
Indemnity: The School agrees to defend, indemnify, and hold harmless PrinciDesk against any claims, regulatory penalties, or liabilities arising from the School's failure to secure valid statutory parental consent.
3. Technical and Organizational Security Measures (TOMs)
PrinciDesk implements enterprise-grade technical safeguards to prevent unauthorized access, alteration, or disclosure of institutional data:
TLS 1.3 encryption for all HTTP/API requests and AES-256 database-level encryption for stored credentials and files.
Multi-tenant isolation guaranteed via organizational UUID indexing across all queries to prevent cross-institution leakage.
Granular permissions restricting staff access to student profiles, gradebooks, payroll, and statutory reports.
Tamper-evident system audit logging recording timestamp, IP address, user identity, and specific ERP actions.
4. Authorized Sub-Processors
The Customer grants general written authorization to PrinciDesk to engage the following trusted sub-processors for infrastructure and notification delivery:
| Sub-Processor | Service Role | Data Location |
|---|---|---|
| AWS / GCP Cloud | Primary Compute, Relational Database & Secure Object Storage | India Region (Mumbai / Delhi) |
| Razorpay / Stripe | Payment Gateway Tokenization (PCI-DSS Level 1) | PCI-DSS Compliant Vaults (India) |
| MSG91 / Twilio | Transactional SMS & DLT WhatsApp Attendance Notifications | India / Global |
5. Incident & Breach Notification
In the event of a confirmed personal data breach affecting Customer's records, PrinciDesk will notify Customer without undue delay and within 72 hours of confirmation. The notice will describe the nature of the breach, affected records, and remedial mitigation measures taken.
6. Data Deletion and Return
Upon termination or expiry of the SaaS subscription:
- Customer has a 30-day grace period to download all institutional data (CSV, JSON, PDF gradebooks).
- Following the grace period, PrinciDesk will securely delete or irreversibly anonymize all Customer data from active databases and cloud storage within 60 days, except where retention is strictly required by statutory tax or accounting laws.
7. Compliance Sign-Off & Grievance Redressal
For DPA counter-signing, compliance requests, or Grievance Officer inquiries, contact:
PrinciDesk Compliance & Legal Desk
Grievance & DPO Email: grievance@princidesk.in
Corporate Legal Entity: PrinciDesk Technologies Private Limited