Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between the institute ("Fiduciary") and manchi.tech ("Processor") for the platform services. Terms not defined here have the meanings in India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Scope

Processor will process Personal Data only on the documented instructions of Fiduciary, for the sole purpose of providing the platform modules enabled on the order form.

2. Categories of data & data principals

Categories: identity, contact, academic, attendance, financial, biometric templates (where enabled), and technical logs. Data principals: students, parents/guardians, faculty, and admin staff of the Fiduciary.

3. Security measures

Processor implements the technical and organizational measures described on /security, including AES-256 at rest, TLS 1.3 in transit, RBAC, audit logging, encrypted backups, and staff background checks.

4. Sub-processors

Fiduciary authorizes Processor to engage the sub-processors listed at privacy@manchi.tech on request. Processor gives 30 days' notice before adding a new sub-processor; Fiduciary may object on reasonable data-protection grounds.

5. Data-principal rights

Processor will assist Fiduciary in responding to data-principal requests (access, correction, erasure, grievance) within the timelines set by the DPDP Act.

6. Incident notification

Processor will notify Fiduciary without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting Fiduciary's data, along with the information required for Fiduciary's reporting obligations.

7. Return & deletion

On termination, Processor will make Fiduciary's data available for export for 30 days and then delete it within the timelines in Processor's retention schedule, except where retention is required by law.

8. Audits

On written request, Processor will provide the most recent independent security assessment and reasonable written responses to Fiduciary's security questionnaires. On-site audits are available for enterprise customers under NDA and reasonable notice.

A signed counter-part of this DPA is available on request at legal@manchi.tech.