Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Quala Labs and the School. It applies whenever Quala Labs processes personal data on the School's behalf in providing the Service ("School Personal Data").

For School Personal Data, the School is the Data Fiduciary and Quala Labs is the Data Processor, as those terms are used in the Digital Personal Data Protection Act, 2023. The School accepts this DPA in the principal console, and each accepted version is recorded with the signatory's name and the date.

2. Processing only on instructions

Quala Labs processes School Personal Data only to provide, secure and support the Service and only on the School's documented instructions, which are these Terms, this DPA and the School's use of the Service's settings. We do not use School Personal Data for our own purposes, do not sell it and do not use it for advertising.

3. Details of the processing

Data Principals	Students, teachers, principals and other staff of the School
Categories of data	Account data, learning records, live class participation, examination conduct data, supervised assignment recordings without audio, AI hint history and technical data, as described in our Privacy Policy
Purpose	Teaching, learning, assessment and academic integrity, at the School's direction
Duration	The life of the School's account, followed by deletion under section 10

4. The School's responsibilities

• To have a lawful basis for the personal data it puts into the Service, including any consent required from a parent or guardian for a child's data, and to give students and staff a privacy notice.
• To decide which features to use, such as supervised assignments with camera recording, and to tell students and parents about them.
• To manage its Authorised Users and keep their access appropriate.

5. Confidentiality

Everyone at Quala Labs who can access School Personal Data is bound by confidentiality and accesses it only when necessary to provide or support the Service.

6. Security

Quala Labs maintains reasonable security safeguards to prevent personal data breaches, as described on our Security page. These include separation of each school's data, encryption in transit, securely hashed passwords, role-based access, isolated environments for running code and an append-only audit record of administrative actions.

7. Sub-processors

The School authorises Quala Labs to use the following sub-processors. Each is bound by obligations that protect School Personal Data. We will give the School at least thirty days' notice before adding or replacing a sub-processor, during which the School may object.

Sub-processor	Purpose	Used for
Our cloud hosting provider	Infrastructure hosting	All schools
Brevo	Delivery of service emails	All schools
Groq	AI processing	Only schools whose plan includes AI features

8. Personal data breaches

If Quala Labs becomes aware of a personal data breach affecting School Personal Data, we will notify the School without undue delay, describe what happened, the data affected, the likely consequences and the steps we are taking, and help the School meet its own obligations to inform affected Data Principals and the Data Protection Board of India.

9. Helping the School respond to requests

Quala Labs will help the School respond to requests from students, staff and parents to access, correct or erase their data. If we receive such a request directly, we will pass it to the School and not respond on the School's behalf unless it asks us to.

10. Retention, export and deletion

• Examination conduct data and live class activity logs are kept for 90 days by default. The School may set any period from 30 to 365 days and may shorten it at any time.
• Supervised assignment recordings are deleted once the teacher has marked the batch, and never kept for more than 30 days.
• The School may export its data from the console, and may ask us to delete it, at any time.
• When the School's account closes, the School may export its data for thirty days. We then delete School Personal Data within a further sixty days, except where the law requires us to keep it.

11. Information and audit

Quala Labs will make available to the School the information reasonably necessary to show that it meets this DPA, and will respond to reasonable written questions about its security and processing. Each school's administrative actions are recorded in an audit ledger the School can review.

12. Precedence

If this DPA conflicts with the Terms of Service on a matter of data protection, this DPA prevails.