Data Processing Addendum

1. Scope, parties and version

1.1 This Data Processing Addendum (DPA), version v2026-10-16, is between the Customer (the school, trust, society or other institution that uses Acadvio) and Boffin Coders Private Limited (we). It forms part of our Terms of Service and applies whenever we process personal data in Acadvio for the Customer.

1.2 The DPA that an organisation administrator accepts in Acadvio, with the signatory’s name and designation, is this document. If we publish a new version, clause 16 applies.

1.3 Terms such as Data Fiduciary, Data Processor, Data Principal, personal data breach and processing have the meaning given in the Digital Personal Data Protection Act, 2023 (the DPDP Act).

2. Roles

2.1 The Customer is the Data Fiduciary for the personal data in Acadvio. We are its Data Processor.

2.2 The Customer is responsible for having a lawful basis for the processing, including the verifiable consent of a parent or lawful guardian for children’s data where the law requires it, and for its notices to Data Principals.

2.3 For data about visitors to our website and people who ask us for a demo, we are the Data Fiduciary; our Privacy Policy covers that.

3. Details of the processing

4. Processing only on instructions

4.1 We process the personal data only on the Customer’s documented instructions: the Terms, this DPA, the Customer’s settings and use of Acadvio, and other written instructions we agree. We do not process it for our own purposes.

4.2 We tell the Customer if we believe an instruction breaks the law, and may refuse to follow it.

4.3 We never sell the personal data, use it for advertising, or combine it with data from other sources to profile anyone.

5. Confidentiality

5.1 Our staff and contractors who can access the personal data are bound by confidentiality obligations and have access only as far as their work needs.

6. Security measures

6.1 We maintain reasonable security safeguards to prevent personal data breaches, including the measures in the Annex to this clause, and we review them regularly.

Annex: measures in place

• Each school’s records are kept in a separate database.
• Connections to the service are encrypted (HTTPS, with HSTS). Passwords are stored only as salted hashes (bcrypt), and repeated failed sign-ins are rate-limited and temporarily locked.
• ID numbers in documents (such as Aadhaar) are encrypted (AES-256-GCM) and shown masked, with only the last four digits visible.
• Role-based access: each user sees only what their role and school allow; parents never see staff contact details.
• Uploaded documents and photos are kept in private storage and opened through signed links that expire after 5 minutes (documents) or 30 minutes (media). Files uploaded before October 2026 are being moved to private storage.
• Parents’ phone numbers and emails are masked for teachers, and every reveal is logged.
• An access log records sensitive actions (exports, bulk prints, document opens, ID-number views, profile views, long lists and contact reveals) as counts, without copying the data, and is kept for one year. Unusual patterns raise a privacy flag for the Customer to review.
• An append-only history of changes to records; issued fee receipts cannot be changed or deleted (a correction is a cancellation and a new receipt).
• Protection against cross-site request forgery on every change, and session tokens kept in secure, HTTP-only cookies.
• Nightly backups of every database and of uploaded files, encrypted with AES-256-GCM before they leave the server, kept off the server in separate private storage, and rotated so each copy is removed within about five weeks.

7. Sub-processors

7.1 The Customer authorises the sub-processors listed on our Sub-processors page, which forms part of this DPA.

7.2 We will give the Customer at least 30 days’ notice, by email to its administrators and on that page, before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If we cannot address the objection, the Customer may end the affected part of the service and receive a pro-rata refund of prepaid fees for it.

7.3 We bind each sub-processor by written terms that protect the data at least as well as this DPA, and we remain responsible to the Customer for their work.

8. Helping with Data Principals’ rights

8.1 Acadvio gives the Customer tools to answer requests from Data Principals: viewing and correcting records, exporting data, recording and withdrawing parental consent, and erasing records. Parents can delete their own parent accounts.

8.2 If we receive a request directly, we pass it to the Customer without undue delay and do not answer it ourselves unless the Customer asks us to. We help the Customer with any request it cannot answer with the tools.

9. Personal data breaches

9.1 We will notify the Customer of a personal data breach affecting its data without undue delay and in any case within 24 hours of becoming aware of it, by email to its administrators and by phone where we can.

9.2 Our notice will describe, as far as we then know, the nature, extent, timing and location of the breach, the data and Data Principals affected, its likely consequences, and what we have done and will do. We will send updates as we learn more.

9.3 We will help the Customer meet its own duties to inform the Data Protection Board of India and the affected Data Principals, including the Board’s detailed report within 72 hours. Where the CERT-In Directions require it, we report the incident to CERT-In within 6 hours of noticing it.

9.4 Notifying a breach is not an admission of fault.

10. Children’s data

10.1 We do not track, monitor the behaviour of, or profile children, and we do not direct advertising at them. Children’s data is processed only for the Customer’s educational and safety purposes.

10.2 Obtaining verifiable parental consent, or relying on an exemption that applies to educational institutions, is the Customer’s responsibility. Acadvio lets a parent give, decline and withdraw consent themselves, and records who decided, when, how and on which version of the notice.

11. Data location and transfers

11.1 Data is stored in India: the database in Mumbai, and hosting and files at DigitalOcean in Bengaluru. Backups are kept with DigitalOcean in Bengaluru. We will not transfer it outside India except as permitted under section 16 of the DPDP Act, and never to a country or territory the Government of India has restricted.

12. Audits and information

12.1 On request, we give the Customer the information it reasonably needs to show compliance with this DPA, such as a description of our security measures and answers to a security questionnaire.

12.2 Once a year, on at least 30 days’ written notice, the Customer (or an independent auditor bound by confidentiality) may audit our compliance with this DPA during business hours, in a way that does not disrupt the service or expose other customers’ data. Each party bears its own costs. An extra audit is allowed after a personal data breach affecting the Customer.

13. Retention during the subscription

13.1 During the subscription, we keep the personal data for as long as the Customer keeps it in Acadvio, following the Customer’s settings (for example, important emails are kept for eight years by default). Fee and financial records are kept for eight years unless the Customer chooses otherwise. Access logs are kept for one year. Help & requests (grievances, data requests and reports) are deleted three years after they are closed, resolved or declined, together with their messages and attachments.

14. Return and deletion at the end

14.1 When the agreement ends, we provide on request an export of the Customer's school records in a machine-readable format. In line with our rule that no bulk file contains private personal details, the export leaves out contact details, identity numbers, dates of birth, addresses, health, bank or payment details, and stored documents and photos; until the exit date, the Customer can view these one record at a time in the service. We delete the personal data within 90 days after the Customer confirms it has received the export (or within 90 days after the agreement ends, if no export is asked for), unless the law requires us to keep it. Encrypted backup copies are removed by our normal backup cycle, within about five weeks. On request, we confirm deletion in writing.

15. Liability

15.1 Each party’s liability under this DPA is subject to the limits in the Terms of Service.

16. Changes and precedence

16.1 We may update this DPA to reflect changes in the law or the service, with at least 30 days’ notice to the Customer’s administrators. A change that reduces the protection of personal data needs the Customer’s acceptance.

16.2 For personal data, this DPA prevails over the Terms of Service if they conflict.

17. Contact

Data protection questions and breach contacts: info@boffincoders.com (grievance officer: Manoj Sethi).