Data Processing Agreement.

This Data Processing Agreement ("DPA") is entered into by and between Klasso Technologies Private Limited (incorporation pending) ("Klasso" or "Data Processor") and the educational institution executing the master service agreement ("School" or "Data Fiduciary"). This DPA governs the processing of personal data related to students, parents, and school staff as part of providing the Klasso school ERP system.

This agreement is structured to fulfill the requirements of Section 8 of India's Digital Personal Data Protection (DPDP) Act 2023.

Section 01

Roles and Responsibilities

Under the DPDP Act 2023, the School acts as the Data Fiduciary, determining the purpose and means of data processing. Klasso acts strictly as a Data Processor on behalf of the School.

• Purpose Limitation: Klasso shall process Personal Data only on documented instructions from the School, including with respect to transfer of data outside India.
• Compliance: The School is responsible for obtaining necessary consent from parents/guardians for processing minors' data before uploading it to the platform.
• Assistance: Klasso will assist the School in fulfilling its obligations under the DPDP Act, including responding to requests from parents/guardians (Data Principals) exercising their rights.

Section 02

Scope and Categories of Data

The categories of Personal Data processed under this DPA include:

• Student Data: Name, class, division, roll number, academic grades, attendance logs, and transport routing data.
• Parent/Guardian Data: Name, mobile number (for OTP authentication & notifications), email address, and fee payment history.
• Teacher/Staff Data: Name, contact details, timetable schedules, attendance, and payroll records.
• Special Categories (Minors): As the platform handles minors' data (students under 18), both parties agree to implement heightened protection standards, ensuring no profiling or targeted tracking of minors occurs.

Section 03

Technical and Organizational Measures

Klasso commits to maintaining robust security postures to prevent unauthorized access, alteration, or leakage of school data:

• Row Level Security (RLS): Cryptographic isolation at the database layer (PostgreSQL) ensuring one school cannot read or write data of another.
• Data Localization: All databases and backups are hosted in the AWS Mumbai (ap-south-1) region, ensuring full compliance with Indian data residency norms.
• Data at Rest: Cryptographic encryption utilizing AES-256 standards.
• Data in Transit: TLS 1.3 enforced for all network connections, APIs, and client-server communication.
• PII Scrubbing: Automatic stripping of personally identifiable information (names, phone numbers) from system logging tools.

Section 04

Sub-Processors

Klasso utilizes selected third-party infrastructure providers to deliver services. The School authorizes the use of the following core sub-processors:

• Supabase Inc. & AWS: Database hosting, user authentication, and storage (Mumbai, India region).
• Railway Corp: Application layer API hosting.
• Razorpay Software Pvt. Ltd.: Payment aggregator for school fee collection (PCI-DSS Level 1 compliant).

Klasso ensures that all sub-processors are bound by contract to data protection terms no less protective than those in this DPA.

Section 05

Breach Notification

In the event of a confirmed data breach affecting school personal data, Klasso will notify the School without undue delay, and no later than 36 hours after becoming aware of the breach. Klasso will provide detailed assessments, containment actions, and support the School in notifying the Data Protection Board of India (DPBI) and affected individuals as required by Section 8(5) of the DPDP Act 2023.

Section 06

Data Deletion and Portability

Upon termination of the service agreement, Klasso shall, at the choice of the School, return or delete all School Personal Data in its possession within 30 days, except where retention is required by Indian law. The School retains full data portability rights, with the ability to export all data in CSV formats via the Admin Portal at any time.