Data processing agreement for colleges

Draft 2, 11 November 2026. Part of the terms of service.

This agreement is between the college named at the end (“the college”) and devsforfun Studio (OPC) Private Limited, Main Street, Konkadivaran, Parvathipuram, Andhra Pradesh 535501 (“Nat IMS”, “we”). It is part of the terms of service.

Under the Digital Personal Data Protection Act, 2023 (the “Act”), a Data Fiduciary may have a Data Processor handle personal data for it only under a valid contract (section 8(2)), and stays responsible for what the processor does (section 8(1)). This is that contract. “Rules” means the Digital Personal Data Protection Rules, 2025. Words such as personal data, Data Principal and personal data breach mean what the Act says they mean (section 2).

1. Roles

The college decides why and how its students’, parents’ and staff’s personal data is processed. It is the Data Fiduciary. Nat IMS processes that data only to provide Nat IMS to the college. We are the college’s Data Processor.

2. What we process

• Students: name, admission number, gender, date of birth, year, group, section, coaching batches, hostel or day scholar, BIE hall ticket numbers, APAAR ID and PEN if given, Aadhaar number if given (optional), photo if added, enrolment status, attendance, fees, concessions, payments and receipts, marks and report cards. For the college’s registers, fee records, exam records and report cards.
• Parents and guardians: name, relation, mobile number, whether it has WhatsApp, language, consent and opt-in records, message delivery status. For the messages the parent agreed to, and proof of the agreement.
• College staff: name, phone number, designation, subjects, role, login details (password stored hashed), staff attendance. For logins and staff attendance.
• All of the above: audit records of who changed what, when, before and after. For security and accountability.

Aadhaar numbers. The college enters a student’s Aadhaar number only when the parent (or the student, once 18) chooses to give it, and only to match the student’s records with government records. We store the full number encrypted (AES-256-GCM) under a key kept apart from the database, with a keyed hash (HMAC-SHA256) so the same number can’t be entered for two students. Screens show only the last four digits. Only the college’s owner login can see the full number, after giving a reason, and every view is logged. We never put the number on receipts, report cards, messages or exports; exports carry only the last four digits. The college removes a number when the parent or student asks. [NEED: lawyer to confirm how the Aadhaar Act, 2016 and its regulations apply, including any Aadhaar Data Vault requirement]

We don’t process bank or card details.

This agreement lasts as long as the terms of service, and section 9 below continues until deletion is complete.

3. What we do with it, and what we don’t

• We process the college’s personal data only on the college’s instructions: these terms, the settings the college asks for, and its written requests. If we think an instruction breaks the law, we say so before acting on it.
• We don’t use the data for anything else. We don’t sell it, use it for advertising, or build profiles. We don’t track or monitor children’s behaviour, or direct advertising at them (section 9(3)), except as the college’s own registers need.
• Only Nat IMS staff who need access get it, and they are bound to keep it confidential.
• When the college withdraws a processing instruction, or a parent withdraws consent and the college records it, we stop that processing (section 6(6)).

4. Security safeguards

We take the reasonable security safeguards listed in rule 6 of the Rules, and keep them in place:

• Encryption: the database and stored files are encrypted, and all traffic uses HTTPS. Aadhaar numbers are encrypted again, separately, in the application, and only the last four digits are shown.
• Access control: each college’s records are kept apart by the database itself (row-level security). Staff logins see only what their role allows. Nat IMS team access goes through a separate console, and every time a team member acts as a college user it is recorded.
• Visibility: every change to a record is logged with who, when, before and after. System logs are kept in Mumbai.
• Continuity: automated database backups are kept for 30 days.
• Log retention: logs, and the personal data the Rules require, are kept for one year and then deleted (rules 6(1)(e) and 8(3)).
• Hosting: everything is stored on Amazon Web Services in Mumbai (ap-south-1).

5. Where the data is

All of the college’s data is stored in India, as above, with one exception. WhatsApp messages to parents pass through Meta’s WhatsApp Business Platform (Cloud API). Meta processes them in its own data centres, which may be outside India, and keeps message content for up to 30 days to run the service.

[NEED: decide whether to turn on Meta’s Cloud API local storage for India. Meta’s documentation says it keeps message data at rest in India, but message content may still be processed in other countries for up to 60 minutes.]

We won’t move the college’s data out of India in any other way without telling the college [NEED: number of days] in advance. Any transfer follows section 16 of the Act and rule 15 of the Rules.

6. Sub-processors

The college agrees that we use:

Before adding or replacing a sub-processor we tell the college at least [NEED: number of days] in advance. If the college objects on reasonable grounds and we can’t resolve it, the college may end the agreement. We stay responsible to the college for our sub-processors’ work.

7. Personal data breaches

• We tell the college without delay, and within 24 hours of becoming aware of a personal data breach affecting its data. We say what happened and when, which data and which people, the likely consequences, what we have done, and who to contact. We send updates as we learn more.
• The college gives notice to the Data Protection Board of India and to each affected Data Principal (section 8(6) and rule 7). We help it: we give it the facts and the list of affected people, and draft the notices in Telugu and English. We give it what it needs for the Board’s report within 72 hours.
• We report cyber incidents to CERT-In within 6 hours, as the CERT-In Directions of 28 April 2022 require of us.

8. Requests from parents, students and staff

If a parent, student or staff member asks us directly about their data, we pass the request to the college within [NEED: number of days] and don’t answer it ourselves unless the college asks us to.

We help the college answer requests under sections 11 to 14 of the Act, within the 90 days that rule 14(3) allows. We give it the data, correct or erase records on its instruction, and confirm when it is done.

9. When the agreement ends

When the agreement ends, or earlier if the college asks:

1. we give the college a full copy of its data, as spreadsheet files (CSV) in a zip, one file per kind of record;
2. we then delete the college’s data within [NEED: number of days], except the logs and data the law requires us to keep (rules 6(1)(e) and 8(3)), which we delete when that period ends;
3. backups that hold the data expire within the 30 days they are kept;
4. we confirm the deletion to the college in writing.

[NEED: lawyer to confirm how the one-year retention in rule 8(3) applies when a college leaves]

10. Information and audits

We give the college the information it reasonably needs to show that this agreement is followed, and answer its written questions within [NEED: number of days]. [NEED: whether the college may audit Nat IMS, how often, and with what notice]

11. When the Act’s duties apply

Most duties of the Act and the Rules referred to here start on 13 May 2027: most of sections 3 to 17 of the Act, under notification G.S.R. 843(E) of 13 November 2025, and rules 3 and 5 to 16 of the Rules, under rule 1(4). Both parties agree to follow this agreement from the day it is signed. [NEED: check egazette.gov.in for any change to the start date]

12. Liability

Liability under this agreement follows the terms of service.

13. Signatures