This Data Processing Addendum ("DPA") applies to the personal data that an Institute (the "Institute") enters into or generates in Institute Console, and which DEXDEVS (SMC-PRIVATE) LIMITED ("DEXDEVS") processes for the Institute under its subscription agreement. If this DPA conflicts with the subscription agreement on a data-protection matter, this DPA applies.
Roles
The Institute decides why and how its students', parents', staff and other people's personal data is used, and is the controller of that data. DEXDEVS is the processor and acts only on the Institute's documented instructions, which are the subscription agreement, this DPA and the Institute's use of the product's settings. DEXDEVS is an independent controller only for the limited data it needs for its own account, security and billing records, as described in the Privacy Policy.
What is processed
- Subjects: students, parents and guardians, teachers and other staff, drivers, applicants and other people the Institute records.
- Data: identity and contact details, enrolment, attendance, academic results, fee and payment records, staff and payroll records, transport and location during a driver's shift, photographs and documents the Institute chooses to upload, and technical data needed to run the service.
- Purpose and duration: to provide Institute Console to the Institute for the life of the subscription and the retention periods in this DPA.
Our commitments
- We process the data only on the Institute's instructions, and tell the Institute if we believe an instruction breaks the law.
- Everyone who can access the data at DEXDEVS is bound by confidentiality and given access only as needed.
- We apply appropriate technical and organisational measures, including encryption in transit, access control by role, tamper-evident audit logs, encrypted backups and regular security review (see Security and Responsible Disclosure).
- We use only the sub-processors listed on the Sub-processors page, under written terms that give the same protection. We give the Institute notice of any change and a reasonable opportunity to object.
- We help the Institute respond to requests from people exercising their rights (access, correction, deletion and similar), by providing the tools in the product and reasonable further assistance.
- We tell the Institute without undue delay (we aim for within 72 hours), after becoming aware of a personal data breach affecting its data, with the information we have to help it meet its own duties.
- We help the Institute with data-protection impact assessments and consultations with regulators where relevant to our processing.
- We make available the information needed to show compliance with this DPA and allow reasonable audits, normally by reviewing our documentation and reports, with on-site audits only where required by law, on reasonable notice and subject to confidentiality.
International transfers
Data may be processed outside the Institute's country, including in the United States and the European Union, by DEXDEVS and its sub-processors. Where the law requires safeguards for such a transfer, we rely on appropriate mechanisms such as standard contractual clauses or the provider's equivalent commitments.
Return and deletion
When the subscription ends, the Institute may export its data for a reasonable period. After that we delete or anonymise it, except where the law requires a record to be kept (for example financial records, which are kept de-identified) and in encrypted backups until they are replaced on their normal schedule. Our approach to individual deletion requests is described on the Account and data deletion page.
The Institute's responsibilities
The Institute is responsible for having a lawful basis and any consent required (including parental or guardian consent for children), for telling people how their data is used, for the accuracy of the data it enters, and for managing its own users' access.
Liability
Each party's liability under this DPA is subject to the limits in the subscription agreement, except where the law does not allow a limit.
Contact
Data-protection questions and notices: privacy@instituteconsole.com.