Data Processing Agreement

This DPA applies for as long as GyanMul processes personal data on behalf of the Controller under the school's subscription to the Service, and continues to apply to any residual processing (e.g. backups pending deletion) until that data is deleted per Section 8.

GyanMul processes personal data solely to provide the school management functionality the Controller has configured and enabled: student information management, attendance, academics, fees, HR/payroll, communication, and related features, including Gurubaa where enabled.

• Students enrolled at the school
• Teachers and other staff members
• Parents and guardians
• School administrators

As described in full in our Privacy Policy, including identity, contact, academic, attendance, financial, and communication data, and any photos or documents uploaded through the Service.

• The Controller (school) determines what personal data is entered into GyanMul and is responsible for having a lawful basis and, where required, consent to process it.
• The Controller is responsible for the accuracy of data entered and for managing user access at the school (e.g. offboarding staff who leave).
• The Controller is responsible for responding to data subject requests it receives directly, with GyanMul's reasonable assistance as described in Section 7.

• GyanMul will process personal data only on the Controller's documented instructions, as implemented through the Service's configuration and features.
• GyanMul will ensure personnel authorized to process personal data are bound by confidentiality obligations.
• GyanMul will implement appropriate technical and organizational security measures, as described in Section 9 of our Privacy Policy (encryption in transit and at rest, role-based access control, least-privilege administration).
• GyanMul will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.

GyanMul will provide reasonable technical assistance to help the Controller respond to data subject requests (access, correction, deletion, portability) relating to data processed through the Service, consistent with the platform's own export and deletion tools.

GyanMul uses the following categories of sub-processors to provide the Service:

• Database and authentication infrastructure (Supabase) — stores structured records and manages account authentication.
• Cloud storage (Amazon Web Services / S3) — stores uploaded files, documents, and generated PDFs.
• Hosting and deployment infrastructure (Vercel) — serves the web platform and API.
• Email delivery, for transactional notifications and communications sent through the platform.

GyanMul remains responsible for its sub-processors' compliance with data protection obligations equivalent to those in this DPA, and will provide reasonable notice of any change in sub-processors that materially affects the processing of a school's data.

Where personal data is processed by infrastructure located outside Nepal, GyanMul relies on its sub-processors' own security and compliance safeguards, and will take reasonable steps to ensure data continues to receive an equivalent level of protection.

Upon termination of the Service, GyanMul will make the Controller's data available for export for a reasonable period, and will delete or anonymize remaining personal data in accordance with our Account Deletion Policy, except where retention is required by law.

GyanMul will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and confidentiality terms.

For DPA-related requests, including signed copies for procurement purposes, contact info@gyanmul.com.