School Data Processing Addendum

1. Scope

This Addendum forms part of the Terms of Service between SheepByte AI Tech ("Processor") and the School ("Data Fiduciary"). It applies to personal data that the Processor processes on the School's behalf through SheepERP.

Where this Addendum and the Terms of Service conflict on the handling of personal data, this Addendum prevails.

2. Subject matter and duration

Subject matter

Provision of school operations software.

Duration

For as long as the School's account is active, plus any agreed retention period.

Categories of Data Principal

Students, their parents and guardians, teaching and non-teaching staff, and the School's administrators.

Categories of personal data

Identity and contact details, academic records, attendance, examination results, fee and financial records, transport assignment, staff employment records, and documents the School uploads.

3. The Processor's obligations

• Process personal data only on the School's documented instructions, which the Terms, this Addendum and the School's own use of the Service constitute.
• Not use the School's personal data for any purpose of its own, including advertising or the training of machine-learning models.
• Bind personnel with access to confidentiality obligations, and grant access only where a role requires it.
• Apply appropriate technical and organisational security measures, including tenant isolation, role-based access control enforced server-side, encryption in transit and at rest, and audit logging.
• Assist the School in responding to requests from Data Principals, and in meeting its own obligations for security, breach notification and impact assessment.
• On termination, return or delete the personal data as the School directs, subject to any retention the law requires.

4. Sub-processors

The School authorises the following sub-processors:

Google Cloud / Firebase

Authentication, database, and file storage. India regions.

Hosting provider

Application hosting and content delivery.

Razorpay

Processing of the School's own subscription payments.

We give notice before adding or replacing a sub-processor, and remain responsible for a sub-processor's acts and omissions as if they were our own.

5. Personal data breach

We will notify the School without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting its data. The notification will describe what is known of the nature of the breach, the categories and approximate volume of records affected, the likely consequences, and the measures taken or proposed.

Notification to the Data Protection Board of India and to affected Data Principals is the School's responsibility as Data Fiduciary; we will provide the information it reasonably needs in order to make it.

6. Data Principal requests

Where a Data Principal approaches us directly about data we hold for a School, we will not respond on the School's behalf. We will refer them to the School and tell the School promptly.

The Service provides the School with the means to access, correct, export and erase the records it holds, so that it can answer such a request itself.

7. Audit

On reasonable written notice, and not more than once a year unless a breach or a regulator requires otherwise, we will make available the information necessary to demonstrate compliance with this Addendum.

8. Deletion and return

On termination the School may export its records through the Service. Unless the School asks otherwise in writing, we delete its personal data within 90 days of the end of the export period, save for data we are required by law to retain and for records of acceptance of legal documents.

9. Contact

Data protection contact: contact@sheepbyte.com.