Data Processing Addendum

1. Scope & Application

This Data Processing Addendum (“DPA”) supplements the Gendemy Terms of Service and applies to the processing of Customer Personal Data by Gendemy on behalf of the subscribing institute, academy, or educational organization (the “Customer”).

This DPA ensures compliance with applicable data protection legislation, including the Digital Personal Data Protection Act (DPDP Act 2023) and international standards.

2. Controller & Processor Obligations

• Customer as Data Controller: The Customer controls and determines the legal basis, categories of students, teachers, and staff enrolled, and instructions for processing academic data.
• Gendemy as Data Processor: Gendemy shall process Customer Data exclusively in accordance with Customer's documented instructions and for the provision and maintenance of the SaaS platform.
• Confidentiality: All Gendemy personnel with access to Customer Data are bound by binding confidentiality obligations.

3. Technical & Organizational Safeguards

Gendemy maintains rigorous technical and organizational security measures to protect Customer Data against accidental loss, unauthorized destruction, alteration, or disclosure:

• Data Encryption: All data in transit is encrypted using TLS 1.3 / HTTPS. All database disks and automated backups are encrypted at rest using AES-256.
• Role-Based Access Control (RBAC): Administrative permissions are segmented per user and branch, preventing privilege escalation.
• Tenant Isolation: Logical database segregation guarantees complete isolation of each Customer's data.
• Continuous Monitoring & DDoS Protection: Edge firewalls and threat mitigation managed via Cloudflare enterprise-grade infrastructure.

4. Authorized Sub-processors

Customer grants general written authorization to Gendemy to engage the following third-party sub-processors:

5. Data Subject Requests Assistance

Taking into account the nature of the processing, Gendemy provides built-in self-service tools (such as CSV/PDF export, profile editing, and deletion requests) to enable Customer to fulfill requests from students, faculty, or guardians exercising their rights under data protection laws.

6. Security Incident & Breach Notification

Gendemy shall notify Customer without undue delay (and in any event within 72 hours) upon becoming aware of a verified Personal Data Breach affecting Customer Data. The notification will include a description of the breach, affected records, and remedial actions taken.

7. Audits & Compliance Verification

Upon reasonable written notice from Customer, Gendemy shall make available documentation necessary to demonstrate compliance with this DPA, including security policies, SOC/ISO compliance attestations, or independent vulnerability assessment summaries.

8. Deletion & Return of Customer Data

Upon termination of Customer's subscription, Customer may export complete institute records through the export tools. Within thirty (30) days following account closure, Gendemy will permanently delete all Customer Data from active production databases, retaining only statutory billing records required under applicable Indian tax laws.