Data Processing Agreement

This DPA applies for as long as GyanMul processes personal data on behalf of the Controller under the school's subscription to the Service, and continues to apply to any residual processing (e.g. backups pending deletion) until that data is deleted per Section 8.

GyanMul processes personal data solely to provide the school management functionality the Controller has configured and enabled: student information management, attendance, academics, fees, HR/payroll, communication, and related features, including Gurubaa where enabled.

• Students enrolled at the school
• Teachers and other staff members
• Parents and guardians
• School administrators

As described in full in our Privacy Policy, including identity, contact, academic, attendance, financial, and communication data, and any photos or documents uploaded through the Service.

• The Controller (school) determines what personal data is entered into GyanMul and is responsible for having a lawful basis and, where required, consent to process it.
• The Controller is responsible for the accuracy of data entered and for managing user access at the school (e.g. offboarding staff who leave).
• The Controller is responsible for responding to data subject requests it receives directly, with GyanMul's reasonable assistance as described in Section 7.

• GyanMul will process personal data only on the Controller's documented instructions, as implemented through the Service's configuration and features.
• GyanMul will ensure personnel authorized to process personal data are bound by confidentiality obligations.
• GyanMul will implement appropriate technical and organizational security measures, as described in Section 9 of our Privacy Policy (encryption in transit and at rest, role-based access control, least-privilege administration).
• GyanMul will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.

GyanMul will provide reasonable technical assistance to help the Controller respond to data subject requests (access, correction, deletion, portability) relating to data processed through the Service, consistent with the platform's own export and deletion tools.

GyanMul uses the following categories of sub-processors to provide the Service:

• Supabase — database and account authentication; stores structured records.
• Amazon Web Services — file storage (Amazon S3) for uploaded files, documents and generated PDFs, and email delivery (Amazon SES) for notifications and messages sent through the platform.
• Google — application hosting (Google Cloud), push notifications (Firebase Cloud Messaging), maps, routes and arrival-time estimates for bus tracking (Google Maps Platform), and Google sign-in where a user chooses it.
• OpenAI — AI models behind Gurubaa: the text and any photo a user sends is processed to produce the requested response, and is not used to train models.
• Meta — publishing the school's posts to its own Facebook Page and Instagram account, only when the school connects them and approves a post.
• eSewa and Khalti — payment gateways for fee payments and Wallet top-ups, using the school's own merchant account; GyanMul receives the payment reference and status only.
• Vercel — custom domains for school websites.

Separately, a school's staff or students may choose to connect their own GyanMul account to an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic). Such a connection is made by the individual user, within their own permissions, and the assistant's provider processes the information under its own terms. A school may ask us to disable these connections for its accounts.

GyanMul remains responsible for its sub-processors' compliance with data protection obligations equivalent to those in this DPA, and will provide reasonable notice of any change in sub-processors that materially affects the processing of a school's data.

Where personal data is processed by infrastructure located outside Nepal, GyanMul relies on its sub-processors' own security and compliance safeguards, and will take reasonable steps to ensure data continues to receive an equivalent level of protection.

Upon termination of the Service, GyanMul will make the Controller's data available for export for a reasonable period, and will delete or anonymize remaining personal data in accordance with our Account Deletion Policy, except where retention is required by law.

GyanMul will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and confidentiality terms.

For DPA-related requests, including signed copies for procurement purposes, contact info@gyanmul.com.