Institute Data Processing Terms

1. Parties and Roles

These terms apply when an institute, coaching center, school, teacher, or organization uses ExamStack SaaS. For institute workspace records, the institute generally acts as the Data Fiduciary or controller-equivalent, and ExamStack acts as a Data Processor or service provider processing data on the institute's instructions. ExamStack remains an independent Data Fiduciary for its own account, billing, security, legal, analytics, and service-administration data.

2. Covered Data

• Institute profile, address, public listing, plan, billing, owner, admin, teacher, and staff account data.
• Student records, parent or guardian contact details, batches, attendance records, QR/device signals, assignments, exam attempts, scores, answers, reports, and learning analytics.
• Question banks, uploaded files, PDFs, images, OCR text, AI prompts, generated study content, review notes, public profile content, and support attachments.
• Audit logs, role changes, session data, notification delivery records, payment events, backup metadata, security events, and abuse signals.

3. Processing Purposes

• Provision, maintenance, security, support, analytics, backup, and improvement of the ExamStack SaaS workspace.
• Attendance, exams, question banks, assignments, reports, parent communications, public institute discovery, and institute operations.
• AI, OCR, file processing, notification delivery, payment administration, abuse prevention, legal compliance, and dispute handling where enabled or required.

4. Institute Responsibilities

• Provide required notices and obtain valid consent or other lawful authority from students, parents, guardians, teachers, and staff before adding or processing their data.
• Maintain accurate records, assign appropriate roles, remove former staff access, review public profile settings, and avoid uploading unnecessary or sensitive personal data.
• Respond to student, parent, guardian, teacher, and staff requests relating to institute-controlled records, including access, correction, deletion, and objection requests where applicable.
• Use AI/OCR and communication features only for lawful educational, administrative, safety, support, or institute-operation purposes.

5. ExamStack Processor Commitments

• Process institute workspace data only to provide ExamStack, follow documented product instructions, comply with law, protect the platform, or provide support requested by the institute.
• Apply role-based access, tenant checks, audit logs, reasonable security safeguards, backup controls, provider controls, and confidentiality obligations for personnel with access.
• Assist the institute, within reasonable product and operational limits, with export, deletion, security, incident, and data-rights requests relating to workspace records.
• Notify the institute or affected users of a personal-data breach where required by applicable law and available contact details.

6. Sub-Processors

ExamStack may use sub-processors for hosting, databases, storage, CDN, backup, email, WhatsApp/SMS, web push, payment processing, analytics, logging, support, AI, OCR, and security. ExamStack remains responsible for requiring sub-processors to protect data through appropriate contractual, technical, and organizational safeguards.

7. AI and OCR Processing

If an institute enables AI or OCR workflows, uploaded papers, images, PDFs, prompts, extracted text, and generated outputs may be processed by configured AI/OCR providers. Institutes should review AI outputs before using them for teaching, exams, grading, publication, or student decisions.

8. Retention, Return, and Deletion

During an active subscription, institute workspace records are retained to provide the service. After termination, suspension, or deletion request, ExamStack may provide a reasonable export window where technically available and then delete or anonymize workspace records according to product retention schedules, backup cycles, legal requirements, payment records, audit requirements, and dispute preservation needs.

9. International Transfers

Sub-processors may process data in India or other jurisdictions. ExamStack will use contractual and security safeguards and will follow India-specific transfer restrictions that are notified under applicable law.

10. Audits and Information

ExamStack may provide reasonable security, compliance, and processing information through documentation, support responses, product settings, audit logs, and contractual exhibits. On-site audits require a separate written agreement and may be subject to confidentiality, security, cost, and scheduling controls.

11. Order of Precedence

If a signed institute agreement, order form, or enterprise data processing agreement conflicts with these public terms, the signed agreement controls for that institute to the extent of the conflict.

12. Contact

Privacy and processing

Privacy and data rights: [email protected]

Support

Support: [email protected]

Registered office

India