What does the Acavya Data Processing Agreement say?
The DPA says Acavya processes your institute’s data only on your instructions, tells you of a breach within hours, uses only listed sub-processors, returns or deletes data at the end, lets you audit, and never uses the data for its own purposes.
Last reviewed:
Between the institute (data fiduciary) and Acavya Ventures, the trade name of ACAVYA, a sole proprietorship registered in India (Udyam registration UDYAM-UP-38-0103995) (“Acavya Ventures” or “Acavya”, data processor).
What is the subject and who holds which role?
The institute is the data fiduciary for the personal data of its students, parents, guardians and staff that it stores in Acavya. Acavya is the data processor (DPDP Act section 8(2)). The subject, duration, nature, purpose and data types are those needed to provide the Service for the institute.
What are the processor’s duties?
- Process personal data only on the institute’s documented instructions, which include using the Service as designed.
- Ensure that people who access the data are bound by confidentiality.
- Apply security safeguards: encryption in transit and for sensitive fields, access control, audit logging, monitoring and backups, consistent with DPDP Rule 6.
- Use only the sub-processors on the sub-processor list, and give 30 days’ notice of additions so the institute can object.
- Help the institute respond to access, correction, erasure and grievance requests, including single-student exports.
- Never use institute data for our own purposes, including any coaching business, marketing, advertising or training AI models, and never contact the institute’s students or parents about our own offers (the No-Poach clause, see the pledge).
What happens if there is a personal data breach?
Acavya will notify the institute without undue delay and aims to do so within 6 hours of becoming aware, with the details the institute needs to inform affected people and the Data Protection Board (a detailed report is due to the Board within 72 hours under DPDP Rule 7). Acavya separately reports cyber incidents to CERT-In within 6 hours where required.
How does our staff access the data?
Only by break-glass access: a recorded reason, limited time, full logging, and notice to the institute. There is no standing staff access to production data.
What happens at the end of the agreement?
At the institute’s choice, Acavya returns the data in open formats or deletes it, within 30 days, except where the law requires retention, which is then restricted to that purpose. The institute can export its data at any time.
Can the institute audit Acavya?
Yes. Acavya provides the information needed to show compliance and allows audits by the institute or its auditor, on 30 days’ written notice and at most once a year, covering how Acavya processes the institute’s data. The audit log of access to the institute’s data is available to the institute.
What about liability and governing law?
Liability and indemnities under this agreement follow the limits in the Terms of Service. Indian law applies, and courts at Jaunpur, Uttar Pradesh have jurisdiction.
Need the DPA before you sign up? Ask us for a copy.
30-day free trial for up to 30 students, no card needed. You set up your own institute, with an optional sample setup to explore. The Free plan is for tutors.