1.1 Parties. This Data Processing Agreement is made between Customer legal name, Customer entity type, of Customer address formatted (the "Controller") and Edsol Edtech Pvt. Ltd., a company incorporated in India, of 28, Jamunather Bulandshahar Uttar Pradesh India (the "Processor").

1.2 Background. The Processor supplies the Controller with access to the Platform under the Master Services Agreement: EU/EEA Variant (MSA-EU-001) together with the Order Form (the "Principal Agreement"). In supplying the Platform the Processor processes personal data on the Controller's behalf. This Agreement records the terms required by Article 28(3) of the GDPR and provides the safeguard required by Chapter V for transfers to India.

1.3 Structure. This Agreement comprises these clauses and:

1.4 Precedence. Where a term of this Agreement conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail. Where a term of this Agreement conflicts with the Principal Agreement in respect of the Processing, this Agreement prevails. Nothing in the Principal Agreement is to be read as varying, contradicting or limiting the Standard Contractual Clauses.

1.5 Duration. This Agreement takes effect on the effective date of the Principal Agreement and continues for as long as the Processor processes personal data on the Controller's behalf, and thereafter in respect of the obligations expressed to survive.

2.1 Controller, processor, data subject, personal data, special categories of personal data, processing, personal data breach, supervisory authority and restricted transfer have the meanings given in the GDPR.

2.2 <DefinedTerm term="Customer Personal Data" /> means personal data processed by the Processor on the Controller's behalf under the Principal Agreement, as described in Annex I.

2.3 <DefinedTerm term="GDPR" /> means Regulation (EU) 2016/679, including as incorporated into the Agreement on the European Economic Area and as supplemented by the national law of the Controller's jurisdiction.

2.4 <DefinedTerm term="Standard Contractual Clauses" /> or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.

2.5 <DefinedTerm term="Sub-processor" /> means a processor engaged by the Processor to carry out processing activities on the Controller's behalf.

2.6 <DefinedTerm term="Deployment Model" /> means one of DM-1, DM-2, DM-3 or DM-4 as defined in WPR-GL-004 and recorded at DM-1.

2.7 <DefinedTerm term="Break-Glass Access" /> means access by a named individual to Customer Personal Data in the clear, granted just in time, on the Controller's per-session approval, for a bounded period, under session recording, and expiring automatically.

2.8 Interpretation. References to Articles are to Articles of the GDPR. References to Clauses of the SCCs are to the clauses of the module applicable to the transfer concerned. Headings do not affect construction. "Including" is not limiting.

3.1 Roles. In respect of Customer Personal Data the Controller is the controller and the Processor is the processor. The Processor does not determine the purposes or the essential means of the processing.

3.2 Where the Controller is itself a processor. Where the Controller processes the personal data on behalf of a third-party controller, for example a hospital operating a shared record on behalf of a regional authority, the Controller warrants that it has that controller's authority to appoint the Processor as a sub-processor on these terms, and Module Three of the SCCs applies instead of Module Two. All other terms of this Agreement apply unchanged.

3.3 Where the Processor acts as controller. The Processor is a controller in respect of, and this Agreement does not apply to: account and contact data of the Controller's administrative users held for contract administration and billing; security telemetry and audit records the Processor is required to keep for its own compliance; and aggregated statistics that contain no personal data. POL-EU-053 states the Processor's own privacy notice for that processing. Product-usage telemetry is not used to develop or improve the Platform in a way that requires access to Customer Personal Data, and the Processor does not use Customer Personal Data to train any model that serves another customer.

3.4 Special categories. Customer Personal Data includes data concerning health, which is a special category of personal data under Article 9(1). The Controller's lawful basis in the treatment context is Article 9(2)(h) as implemented by the national law recorded in Annex IV, not consent. The Processor records this expressly so that the Controller's own record of processing does not default to a consent narrative.

3.5 The Processor makes no representation about the Controller's own compliance. The Controller is responsible for the lawfulness of the personal data it makes available, for its own record of processing, for its data protection impact assessment, for information to data subjects, and for the configuration of access rights inside the Platform.

4.1 The Processor processes Customer Personal Data only on the Controller's documented instructions, including as regards transfers to a third country, unless required to do otherwise by Union or Member State law to which the Processor is subject. Where such a requirement applies, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

4.2 The instruction set. The Controller's documented instructions are: this Agreement, the Principal Agreement, the configuration the Controller makes in the Platform, and any further written instruction the Controller gives. Instructions given through the Platform's administrative interface, or through the Processor's support channel by a person the Controller has authorised, are documented instructions.

4.3 Unlawful instruction. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, and may suspend performance of that instruction until it is withdrawn, amended or confirmed in writing. Suspension under this clause is not a breach of the Principal Agreement.

4.4 Instructions outside scope. An instruction that requires materially more than the Processor is obliged to do under this Agreement (for example a bespoke extraction, an unscheduled migration, or support delivered from a specified location) may be charged at the rates in the Order Form. The Processor may not charge for anything Article 28 or Article 32 requires it to do.

4.5 No independent purposes. The Processor does not sell, rent, disclose for consideration, or use for its own marketing any Customer Personal Data, and does not combine it with data from another controller.

5.1 The Processor ensures that every person authorised to process Customer Personal Data has committed to confidentiality in writing, or is under an appropriate statutory obligation of confidentiality. The commitment survives the end of that person's engagement.

5.2 Access is limited to those persons who need it to perform the Principal Agreement. The Processor maintains a register of individuals authorised for production access and makes it available to the Controller on request under 13.3.

5.3 The Processor screens personnel before engagement to the extent permitted by applicable law, trains them on data protection and on the transfer restrictions in 11 and 12, and revokes access on the same Business Day that an engagement ends.

6.1 The Processor implements the technical and organisational measures in Annex II, which are designed to ensure a level of security appropriate to the risk, having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, and to the risk to the rights and freedoms of natural persons. The measures address in particular pseudonymisation and encryption, the ongoing confidentiality, integrity, availability and resilience of processing systems, the ability to restore availability and access in a timely manner after an incident, and a process for regularly testing, assessing and evaluating effectiveness.

6.2 No degradation. The Processor may update the measures in Annex II, but may not reduce the overall level of security. Where an update materially changes a measure the Controller relies on, the Processor notifies the Controller at least thirty (30) days in advance.

6.3 Per-model boundary: stated, not implied. The measures the Processor can implement differ by Deployment Model, and a single undifferentiated security statement would be untrue in at least one model.

6.4 Testing. The Processor commissions an independent security assessment of the Platform at least annually, makes the summary available to the Controller, and makes the full report available under non-disclosure. Edsol Edtech Pvt. Ltd. holds no security certification of any kind and does not represent that it does; WPR-GL-005 states the assurance position and what compensates for the absence.

7.1 General authorisation. The Controller gives the Processor a general written authorisation to engage Sub-processors, on the terms of this clause. This corresponds to Option 2 of Clause 9(a) of the SCCs.

7.2 The list. The Sub-processors engaged at the date of this Agreement are listed in Annex III and maintained at DIS-GL-009, which states for each one its name, its role, the country in which it processes, and the transfer safeguard relied on.

7.3 Change notice. The Processor gives the Controller thirty (30) days' written notice of the intended addition or replacement of a Sub-processor that will process Customer Personal Data. Notice is given by email to the address in Annex I and by an entry in the change log DIS-GL-010, to which the Controller may subscribe.

7.4 Objection. The Controller may object on reasonable grounds relating to data protection or security within the notice period. On objection the Parties will discuss in good faith; if the Processor cannot accommodate the objection within thirty (30) days, the Controller may terminate the affected Services without liability for Charges in respect of the period after termination, and the Processor will supply exit assistance. POL-GL-055 states the process.

7.5 Flow-down. The Processor imposes on each Sub-processor, by written contract, data protection obligations no less protective than those in this Agreement, including in particular the obligations in 6, 9, 11 and 12, and including the third-party beneficiary rights required by Clause 9(c) of the SCCs. A copy of the relevant terms is made available to the Controller on request, with commercial terms redacted.

7.6 Verification: the measure that answers the criticism. The Processor operates a documented programme for verifying that its Sub-processors actually meet the obligations flowed down to them, rather than merely contracting for them. The programme is described in POL-GL-135 and comprises, at minimum, for each Sub-processor that processes Customer Personal Data:

1. an annual review of the Sub-processor's own security documentation and any independent assessment it holds;
2. a recorded assessment of the transfer safeguard where the Sub-processor processes outside the EEA, including an assessment against the European Essential Guarantees;
3. a record of the date, the reviewer, the evidence examined and the conclusion; and
4. a defined action where a Sub-processor fails verification, up to and including replacement.

The evidence of verification is available to the Controller on request. This clause exists because the absence of documented sub-processor verification, and specifically the absence of an assessment of transfers to sub-processors in third countries including India, is the deficiency for which European public bodies have been criticised by their own supervisory authority. The Processor is that third-country sub-processor, and the answer is a programme with evidence rather than an assurance.

7.7 Liability. Where a Sub-processor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the performance of that Sub-processor's obligations.

7.8 Not Sub-processors. A third-party system to which the Controller connects the Platform using the Controller's own credentials (a national health service, a laboratory analyser, a payment gateway, an insurer) is not a Sub-processor of the Processor. The Controller is the controller of that disclosure and holds the relationship. DIS-GL-024 and DIS-GL-025 state the boundary and the credential-custody model.

8.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests to exercise rights under Chapter III of the GDPR: access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision making.

8.2 Self-service first. The Platform provides the Controller with the ability to access, correct, export, restrict and delete personal data records without the Processor's involvement. The Controller uses those functions where they are sufficient, and the Processor's assistance is available where they are not.

8.3 Response time. Where assistance is required, the Processor provides it within seven (7) Business Days of a written request, so that the Controller can meet the one-month period in Article 12(3). Where a request is complex, the Processor states within those seven days what it can provide and by when.

8.4 Requests received directly. If the Processor receives a request from a data subject relating to Customer Personal Data, it does not respond to the substance. It forwards the request to the Controller within two (2) Business Days, acknowledges receipt to the data subject stating that the Controller is responsible, and identifies the Controller where the data subject does not already know it.

8.5 Charges. Assistance under this clause is provided without additional charge where it is required by Article 28(3)(e). The Processor may charge, at the rates in the Order Form, for assistance that goes materially beyond that obligation, for example a bespoke forensic reconstruction of a record's history over several years.

8.6 Portability format. Where a data subject exercises the right to portability, the Processor supplies the data in a structured, commonly used and machine-readable format, and states the format and schema so that the Controller can verify it.

9.1 Notification to the Controller. The Processor notifies the Controller of a personal data breach affecting Customer Personal Data without undue delay and in any event within four (4) hours of becoming aware of it. Article 33(2) requires notification without undue delay; the Processor fixes a four-hour outer limit so that the Controller can meet both its own 72-hour Article 33(1) obligation and, where it is an essential entity, its 24-hour early-warning obligation under the national transposition of the NIS2 Directive.

9.2 "Aware". Awareness arises when any Processor person or system holds information indicating that a breach may have occurred. It is not the point at which the breach is confirmed, scoped or understood. A clock that starts at certainty can be started whenever it is convenient.

9.3 Content of the notification. The first notification contains, so far as known, and thereafter is supplemented as information becomes available:

1. the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned;
2. the name and contact details of the Processor's data protection contact;
3. the likely consequences;
4. the measures taken or proposed to address the breach, including to mitigate its adverse effects;
5. whether the breach affects other controllers, and whether it originated with a Sub-processor;
6. whether personal data was accessed, exfiltrated, altered or rendered unavailable, and the basis for that conclusion; and
7. the time of the breach, the time of detection and the time of containment.

The notification is drafted so that the Controller can file its own regulatory report without a second request to the Processor. Where an element is unknown, the notification says so and states when it will be supplied.

9.4 Reporting responsibility. The Controller notifies the supervisory authority and, where required, the data subjects. The Processor does not notify a supervisory authority or a data subject on the Controller's behalf and does not represent that it can. The Processor supplies the content, the technical analysis and the evidence, and on request supplies a draft of the Article 34 communication and the list of affected data subjects.

9.5 Cooperation and evidence. The Processor cooperates with the Controller's investigation, preserves evidence including logs for not less than the period stated in DIS-GL-034, and provides a written post-incident review within ten (10) Business Days of containment or a dated interim review stating why the full review is not yet possible.

9.6 Sub-processor breach. A breach at a Sub-processor is a breach for the purposes of this clause and the same clocks apply, running from the Processor's awareness.

9.7 No admission. A notification under this clause is not an admission of fault or of liability. DIS-EU-016 states the commitment in the customer-facing form and is the source of truth for it.

10.1 Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in ensuring compliance with Articles 32 to 36.

10.2 Data protection impact assessment. The Processor supplies, without additional charge, a processor input pack for the Controller's data protection impact assessment, comprising: the description of the processing in Annex I, the measures in Annex II, the data-flow description in DIS-GL-006, the sub-processor register DIS-GL-009, the retention and deletion positions in DIS-GL-023, the remote-access model in DIS-GL-033 and the transfer impact assessment REP-GL-021. It responds to written follow-up questions within ten (10) Business Days.

10.3 The assessment remains the Controller's. The Processor does not carry out the Controller's impact assessment, does not sign it, and does not warrant its adequacy. Processing of health data on a large scale will ordinarily require one; the Processor's role is to make it cheap to produce rather than to produce it.

10.4 Prior consultation. Where the Controller consults a supervisory authority under Article 36, the Processor supplies the information the authority requests of the processor, within the authority's deadline, and informs the Controller of any direct contact it has with the authority about the Controller's processing.

10.5 Risk-assessment input. Where the Controller's own sector framework requires a supplier risk analysis, the Processor supplies the input pack described in the applicable country schedule in Annex IV.

This clause is the reason the Agreement exists in this form. It is written to be read by the Controller's data protection officer first.

11.1 No adequacy decision. There is no adequacy decision under Article 45 for India, and none is in prospect. Every transfer of Customer Personal Data to the Processor in India therefore requires an Article 46 safeguard.

11.2 Incorporation of the Standard Contractual Clauses. The Standard Contractual Clauses are incorporated into this Agreement by reference and form an integral part of it, and are entered into between the Controller as data exporter and the Processor as data importer on execution of this Agreement, without any further act being required. The Clauses are used unmodified; modification would forfeit the mechanism.

11.3 Module. Module Two (controller to processor) applies where the Controller is a controller. Module Three (processor to processor) applies instead where 3.2 applies. The Processor enters into Module Three with each Sub-processor to which it makes an onward transfer from the EEA.

11.4 Elections. The Parties' elections are made here once, so that nothing remains to be negotiated:

11.5 EEA States that are not Member States. Where the Controller is established in an EEA State that is not a Member State of the Union, the GDPR applies through the EEA Agreement and the Clauses apply with the adaptations that follow from that incorporation: references to Member State law are read as references to the law of that State, references to the competent supervisory authority as references to that State's authority, and references to Union law as references to the corresponding provisions as incorporated.

11.6 The transfer map, leg by leg. The Parties record the map so that the legs are not conflated in the Controller's own assessment. Conflation is the most common defect in a vendor transfer annex and it hides the leg that carries the risk.

Under DM-3 and DM-4 leg 2 does not exist because the infrastructure is the Controller's. Leg 1 is unchanged in every model, because remote access from India is a transfer whether or not the data is hosted in the EEA.

11.7 Transfer impact assessment. The Processor maintains a transfer impact assessment for transfers to India, prepared on the six-step method in the European Data Protection Board's Recommendations 01/2020, and supplies it to the Controller. It is published as REP-GL-021. Its conclusion is stated here rather than buried, because the Controller's data protection officer will reach it in any event:

Indian law does not, on its face, provide a level of protection essentially equivalent to that guaranteed within the Union. The compulsion powers relied on by the Indian state, including under section 69 of the Information Technology Act, 2000 and the rules made under it, section 5(2) of the Indian Telegraph Act, 1885, and the production powers of the criminal procedure statute, are not subject to independent prior authorisation of the kind the European Essential Guarantees contemplate, and an effective remedy is not clearly available to a data subject who is not resident in India. The Digital Personal Data Protection Act, 2023 contains broad exemptions in favour of the State.

The transfer is nonetheless defensible, measure by measure, because the supplementary measures in 12 reduce what is available to be compelled in India to pseudonymised data under keys held in the EEA. It is not defensible on the basis that India is essentially equivalent, and the Processor does not assert that it is.

11.8 No reliance on derogations. The Processor does not rely on an Article 49 derogation. Article 49 derogations are for occasional transfers and are not a lawful basis for systematic remote support. The Processor holds no binding corporate rules and does not claim any.

11.9 Onward transfer prohibition. The Processor does not disclose Customer Personal Data to a recipient outside the EEA except as recorded in Annex III, under Module Three of the SCCs, and after the assessment required by 7.6.

The measures below are committed as controls, not as undertakings, and they are the reason the transfer in 11.6 Leg 1 is defensible. They are in addition to Annex II, and their failure is a breach of this Agreement.

12.1 The load-bearing measure is S5. Where an importer requires access to data in the clear in order to provide the service, supplementary technical measures do not rescue the transfer and the whole weight falls onto the assessment of the destination country's law, which does not support it. The Controller should test S5 during evaluation by asking to see the approval flow, rather than accepting it as a statement.

12.2 Suspension. Where the Processor becomes unable to comply with the SCCs, or where a change in Indian law or practice makes a supplementary measure ineffective, the Processor notifies the Controller without undue delay under Clause 14(f) and Clause 16 of the SCCs, suspends the affected transfer, in practice by suspending access from India and operating from within the EEA, or by handing operational control to the Controller, and the Controller may terminate the affected Services under 16.3.

12.3 Re-assessment triggers. REP-GL-021 is re-assessed at least annually and immediately on: a change in Indian law affecting state access; a judgment of the Court of Justice of the European Union affecting Article 46 transfers; guidance or an enforcement decision of the Controller's own supervisory authority affecting third-country transfers; receipt by the Processor of any government access demand relating to customer data; a change to the hosting region, the key custody arrangement or the support access model; the addition of a Sub-processor in a third country; a change of Deployment Model; or a finding that any measure in this clause is not in fact implemented.

12.4 The honest alternative. A Controller that will not accept any processing from India should elect DM-3 or DM-4, where it controls the access path itself, or should require that all support be performed from within the EEA at the uplift stated in the Order Form. The Processor will not claim that the Standard Contractual Clauses make offshore access invisible to a supervisory authority.

13.1 Information. The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28, including the current versions of Annexes I to III, the documents named in 10.2, the evidence of sub-processor verification under 7.6, and the summary of the most recent independent security assessment.

13.2 Audit. The Controller, or an auditor it mandates, may audit the Processor's compliance with this Agreement once in any twelve-month period, and additionally after a personal data breach affecting the Controller or where a supervisory authority requires it. The Controller gives thirty (30) days' notice, audits during business hours, does not unreasonably disrupt operations, and is bound by confidentiality. The Processor contributes to the audit. Each Party bears its own costs, save that the Processor may charge at the Order Form rates for a second or subsequent audit in the same period that is not required by a supervisory authority.

13.3 What an audit may reach. The audit may cover the Processor's policies, procedures, the register of individuals with production access, access logs relating to the Controller's own environment, the configuration of the measures in Annex II and 12, and the evidence of sub-processor verification. It may not reach another controller's data, another customer's environment, or information whose disclosure would create a security risk to another customer; where access is refused on that ground the Processor states the ground in writing.

13.4 Sub-processor audits. The Processor procures for the Controller equivalent audit rights against Sub-processors, or exercises its own rights on the Controller's behalf and reports the result.

13.5 Supervisory authority. The Processor cooperates with, and submits to the powers of, the Controller's supervisory authority in respect of the processing under this Agreement, and permits an audit by that authority under Clause 8.9 of the SCCs.

14.1 Notification. If the Processor receives a legally binding request from a public authority, including a judicial authority, for disclosure of Customer Personal Data, it notifies the Controller promptly and, where possible, before responding. If it is prohibited from notifying, it uses best efforts to obtain a waiver of the prohibition, documents those efforts, and provides the documentation to the Controller at the earliest opportunity.

14.2 Aggregate information. Where notification is prohibited, the Processor provides the maximum information it is lawfully able to, on a regular basis and in aggregate form, and publishes it in the transparency report at S11.

14.3 Challenge. The Processor reviews the legality of every such request, challenges it where there are reasonable grounds to consider it unlawful under the law of the requesting jurisdiction, applicable obligations under international law and principles of international comity, and pursues appeal options. It seeks interim measures with a view to suspending the effect of the request until the competent judicial authority has decided. It does not disclose more than the minimum permissible on a reasonable interpretation of the request.

14.4 Records. The Processor documents every request, the assessment made and the action taken, and makes the record available to the Controller and to the competent supervisory authority on request.

14.5 No back door. The Processor has not created, and will not create, any facility for a public authority to access Customer Personal Data directly, and it is not subject to any obligation to provide systematic access to a foreign authority. As at 01 August 2026 the Processor has received no government request for a customer's personal data. The published policy is POL-GL-067.

14.6 Onward. Every Sub-processor is bound to equivalent obligations, and a request received by a Sub-processor is treated as a request received by the Processor for the purposes of this clause.

15.1 The Controller's choice. At the end of the provision of the Services the Processor, at the Controller's choice, deletes or returns all Customer Personal Data and deletes existing copies, unless Union or Member State law requires storage of the personal data.

15.2 Export window. The Controller exercises its choice in writing during the export window in the Principal Agreement. Absent a choice, the Processor deletes. The Processor does not retain data on the basis of silence.

15.3 Export. Where return is chosen, the Processor delivers a complete, readable, self-describing export in the format recorded in the Order Form, together with the schema, a record count and a checksum, so that the Controller can verify completeness independently. The format is a contractual term.

15.4 Deletion. Deletion is performed in accordance with DIS-GL-023, including the treatment of backups, and is certified in writing with the date, the scope, the method and the residual-backup expiry date. Backup media are overwritten on their ordinary rotation; the Processor states the maximum residual period rather than claiming instantaneous erasure.

15.5 The Controller's own retention duty survives. National law imposes a clinical-record retention obligation on the Controller which is not discharged by this Agreement and which may outlive it. The period applicable in the Controller's jurisdiction is stated in Annex IV. Planning for it is the Controller's responsibility, and the Processor's obligation is to make the export good enough that the Controller can meet it.

15.6 DM-4. In DM-4 the data is on the Controller's premises. The Processor's obligation is limited to deleting any copy in its own systems, including support artefacts, and certifying that it has done so.

16.1 Liability. The limitation of liability in the Principal Agreement applies to this Agreement, save as varied by clause 10 of MSA-EU-001, and save that nothing limits a Party's liability to a data subject or to a supervisory authority under the GDPR, or either Party's liability under Clause 12 of the SCCs.

16.2 Apportionment. Article 82(5) applies: a Party that has paid full compensation may claim back from the other the part corresponding to that other's responsibility.

16.3 Termination for a transfer failure. The Controller may terminate the affected Services immediately on written notice, without liability for Charges in respect of the period after termination, where 12.2 applies, or where a supervisory authority or a court prohibits or suspends the transfer, or where the Processor is in material breach of 11 or 12 and has not remedied it within fifteen (15) Business Days of notice.

16.4 Survival. Clauses 5, 9, 13, 14, 15 and 16 survive termination, as do the SCCs to the extent of any personal data still held.

16.5 Amendment. This Agreement may be amended only in writing signed by both Parties, save that the Processor may update Annexes II and III in accordance with 6.2 and 7.3, and save that where the European Commission adopts a replacement for the SCCs the Parties will execute the replacement within the transition period the adopting decision allows, without reopening commercial terms.