Data Processing Agreement

1. Parties & scope

This Data Processing Agreement (DPA) supplements the Terms of Service and the Privacy Policy and applies to personal data processed through the Jago Yuva, Jago Bharat platform. It is entered into between Advaita Ashrama, Ramakrishna Math, Belur Math (“Advaita Ashrama”) and the participating institution and is accepted by the institution at registration.

2. Roles of the parties

• Advaita Ashrama is the Data Fiduciary for personal data processed through the Platform and determines the purposes of that processing.
• the Ministry of Culture, Government of India, and the Centre for Cultural Resources and Training (CCRT) take part in running the Programme as programme partners / joint data fiduciaries, for the purposes described in the Privacy Policy.
• The institution is the party that has obtained, holds, and warrants the verifiable parental/guardian consent that makes the processing of students’ data lawful.
• Sub-processors (Schedule below) act as data processors on Advaita Ashrama’s instructions.

3. Institution obligations & consent

The institution agrees that it will:

• before uploading any student’s data, inform the students and their parents/guardians about the Programme and obtain and hold their verifiable consent, and be able to produce the underlying consent records if required;
• upload only the data the Programme requires, and keep it accurate and current;
• make the explicit attestations presented at the roster and submission checkpoints truthfully;
• act on any withdrawal of consent by removing the student from the roster; and
• assist Advaita Ashrama in responding to access, correction, and erasure requests from participants or their guardians.

4. Our obligations

Advaita Ashrama agrees that it will:

• process personal data only for the Programme purposes described in the Privacy Policy;
• apply appropriate technical and organisational security measures (see the Security & Data Protection page);
• restrict access on a least-privilege basis and scope each institution to its own data;
• permit access by authorised programme personnel only: state-scoped DRPs and SPOCs, who are verified and authorised before any access, National Observers with nationwide read-only oversight access, or nationwide Platform administrators when assisting a school;
• engage sub-processors only under obligations consistent with this DPA; and
• assist with data-principal requests and cooperate on any personal data breach.

5. Consent warranty & indemnity

The institution warrants that it holds verifiable parental/guardian consent for every student it adds and for every entry it submits. The institution indemnifies and holds harmless Advaita Ashrama and the Ministry of Culture, Government of India, and the Centre for Cultural Resources and Training (CCRT) against claims, losses, and costs arising from a breach of that warranty.

6. Sub-processors

Advaita Ashrama engages the processors listed in the Schedule below to provide the Platform. Each is bound to protect personal data consistently with this DPA and the Privacy Policy. Payment card data is handled by the PCI-DSS-compliant payment gateway and is not stored by us. the Ministry of Culture, Government of India, and the Centre for Cultural Resources and Training (CCRT) are programme partners, not sub-processors, and their role is described in the Privacy Policy.

7. International transfers

Roster and guardian personal data is stored in India (our database provider’s Mumbai region). Student submission uploads (files, images, and videos) are stored with our object-storage provider, Cloudflare R2, which does not guarantee an India storage region and may store them outside India. Some other processing or hosting may also occur outside India. In each case the data is protected by appropriate safeguards. The DPDP Act permits cross-border transfer except to countries the Government of India restricts.

8. Personal data breach

In the event of a personal data breach, Advaita Ashrama will act to contain and remediate it and will cooperate with the institution and notify the relevant authority and affected persons as required by the DPDP Act. The institution will promptly report to us any breach it becomes aware of that affects Programme data.

9. Duration & deletion

This DPA applies for as long as Advaita Ashrama processes personal data on the institution’s behalf. Personal data is retained in line with the Privacy Policy — Retention section, which does not commit to a fixed retention period; an institution, parent, or guardian may request correction or deletion of a student’s data.

10. Governing law

This DPA is governed by the laws of India and is subject to the jurisdiction of the competent courts in India.

Schedule — Sub-processors

The processors Advaita Ashrama uses to operate the Platform:

This list may change as the Platform evolves; the current version is always shown here with the “Last updated” date above.

Contact

Questions about this DPA can be sent to our Grievance Officer: