Organisation Terms and Data Processing Agreement
Effective date: [to be set at launch] · Version: 0.1 (draft for legal review)
Part A: Organisation Terms
1. Parties and scope
These terms are between Munarish Academy (5/446, 4th Street, Kumaran Nagar, Mannivakkam Extension, Vandalur, Chennai 600048, Tamil Nadu, India; GSTIN 33FMKPB4755A1ZF; "Munarish", "we") and the organisation named in the order or sign-up ("the Organisation", "you"). They cover the use of SmartAssess by the Organisation and its authorised users (administrators, teachers, students and parents), whether through the embedded app on your website or portal, the hosted organisation portal, the API, or the mobile app with an organisation sign-in.
2. Your responsibilities
- You decide who may use SmartAssess in your organisation and with which role. You keep your users' identities, roles, batches and parent links accurate.
- When you embed SmartAssess, you keep your API keys secret (server-side only), authenticate your users properly, and register only websites you control.
- You obtain any consent needed from students and, for students under 18, from their parents or guardians, for their data to be processed for assessment through SmartAssess, and you give them a privacy notice that mentions this service.
- You are responsible for the study material your organisation uploads (Content and Copyright Policy) and for how your staff use results.
- AI marks are suggestions. Results are released only after your teacher approves them, unless you switch on auto-release for objective-only papers. You are responsible for the final marks you release.
3. Our responsibilities
- Provide the service as described, with the security measures in Part B §6.
- Keep your organisation's data separate from every other customer's and from our consumer users.
- Give you notice of material changes and of planned downtime.
- Provide support through [support channel] with the response times in the order.
4. Fees
Fees, included paper pools, paper packs and billing periods are in the order or plan page. Invoices include GST. Fees are payable within [15] days of invoice, or in advance by web checkout. Unpaid accounts may be limited to read-only after [30] days' notice. Your data stays exportable.
5. Intellectual property
You keep all rights in your content and your users' answers. We keep all rights in the service. Generated papers and corrected sheets may be used freely by your organisation.
6. Term, suspension and exit
Monthly or yearly, as ordered. Either party may end the agreement at the end of a term, or earlier for an uncured material breach (30 days' notice). On exit, you may export all data (papers, submissions, corrected sheets, results, as PDF + CSV/JSON) for 30 days. We then delete it (Part B §9).
7. Liability
Each party's total liability is limited to the fees paid in the 12 months before the claim, except for breach of confidentiality, data-protection obligations caused by the breaching party, or amounts that cannot be limited by law. Neither party is liable for indirect losses.
8. Law
Indian law. Courts at Chennai, Tamil Nadu.
Part B: Data Processing Agreement (DPA)
1. Roles
For personal data of the Organisation's users processed in SmartAssess for Organisations, the Organisation is the Data Fiduciary and Munarish is the Data Processor under the Digital Personal Data Protection Act, 2023 and its Rules. We process that data only on your documented instructions: these terms, your settings, and your users' use of the service as you configure it.
2. Data and purposes
| Category | Data subjects | Purpose |
|---|---|---|
| Identity and role (name, external id, optional email/phone, batch, parent links) | Admins, teachers, students, parents | Sign-in, access control, notifications |
| Study material | — (may contain third-party content) | Building the organisation's knowledge bank and papers |
| Answer-sheet images, the text read from them, marks, feedback, comments, annotations | Students | Assessment, review, release and progress |
| Logs (security, audit) | All users | Security, audit, dispute resolution |
3. Confidentiality
Our staff and contractors with access are bound by confidentiality, and access is limited to what support and operations require. It is logged and audited.
4. Sub-processors
We use sub-processors for hosting and storage, AI processing (a single AI provider, through our own business account), messaging and error monitoring. The current list is at [URL]. We give 30 days' notice of new sub-processors, and you may object on reasonable grounds. AI sub-processors are used through paid API terms that prohibit training on your data. We do not send user names or contact details to AI providers.
5. Cross-border transfer
Primary storage is in India. AI sub-processors may process content outside India, subject to any restrictions notified by the Government of India.
6. Security
Encryption in transit and at rest, tenant isolation, role-based access, audit logs, encrypted backups, vulnerability management, and the controls described in our security summary (available on request).
7. Personal data breach
We notify you without undue delay, and within 24 hours of becoming aware of a breach affecting your data, with the information you need to meet your own duties to the Data Protection Board, CERT-In and affected individuals. We cooperate fully.
8. Assistance
We help you respond to requests from your users (access, correction, erasure, grievance) through admin tools (export, delete a user or a student's data) and, where needed, through support.
9. Deletion and return
On termination, or on your instruction: export for 30 days, then deletion from live systems within a further 30 days, and from backups within 35 days of that. We keep only what law requires (e.g. invoices). A deletion certificate is available on request.
10. Audit
We provide information reasonably needed to show compliance (e.g. security summary, sub-processor list, policies). On-site audits by agreement, at reasonable notice and cost.
11. Use of de-identified data for quality
Only if you opt in (Organisation settings): teacher corrections to AI marks, with names and images removed, may be used to measure and improve marking quality. They are never used to train third-party AI models.