Data Processing Agreement

This addendum forms part of the Libolink Terms of Service between the library ("Library", the Data Fiduciary) and Akhilesh Nigam, who manages the Libolink digital platform ("Libolink", the Data Processor).

1. Scope and roles

• This addendum covers personal data that the Library, its staff and its students put into Libolink: students, guardians, staff, enquiries, attendance, fees and related records.
• Under the Digital Personal Data Protection Act, 2023, the Library decides the purpose and means of processing this data and is the Data Fiduciary. Libolink processes it only on the Library's behalf.

2. Libolink's commitments

• Process the data only to provide, secure and support the service, and on the Library's documented instructions. The settings and actions in the app are those instructions.
• Not sell the data, and not use it for advertising or for any purpose of Libolink's own, except aggregated, non-identifying statistics about how the service performs.
• Make sure that people with access to the data are bound by confidentiality and have access only as their role needs.
• Libolink administrators may open the Library's workspace to set it up, give support or correct records, as part of providing the service. Each opening lasts at most 8 hours, needs two-step verification, and every entry and change is recorded in the Library's audit log.
• Keep reasonable security safeguards in place: encryption in transit, separation of each library's data, access controls, two-step verification for administrators, malware scanning of uploads, logging and backups.
• Notify the Library without undue delay, and where possible within 24 hours, after becoming aware of a personal data breach affecting its data. The notice will include the information the Library needs to inform affected people and the Data Protection Board of India.
• Help the Library respond to data principals' requests (access, correction, erasure, consent withdrawal and grievances) through the privacy request, export and consent tools in the app.

3. Sub-processors

• The Library authorises Libolink to use the sub-processors on the Sub-processors page.
• Libolink gives at least 15 days' notice of a new sub-processor on that page or in the app. Libolink binds each sub-processor to data protection terms no less protective than this addendum, and stays responsible for their work.

4. Children's data

• The Library is responsible for obtaining verifiable consent from a parent or lawful guardian before processing data of a student under 18.
• Libolink provides a guardian-consent workflow. Where the Library enables it, memberships are blocked until consent is recorded.

5. End of the service

• During the subscription and for 30 days after it ends, the Library can export its data.
• Libolink then deletes or anonymises the Library's personal data, and backup copies are overwritten within 35 days. Data that Libolink must keep by law is retained only for that purpose and period.

6. Information and audits

• Libolink will make available the information reasonably needed to show compliance with this addendum, such as security documentation and the audit log available in the app.
• Any other audit is by prior agreement and at reasonable times.

7. Library's responsibilities

• Collect data lawfully, give students the required notice and keep the data accurate.
• Configure staff permissions appropriately.
• Not instruct Libolink to process data unlawfully.