Data Processing Agreement
Version 2026-10-15, in force from 15 October 2026
This agreement is between Paatya ("we") and each academy owner who uses Paatya ("you"). It forms part of the Terms of Service and applies to the personal data of the learners, staff and enquirers of your academy that we handle for you.
1. Who is responsible for what
Under the Digital Personal Data Protection Act, 2023, you are the Data Fiduciary for your academy's learners, staff and enquirers: you decide why and how their data is used. We are your Data Processor: we handle it only to provide Paatya to you.
Payments are the exception. If you sell courses online, Paatya and Razorpay also handle learners' payment details, and your payout account's business and bank details, for their own legal duties: taking and refunding payments, checking who a payee is (KYC), preventing fraud, handling chargebacks, and keeping payment and tax records. For that part, each of us is responsible for it in its own right, and it is kept for as long as those laws require.
You are responsible for having a lawful basis for the data you put into Paatya, for giving people the notice the law requires, and, for learners under 18, for having verifiable consent from a parent or guardian.
2. What we do with it
We handle your academy's personal data only:
- to provide, secure and support Paatya for your academy;
- on your instructions, which are what you set up and do in Paatya; and
- where the law requires us to.
We do not sell it, use it to advertise, or use it for our own purposes beyond running and improving the service.
3. People who handle it
Our staff who can reach your academy's data are bound to keep it confidential and reach it only when they need to, for example to answer a support request you made.
4. Sub-processors
We use the service providers listed on the Sub-processors page. We tell academy owners at least 30 days before adding a new one, and you may object. Each is bound to protect the data at least as well as we are.
5. Security
We protect personal data with reasonable security safeguards, including encryption in transit and at rest; access controls that give each person and each part of the service only the access it needs; two-step sign-in required for our staff and for every academy admin; temporary blocking of an account after repeated wrong passwords; a bot check on signup forms; automatic alerts on suspicious sign-in activity; and activity logs.
6. Personal data breaches
If we become aware of a breach affecting your academy's personal data, we tell you without undue delay, and within 72 hours, with what we know. We help you meet your own duty to inform the Data Protection Board and the people affected, and report to CERT-In as the law requires.
7. Helping you
We help you answer requests from your learners and staff to see, correct or erase their data, and we answer reasonable questions about how we protect it.
8. When you leave
When your academy closes, we delete its personal data as described in Academy Suspension, Closure and Data Deletion, except what the law requires us to keep.
9. Where the data is kept
Your academy's data is stored on Amazon Web Services in India. Where a sub-processor handles it outside India, it does so as the law allows.
10. Contact
Questions about this agreement go to support@paatya.net.