Data Processing Agreement

1. Roles and Responsibilities

Under this Data Processing Agreement (DPA), the registered School acts as the Data Controller. Schexus acts solely as the Data Processor, processing personal data on behalf of the School and strictly in accordance with the School's documented instructions.

2. Processing of Personal Data

Schexus will only process personal data (including student, parent, and staff information) for the purpose of providing the educational management services agreed upon. Schexus will not use the data for its own purposes or disclose it to third parties, except as required by law or as expressly permitted by the School.

3. Security Measures

Schexus implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

4. Sub-processors

The School authorizes Schexus to engage third-party sub-processors (such as cloud hosting providers) to assist in providing the services. Schexus remains responsible for any sub-processor's compliance with data protection obligations equivalent to those in this DPA.

5. Data Subject Requests

Schexus will reasonably assist the School in fulfilling its obligation to respond to requests from data subjects exercising their rights under applicable data protection laws.