Data Processing Addendum (Coaching & Tutoring)

1. Roles

The Academy is the Data Fiduciary of its students', guardians', coaches' and staff's personal data. Ironbay Innovations Pvt Ltd (“10mins”) is a Data Processor and processes the data only to provide the software, on the Academy's documented instructions, which are the Academy's use of the product.

2. What is processed

• Students: name, phone, email, photo, education stage, interests, goal, exam date, guardian name and phone for students under 18, learning progress, quiz and test results, time taken and tab-leave counts, notes, doubts and photos, chat messages, AI-helper questions and answers, reviews, purchases and payment references, notifications, and device push tokens.
• Coaches: name, phone, email, photo, qualifications, links, intro video, identity and education documents, earnings and payout records.
• Staff: name, email, role, activity log entries.
• Safety: reports and their replies.

3. Children's data

• 10mins processes children's data only to provide the software to the Academy and does not track, profile, or direct advertising at children, and will not enable the Academy to do so.
• The software records the guardian's details and the time of consent given at sign-up; obtaining and verifying consent is the Academy's responsibility.

4. 10mins' commitments

• Process only for providing the service; no sale of data, no use for advertising.
• Staff with access are bound by confidentiality. Access to tenant data is limited to what support or the law needs.
• Appropriate security: encryption in transit, hashed passwords, role-based access, private storage and signed access for identity documents, logging, and separation between tenants.
• Sub-processors are listed at /subprocessors, including the artificial-intelligence provider that receives AI-helper and knowledge-base content; 10mins will update the list before adding or replacing one, and is responsible for them.
• Help the Academy answer a data principal's request (download and delete tools are in the student app; exports are in the admin panel).
• Tell the Academy without undue delay after becoming aware of a personal-data breach so that it can notify the Data Protection Board and affected people.
• On the Academy leaving, return or delete the data after export, except what the law requires to keep.

5. Academy's commitments

• Have a lawful basis and notice for each category of data, and verifiable parental consent for students under 18.
• Set and follow a retention schedule, delete or anonymise on request, and respond to data principals and to the Data Protection Board.
• Limit staff access to what each role needs and review the activity log.

6. Transfers

Data is stored on cloud servers that may be outside India; 10mins uses providers that apply appropriate safeguards and will not transfer to a country the Government has restricted.