Data Processing Addendum (DPA)

Roles

For personal data that an institute (“Customer”) enters into MizEdu, the Customer is the Data Fiduciary and BrandMiz Private Limited is the Data Processor within the meaning of the Digital Personal Data Protection Act, 2023.

Subject matter and scope

Purpose	Providing the MizEdu admissions CRM and related support to the Customer
Data Principals	Enquirers, students and applicants, parents and guardians, the Customer’s staff and users
Categories of data	Identity and contact details, course and branch preferences, communications and call outcomes, appointment and attendance records, application documents, fee plans and payment status, marketing source data, user account and audit data
Duration	The term of the Customer’s subscription and the post-termination export period, plus any retention required by law

Processing on instructions

We process Customer personal data only on the Customer’s documented instructions — given through the Terms, the configuration of the Service and written requests — and not for our own purposes. We will tell the Customer if we believe an instruction breaches the law.

Confidentiality of personnel

Our personnel who can access Customer personal data are bound by confidentiality obligations and access it only as needed to provide the Service or support requested.

Security safeguards

We implement reasonable security safeguards appropriate to the risk, including tenant isolation, role-based access control enforced on the server, encryption in transit, hashed credentials, server-side secret storage, audit logging, backups and access controls for our staff. See Security.

Sub-processors

The Customer authorises us to engage sub-processors for hosting, storage, email, SMS and WhatsApp delivery, payment processing and support tooling. We impose data-protection obligations on them no less protective than this DPA and remain responsible for their performance. A current list is available on request from support@mizup.app, and we will notify Customers of new sub-processors in advance so they can object on reasonable grounds.

Assistance with rights and compliance

Taking into account the nature of processing, we help the Customer respond to Data Principal requests (access, correction, erasure, grievance and nomination) — mostly through features in the Service such as export, edit, anonymisation and opt-out handling — and with its other obligations under the DPDP Act.

Personal data breaches

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, with the information reasonably available, so that the Customer can meet its obligation to inform the Data Protection Board of India and affected Data Principals. We will take reasonable steps to contain and remedy the breach.

Children’s data

The Customer is responsible for obtaining verifiable parental or guardian consent under section 9 of the DPDP Act. We will not use children’s personal data for tracking, behavioural monitoring or targeted advertising.

Location and transfers

Customer personal data is hosted in India. Any transfer outside India complies with section 16 of the DPDP Act.

Return and deletion

On termination, the Customer may export its data for 30 days. After that we delete or anonymise Customer personal data within a reasonable period, except where retention is required by law. Backups are overwritten in the ordinary course.

Information and audits

We make available information reasonably necessary to demonstrate compliance with this DPA, and Pro customers may request audits as agreed in their order form, on reasonable notice and subject to confidentiality.

Contact

Privacy and DPA requests: support@mizup.app.

BrandMiz Private Limited
Registered office: U-179, Office No. 303, 2nd Floor, Gali No. 4, Shakarpur, East Delhi, Delhi 110092, India
Email: admin@mizup.app · Support: support@mizup.app · WhatsApp: +91 87001 39720