This Data Processing Agreement (“DPA”) forms part of the agreement between Asset Chain Techlligence Pvt. Ltd. (“TruScholar”, “Processor”) and the customer (“Customer”, “Controller”) for the provision of the TruScholar platform.
It sets out how we process personal data on your behalf, and what each party is responsible for.
Plain summary of the position:
You are the data controller. You decide what credentials to issue, to whom, and what data they contain.
We are the data processor. We process that data only on your instructions, to deliver the service.
We do not sell personal data, and we do not use it to market unrelated services.
Only a cryptographic hash is anchored to a distributed ledger. No personal data is written on-chain, so correction and erasure rights remain enforceable.
Personal Data — any information relating to an identified or identifiable natural person, as defined under applicable data protection law.
Data Subject — the individual to whom Personal Data relates, including credential recipients, learners, administrators and other users.
Processing — any operation performed on Personal Data, including collection, storage, alteration, retrieval, disclosure, erasure and destruction.
Controller / Data Fiduciary — the party that determines the purposes and means of Processing. Under this DPA, the Customer.
Processor / Data Processor — the party that Processes Personal Data on behalf of the Controller. Under this DPA, TruScholar.
Sub-processor — a third party engaged by TruScholar to Process Personal Data.
Applicable Data Protection Law — all laws applicable to the Processing, including the Digital Personal Data Protection Act, 2023 (India); Regulation (EU) 2016/679 (GDPR); the UK GDPR and Data Protection Act 2018; and applicable US state privacy laws.
Personal Data Breach — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
3.1 The Customer is the Controller and TruScholar is the Processor in respect of Personal Data Processed under the Agreement.
3.2 Each party complies with its own obligations under Applicable Data Protection Law.
3.3 The Customer is responsible for the lawfulness of the Personal Data it provides, including establishing a lawful basis, providing notice to Data Subjects, and obtaining consent where required.
3.4 TruScholar acts as an independent Controller only in respect of limited data it processes for its own purposes — account administration, billing, service security and product improvement — as described in its Privacy Policy.
Subject matter: provision of the TruScholar credential issuance, verification, records management and career platform.
Duration: for the term of the Agreement, plus any retention period set out in Section 13.
Nature and purpose: designing, issuing, delivering, verifying, managing, correcting, revoking and archiving digital credentials; digitising legacy academic records; supporting career and placement services where those modules are used.
Categories of Data Subject:
Credential recipients — students, learners, employees, members
Institutional administrators and staff users
Verifiers who check credentials
Recruiters and career service users, where applicable
Categories of Personal Data:
Identity data — name, enrolment or roll number, date of birth where supplied, photograph where supplied
Academic data — programme, grades, marks, credits, issue dates, credential status
Contact data — email address, telephone number
Account data — credentials for platform access, roles and permissions
Usage data — access logs, issuance and verification activity
Employment data — where career or placement modules are used
Special category data: not required by the service. The Customer must not upload special category data unless separately agreed in writing.
Children’s data: where the Customer issues credentials to individuals under 18, the Customer is responsible for obtaining verifiable parental consent where required, including under Section 9 of India’s DPDP Act, 2023.
TruScholar will:
5.1 Process only on documented instructions from the Customer, including in respect of international transfers, unless required to do otherwise by law — in which case it will inform the Customer beforehand unless legally prohibited.
5.2 Ensure confidentiality. Personnel authorised to Process Personal Data are bound by confidentiality obligations and receive data protection training.
5.3 Implement appropriate security measures, as set out in Section 7.
5.4 Assist the Customer in responding to Data Subject requests, as set out in Section 9.
5.5 Assist the Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of Processing and the information available.
5.6 Notify the Customer without undue delay of any Personal Data Breach, as set out in Section 10.
5.7 Delete or return Personal Data at the end of the Agreement, as set out in Section 13.
5.8 Make available all information necessary to demonstrate compliance, and allow for audits, as set out in Section 12.
5.9 Immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
5.10 Not sell Personal Data, and not use it for its own marketing or to train models offered to third parties.
The Customer will:
6.1 Ensure it has a lawful basis for the Processing it instructs.
6.2 Provide Data Subjects with required notices about how their data is processed.
6.3 Ensure the accuracy of Personal Data uploaded to the platform.
6.4 Configure access controls and permissions appropriately, and manage its own users.
6.5 Not upload special category data or data outside the scope described in Section 4 without prior written agreement.
6.6 Respond to Data Subject requests directed to it, with TruScholar’s assistance.
TruScholar maintains technical and organisational measures appropriate to the risk, including:
Certification and audit
CMMI Level [X], ISO/IEC 27001 and SOC 2 Type [X], with independent audits maintained and evidence available on request.
Encryption
Personal Data encrypted in transit using industry-standard protocols, and at rest.
Access control
Role-based access control limiting access to what each role requires; single sign-on support; multi-factor authentication; access review processes; and prompt removal of access for leavers.
Credential integrity
Each credential anchored as a cryptographic hash. Only the hash is written to a distributed ledger. Personal Data remains in the platform database, where correction and erasure rights can be exercised.
Logging and monitoring
Append-only audit logging of issuance, edits, revocation and access events, with timestamp and acting user, not alterable by Customer administrators or by TruScholar.
Resilience
Backup, disaster recovery and business continuity arrangements, tested periodically.
Testing
Penetration testing carried out at least annually, with a summary available under NDA.
Secure development
Security review within the development lifecycle, dependency scanning and vulnerability management.
TruScholar may update these measures provided the level of security is not reduced.
8.1 The Customer grants general authorisation for TruScholar to engage Sub-processors.
8.2 A current list of Sub-processors is set out in Annex 1 to this DPA.
8.3 TruScholar will give at least 30 days’ notice before adding or replacing a Sub-processor, by email to the Customer’s nominated contact and by updating Annex 1. Customers may subscribe to change notifications at privacy@truscholar.io.
8.4 The Customer may object to a new Sub-processor on reasonable data protection grounds within 30 days of notice. The parties will work in good faith to find a resolution. If none is found, the Customer may terminate the affected service without penalty for the unused portion of any prepaid fees.
8.5 TruScholar imposes data protection obligations on each Sub-processor no less protective than those in this DPA, and remains fully liable to the Customer for each Sub-processor’s performance.
9.1 Taking into account the nature of the Processing, TruScholar will assist the Customer by appropriate technical and organisational measures in responding to requests from Data Subjects to exercise their rights, including access, correction, erasure, restriction, portability and objection.
9.2 Where TruScholar receives a request directly from a Data Subject relating to Customer data, it will not respond substantively but will forward the request to the Customer without undue delay.
9.3 The platform provides self-service functionality allowing the Customer to access, correct, export and delete Personal Data without needing to contact TruScholar.
9.4 On credential integrity and erasure. Because only a cryptographic hash is anchored, correction and erasure of Personal Data can be given full effect. Correcting a credential re-anchors it properly; erasing a record removes the Personal Data while the anchored hash, which contains no Personal Data, remains.
10.1 TruScholar will notify the Customer without undue delay and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Customer data.
10.2 The notification will include, to the extent known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information.
10.3 Where full information is not available immediately, TruScholar will provide it in phases without undue further delay.
10.4 TruScholar will take reasonable steps to contain and remediate the breach and will cooperate with the Customer in meeting its own notification obligations to supervisory authorities and Data Subjects.
10.5 TruScholar will not make any public statement identifying the Customer in connection with a breach without the Customer’s prior written consent, unless legally required.
11.1 The Customer’s Personal Data is hosted in [region(s)]. Data residency options are available and confirmed in writing during onboarding.
11.2 Where Personal Data is transferred outside the jurisdiction in which it was collected, TruScholar ensures an appropriate transfer mechanism is in place, which may include:
Standard Contractual Clauses adopted by the European Commission, incorporated into this DPA by reference where transfers from the EEA occur
UK International Data Transfer Addendum for transfers from the United Kingdom
Adequacy decisions where applicable
Transfer mechanisms permitted under India’s DPDP Act, 2023, subject to any restrictions notified by the Central Government
11.3 TruScholar will carry out transfer impact assessments where required and implement supplementary measures where necessary.
13.1 TruScholar retains Personal Data for the term of the Agreement and for 90 days thereafter, unless a longer period is required by law.
13.2 On termination, and at the Customer’s election, TruScholar will return Personal Data in a structured, commonly used, machine-readable format, or delete it.
13.3 Issued credentials. Credentials already issued remain verifiable and remain in recipients’ own wallets, since those credentials belong to the recipients. The Customer’s administrative data, records and metadata are returned or deleted as above.
13.4 Backups are deleted in accordance with the backup retention cycle.
13.5 TruScholar will certify deletion in writing on request.
The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.
In the event of conflict, this DPA prevails over the Agreement in respect of Processing of Personal Data. Where Standard Contractual Clauses apply, those clauses prevail over this DPA to the extent of any conflict.
This DPA is governed by the law stated in the Agreement, except where Applicable Data Protection Law requires otherwise.
Data Protection Officer: [name or role]
Email: dpo@truscholar.io
Post: Asset Chain Techlligence Pvt. Ltd., 3rd Floor, Nanda Motors, Nawathe Square, Amravati 444606, Maharashtra, India
EU representative (where applicable): [name and address]
UK representative (where applicable): [name and address]
Customers who require a signed DPA may request one at dpo@truscholar.io. Where no separate DPA is executed, this version applies to all Customers from the effective date shown above.
A downloadable PDF of this DPA is available for your records and for your procurement file.
This annex lists the Sub-processors TruScholar engages to provide the Services: what each one does, what Personal Data it processes, where that processing takes place, and the safeguard relied upon for any international transfer. Notice of changes and the Customer’s right to object are set out in section 8.
How we choose and manage sub-processors
Before engaging any sub-processor, we:
Assess their security posture, certifications and data protection practices
Confirm they can meet obligations no less protective than those in this DPA
Put a written data processing agreement in place
Confirm an appropriate transfer mechanism where data crosses borders
Limit their access to only the data necessary for their function
We remain fully liable to our customers for the performance of every sub-processor.
We review each sub-processor at least annually, and on any material change to the service they provide.
Current sub-processors
Infrastructure and hosting
[Cloud hosting provider]
Hosts the platform and stores all platform data. Processes every category of personal data held in the platform. Processing takes place in [region], relying on [transfer safeguard].
[Content delivery network]
Delivers static content and protects against denial-of-service attacks. Processes technical and usage data, including IP addresses. Processing takes place in [region], relying on [transfer safeguard].
[Backup provider]
Maintains encrypted backups for disaster recovery. Processes every category of platform data. Processing takes place in [region], relying on [transfer safeguard].
Communications
[Email delivery provider]
Delivers credential notifications and service emails. Processes recipient names and email addresses. Processing takes place in [region], relying on [transfer safeguard].
[SMS provider]
Delivers credentials and notifications by SMS where email is not the appropriate channel. Processes recipient names and telephone numbers. Processing takes place in [region], relying on [transfer safeguard].
[Push notification provider]
Delivers in-app and push notifications. Processes account identifiers and device tokens. Processing takes place in [region], relying on [transfer safeguard].
Platform operations
[Product analytics provider]
Measures feature usage so the product can be improved. Processes usage data and account identifiers. Processing takes place in [region], relying on [transfer safeguard].
[Error monitoring provider]
Captures application errors so faults can be diagnosed and fixed. Processes technical data and limited account identifiers. Processing takes place in [region], relying on [transfer safeguard].
[Support platform]
Manages support tickets and correspondence. Processes contact details and the content of support correspondence. Processing takes place in [region], relying on [transfer safeguard].
Credential anchoring
[Blockchain network]
Anchors credential integrity proofs. Processes a cryptographic hash only. No personal data is written to the ledger. Processing is distributed by design, and no transfer safeguard is required because no personal data is transferred.
Government and ecosystem integrations
These are engaged only where a Customer instructs delivery to them, and each operates under its own statutory framework.
DigiLocker
Delivers credentials into recipients’ DigiLocker accounts. Processes credential data as instructed by the Customer. Processing takes place in India.
National Academic Depository (NAD)
Receives statutory lodgement of academic records. Processes credential data as instructed by the Customer. Processing takes place in India.
Academic Bank of Credits (ABC)
Maintains credit records. Processes credit data as instructed by the Customer. Processing takes place in India.
Business operations
[Payment provider]
Processes subscription payments. Processes billing contact details. Card data is handled under PCI-DSS and is not stored by TruScholar. Processing takes place in [region], relying on [transfer safeguard].
[CRM provider]
Manages customer and prospect relationships. Processes business contact details. Processing takes place in [region], relying on [transfer safeguard].
Affiliates
TruScholar may share personal data with members of its corporate group for the purposes of providing and supporting the service. Group entities are bound by intra-group data processing terms no less protective than this DPA.
Current group entities: [list]
Change log
We record every change to this list here, with the date, the provider concerned, whether it was added, removed or replaced, and the reason.
No changes recorded since this list was published on 23-09-2026.