Loading page content
Loading page content
Legal
Published November 2026
Effective date: 5 November 2026.
Not yet a binding agreement.
This Data Processing Addendum is published for review and contains fields marked[DECISION REQUIRED]. Those fields are business or legal decisions that must be completed by ZENRITH (SMC-PRIVATE) LIMITED and confirmed by qualified counsel before this document is signed or treated as binding. Do not rely on this document as a contract until it has been executed by both parties.
Controller (customer / school)
[DECISION REQUIRED — company and legal confirmation pending]
The legal name, registered address, and contact details of the school or organisation acting as controller.
Processor (Zenrith)
ZENRITH (SMC-PRIVATE) LIMITED, Pakistan
Contact: zenrith.hq@gmail.com. Official site: https://www.zenrith.com (site configuration URL: https://zenrith.com; canonical discrepancy noted).
Zenrith processes personal data on behalf of the controller to provide the Zenrith Edu school management platform, including: student, teacher, and parent account management; attendance, homework, results, timetables, and fee records; in-app messaging and notifications; leave management; and platform administration.
Processing is limited to the controller's documented instructions and to what is necessary to provide the service. Zenrith does not use customer personal data for its own independent purposes, for advertising, or for training models.
Duration of processing
[DECISION REQUIRED — company and legal confirmation pending]
The term of the underlying service agreement and any post-termination data-handling period.
Zenrith engages the following categories of subprocessors:
Specific subprocessor legal entities, locations, and services require external confirmation against Google/Firebase and Vercel contractual documentation before this DPA is executed.
Subprocessor authorisation and objection process
[DECISION REQUIRED — company and legal confirmation pending]
Whether the controller grants general authorisation for subprocessors, the notice period, and the right to object and terminate.
Processing by Google Firebase and Vercel may involve transfers of personal data outside Pakistan, including to the United States. Transfer mechanisms (such as Standard Contractual Clauses or reliance on an adequacy decision) require external confirmation.
Transfer mechanism and destination countries
[DECISION REQUIRED — company and legal confirmation pending]
The specific transfer mechanism, destination countries, and any supplementary measures.
Zenrith will assist the controller in responding to data-subject requests (access, correction, deletion, restriction, objection, portability, withdrawal of consent) within the timeframe set out below. Zenrith Edu deletion is school-mediated: the school administrator initiates deletion, and Zenrith removes the Firebase Auth user, the users document, the PIN verifier, and parent links. Messages, academic records, fee records, and audit logs (which may contain name and role) are retained as school records.
Response timeframe for data-subject requests
[DECISION REQUIRED — company and legal confirmation pending]
Zenrith aims to respond within 30 days where it is the controller; processor-assist timelines to be confirmed.
Zenrith implements role-based access control, tenant isolation between schools, PBKDF2-SHA256 PIN verifiers (100,000 iterations, 32-byte key, 16-byte salt) stored in server-only documents, Firebase Authentication, and Firebase Cloud Messaging for notifications. Crashlytics is active on Android/iOS; Sentry on Windows only when SENTRY_DSN is set, with sendDefaultPii = false.
Security schedule and specific technical/organisational measures
[DECISION REQUIRED — company and legal confirmation pending]
A detailed security schedule (encryption, access logging, vulnerability management, etc.) to be agreed with the controller.
Zenrith will notify the controller without undue delay after becoming aware of a personal-data breach affecting controller data, and will cooperate with the controller's own breach-notification obligations.
Breach-notification timeline
[DECISION REQUIRED — company and legal confirmation pending]
The number of hours or days within which Zenrith will notify the controller after becoming aware of a breach.
Zenrith does not claim certifications (such as ISO 27001 or SOC 2). Audit rights, evidence, and any compliance representations require company and legal confirmation.
Audit rights and evidence
[DECISION REQUIRED — company and legal confirmation pending]
The controller's right to audit, notice requirements, and costs.
At the end of the service, Zenrith will delete or return personal data to the controller, except where retention is required by law. Audit logs may be retained for legal or security purposes.
Post-termination data-handling timeline
[DECISION REQUIRED — company and legal confirmation pending]
The timeline for deletion or return of data after termination, and any lawful-retention exceptions.
Governing law
[DECISION REQUIRED — company and legal confirmation pending]
To be confirmed by the company and legal counsel. Website terms currently state the laws of Pakistan.
Dispute resolution / jurisdiction
[DECISION REQUIRED — company and legal confirmation pending]
To be confirmed by the company and legal counsel.
Liability allocations between Zenrith and the controller require company and legal confirmation.
Liability cap
[DECISION REQUIRED — company and legal confirmation pending]
To be confirmed by the company and legal counsel.
Indemnity scope
[DECISION REQUIRED — company and legal confirmation pending]
To be confirmed by the company and legal counsel.
This DPA is not effective until signed by authorised representatives of both parties. Signature fields are intentionally left blank pending company and legal confirmation.
Controller signature (name, title, date)
[DECISION REQUIRED — company and legal confirmation pending]
Processor signature (Zenrith — name, title, date)
[DECISION REQUIRED — company and legal confirmation pending]
Questions about this DPA can be sent to zenrith.hq@gmail.com.