This Data Processing Agreement ("DPA") is entered into between the Controller (an institutional or commercial entity that licenses The Ivory Index for use by students or employees) and the Processor (AOArose). This DPA shall be incorporated into and form part of the Master Services Agreement or equivalent commercial agreement between the parties.
Article I
Definitions
| Term | Meaning |
|---|---|
| "Controller" | The entity or organisation that determines the purposes and means of processing personal data and has engaged AOArose under a Master Services Agreement. |
| "Processor" | Imperial Eminence Cyberguard Corporation ("IECC"), the entity that manages all licensing, infrastructure, hosting, software delivery, and data operations for The Ivory Index. legal@imperialecc.com |
| "Data Subject" | Any individual (including students, employees, or end users) whose personal data is processed in connection with the Services. |
| "Personal Data" | Any information relating to an identified or identifiable natural person, as defined in applicable Data Protection Law. |
| "Processing" | Any operation performed on Personal Data, whether or not by automated means. |
| "Data Protection Law" | All applicable data protection and privacy laws, including GDPR, UK GDPR, India's DPDPA 2023, and any other applicable national legislation. |
| "Sub-processor" | Any third party engaged by the Processor to process Personal Data on behalf of the Controller. |
| "Security Incident" | Any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data. |
Article II
Subject Matter and Scope of Processing
2.1The Processor shall process Personal Data only on behalf of and on the documented instructions of the Controller, for the purpose of providing The Ivory Index Software and associated services as described in the Master Services Agreement.
2.2Nature of Processing (Current Architecture): All processing of student Personal Data occurs exclusively on the Data Subject's local device. The Processor does not receive, store, access, or process student Personal Data on any server or infrastructure operated by the Processor. The Processor's role as defined in this DPA is therefore limited to: (i) defining the technical means by which the Software processes data on-device; and (ii) processing any Personal Data that the Controller separately and explicitly transmits to the Processor outside the Software (e.g., support communications). This DPA shall govern any future server-side processing if and when the Software's architecture is extended to include such processing, subject to amendment under Article IX.
2.3Types of Personal Data (Potential Categories — Local Device Only): The following categories of Personal Data may be processed on the Data Subject's local device by the Software but are not received by the Processor: academic records (GPA, test scores, qualifications), biographical data (name, date of birth, nationality), contact information, personal statements and essays, career goals, financial indicators, and experience records. These categories are listed for transparency regarding the Software's local functionality only and do not constitute an admission that the Processor processes them in any GDPR-regulated sense.
2.4Categories of Data Subjects: Students, applicants, or other individuals designated by the Controller.
2.5Duration of Processing: For the term of the Master Services Agreement and for such period thereafter as required by applicable law or as agreed in writing.
Article III
Processor Obligations
3.1The Processor shall: (a) process Personal Data only on documented instructions from the Controller; (b) ensure that persons authorised to process Personal Data have committed to confidentiality; (c) implement appropriate technical and organisational measures as set out in Article V; (d) assist the Controller in ensuring compliance with Data Subjects' rights under applicable Data Protection Law; (e) upon termination, confirm in writing that the Processor holds no copies of Personal Data (which, given the local-device architecture of the Software, is the ordinary position), and provide the Controller with instructions for Data Subject self-deletion via removal of the local data directory. The Processor's deletion obligation extends only to Personal Data actually in the Processor's possession. Because the Software's architecture is designed so that Personal Data resides exclusively on the Data Subject's local device and is not transmitted to or stored by the Processor, the Processor cannot undertake to "return" data it has never received. Any obligation in this clause to delete or return data is limited accordingly.
3.2The Processor shall immediately inform the Controller if, in its opinion, an instruction from the Controller infringes applicable Data Protection Law.
Article IV
Sub-processors
4.1Authorised Sub-processors as of the effective date:
| Sub-processor | Role | Location | Personal Data Accessed |
|---|---|---|---|
| Ollama (open-source runtime) | Local AI model inference | User's local device only | Prompt data processed entirely on-device — no transmission to Ollama servers |
| None | — | — | No other sub-processors currently engaged |
4.2The Processor shall provide at least thirty (30) days' prior written notice of any intended addition or replacement of sub-processors. The Controller may object in writing within that period.
Article V
Technical and Organisational Security Measures
5.1The Processor implements and maintains the following measures: (a) Data minimisation — the Software collects only data necessary for its stated functions; (b) Local storage — all Personal Data is stored exclusively on the Data Subject's device in ~/.theivorry/; (c) No network egress — the Software makes no outbound connections carrying Personal Data; (d) Access control — data is accessible only through the Software interface on the authorised device; (e) Encryption — the Processor recommends OS-level disk encryption and does not store data in plaintext on cloud systems; (f) Software security patches — released on a periodic basis, last patch May 2026.
5.2The Processor shall notify the Controller without undue delay (and in any event within seventy-two (72) hours) upon becoming aware of a Security Incident affecting Personal Data processed under this DPA.
Article VI
Data Subject Rights Assistance
6.1The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under applicable Data Protection Law, taking into account the nature of the processing and the information available to the Processor.
6.2Because Personal Data is stored locally, deletion requests can typically be fulfilled by the Data Subject directly by deleting the ~/.theivorry/ directory. The Processor will confirm the completeness of such deletion upon request.
Article VII
International Transfers
7.1No Personal Data is transferred from the Data Subject's device to any AOArose system. In the event the parties agree to any server-side processing in the future, such processing will be governed by appropriate transfer mechanisms (Standard Contractual Clauses or equivalent) and this DPA will be amended accordingly.
Article VIII
Audit Rights
8.1The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor, provided that: (a) the Controller provides at least thirty (30) days' prior written notice; (b) audits are conducted during normal business hours and no more than once per calendar year absent reasonable cause; (c) the Controller bears all costs of any audit it commissions.
Article IX
Governing Law and Liability
9.1This DPA is governed by the laws of India. The parties submit to the exclusive jurisdiction of the courts of India. This DPA is entered into with IECC or its designated operating entity. IECC's formal corporate registration is subject to finalisation upon commercial launch, at which point this DPA shall be re-executed between formally registered entities if required by applicable law. Liability under this DPA is subject to the limitations set out in the Master Services Agreement.
9.2For all DPA enquiries: legal@imperialecc.com
Executed as a Binding Legal Agreement
The Processor — IECC
Imperial Eminence Cyberguard Corporation (IECC)
Authorised Signatory
Date
The Controller
Organisation Name
Authorised Signatory + Title
Date