Skip to content
institify

Legal

Data Processing Agreement

Last updated

In short

This agreement forms part of the Terms of Service between Institify, operated by Pxlhut ("we", the processor), and each customer ("you", the controller). It applies whenever we handle personal information on your behalf.

Put simply: your students' information is yours. We handle it only to run the service for you, keep it secure, use only the providers listed here, tell you quickly if something goes wrong, and delete or return it when you leave.

Contents
  1. 1.Definitions
  2. 2.Roles and instructions
  3. 3.Details of the processing
  4. 4.Our people
  5. 5.Security measures
  6. 6.Sub-processors
  7. 7.International transfers
  8. 8.Helping you meet your obligations
  9. 9.Personal data breaches
  10. 10.Return and deletion of data
  11. 11.Improving the service
  12. 12.Information and audits
  13. 13.Liability and conflicts
  14. 14.Governing law
  15. 15.Contact

1.Definitions

Controller
The organisation that decides why and how personal information is used. Here, that is you, the customer.
Processor
The organisation that handles personal information for the controller, following its instructions. Here, that is us.
Sub-processor
Another company we use to help provide the service, which handles some of your personal information for us.
Customer personal data
Personal information that you or your users put into the service, or that the service creates for you, such as answers, recordings and results.
Data subject
The person the information is about.
Personal data breach
A security incident that leads to customer personal data being lost, destroyed, changed, disclosed or accessed without permission.
Data protection law
The laws on personal information and privacy that apply to either of us, including those of Bangladesh and of the countries where your students live.

Other words have the meaning given in the Terms of Service.

2.Roles and instructions

  • You are the controller and we are the processor of customer personal data.
  • We will handle customer personal data only on your documented instructions. These terms, your settings and your use of the service are your instructions.
  • If we think an instruction breaks data protection law, we will tell you. We may also be required by law to handle data in a certain way. If so, we will tell you first unless the law forbids it.
  • You are responsible for having a lawful reason to collect and use your students' information, for telling them how it is used, and for getting any consent needed, including from a parent or guardian for a student under 18.

3.Details of the processing

  • Subject matter

    Providing the service: authoring and running tests, marking, AI band suggestions, results and score reports, student and batch management, attendance, fees, messages, bookings, enquiries and the centre website.

  • Duration

    For as long as you use the service, and until the data is deleted or returned as set out in section 10.

  • Nature and purpose

    Storing, organising, displaying, analysing, marking, sending and deleting data, only to provide, secure and support the service for you.

  • Data subjects

    Your students and walk-in candidates, their parents or guardians where you add them, your staff, and people who send enquiries or bookings through your website.

  • Categories of data

    Names, student IDs, dates of birth, nationality, contact details, branch and batch, attendance, fees and payments, exam answers, Writing essays, Speaking recordings and transcripts, marks, bands, examiners' comments, activity recorded on exam computers during a test, and enquiry details.

  • Special categories

    The service is not designed to hold sensitive data such as health or religious information. Please do not add it. Speaking recordings capture a person's voice. We use them only to run and mark the test, never to identify people by their voice.

4.Our people

Only people who need to work on the service can access customer personal data, and only as far as their work requires. Everyone with access must keep it confidential.

5.Security measures

We protect customer personal data with appropriate technical and organisational measures, including:

  • Encrypted connections for all traffic to and from the service.
  • Passwords stored in a scrambled form that cannot be reversed.
  • A one-time code when staff sign in from a new device, and account lockout after repeated wrong passwords.
  • Each customer's data kept separate, and access inside a customer controlled by roles and branches.
  • Exam attempts tied to registered exam computers.
  • Encrypted storage of the secret keys for your payment accounts.
  • Nightly database backups, kept for a short time.
  • Automatic deletion of Speaking recordings after 90 days, as described in our Privacy Policy.
  • Error reports cleaned of personal details before they are sent.

Our Security page describes these measures in more detail. We may improve them over time, but we will not lower the overall level of protection.

6.Sub-processors

You allow us to use the sub-processors listed below. We have, or will have, a written agreement with each one that protects the data at least as well as this agreement.

Infrastructure:

  • Amazon Web Services (AWS)

    What they do for us
    Hosts the service and its databases. Sends email (Amazon SES). Creates PDF score reports (AWS Lambda).
    Data involved
    All service data, including account, student and exam data.
    Where
    Australia (Sydney)

  • Bunny.net

    What they do for us
    Stores and delivers uploaded files, such as test audio, pictures and Speaking recordings.
    Data involved
    Uploaded files and Speaking recordings.
    Where
    Singapore, with delivery from servers worldwide

  • Cloudflare

    What they do for us
    Runs our domain names, protects the service from attacks and routes traffic, including to centres' own web addresses. Provides some AI speech features (see below) and the spam check on website forms.
    Data involved
    Traffic passing to and from the service, including IP addresses.
    Where
    Worldwide

  • Sentry

    What they do for us
    Error reports, so we can find and fix faults. Set up to remove names, emails, passwords, answers and other personal details before a report is sent.
    Data involved
    Technical details of the error and internal ID numbers only.
    Where
    United States

  • Alpha SMS

    What they do for us
    Sends text messages, such as absence alerts, fee reminders and notices, when a centre uses SMS.
    Data involved
    Mobile number and the message text.
    Where
    Bangladesh

AI providers. Some of them are in China and the United States. If you need certain providers avoided, contact us before you add students.

  • DeepSeek

    What they do for us
    Suggests Writing and Speaking bands and helps run the AI Speaking examiner. Also drafts text in the centre website builder.
    Data involved
    Essay text, Speaking transcripts and question text. Transcripts can include a name the candidate says aloud.
    Where
    China

  • OpenAI

    What they do for us
    Helps assess pronunciation in Speaking.
    Data involved
    Recordings of a candidate's Speaking answers.
    Where
    United States

  • Google (Gemini)

    What they do for us
    Helps assess pronunciation in Speaking.
    Data involved
    Recordings of a candidate's Speaking answers and the question text.
    Where
    United States

  • Soniox

    What they do for us
    Turns a candidate's spoken answers into text during Speaking.
    Data involved
    Live Speaking audio, plus the candidate's name and nationality and the test questions, to recognise words more accurately.
    Where
    United States

  • ElevenLabs

    What they do for us
    Gives the AI Speaking examiner its voice.
    Data involved
    The examiner's lines as text, which can include a name the candidate gave.
    Where
    United States

  • Cloudflare (Workers AI) and TypeSafe

    What they do for us
    Helps the AI Speaking examiner decide what to ask next, so it does not repeat a question already answered. Writes transcripts of Listening audio that teachers upload.
    Data involved
    Speaking transcripts and question text. Teacher-uploaded audio.
    Where
    Worldwide (Cloudflare). Not published (TypeSafe).

  • Zhipu AI, MiniMax, and TypeSafe through Vercel AI Gateway

    What they do for us
    Draft and edit pages in the centre website builder.
    Data involved
    The centre's own website content and the instructions its staff type. No student exam data.
    Where
    China (Zhipu AI, MiniMax). United States (Vercel).

Payment providers. Stripe takes payments for our subscriptions. SSLCommerz, bKash and EPS are used only when you, or your agency, connect your own merchant account. For payments your students make to you through them, you choose and contract with that provider directly.

  • Stripe

    What they do for us
    Takes card payments for Institify subscriptions.
    Data involved
    Name, email, billing details and payment information. Card numbers go to Stripe, not to us.
    Where
    United States and worldwide

  • SSLCommerz

    What they do for us
    Bangladesh payment gateway (cards, bank and mobile wallets) that a centre or agency can connect to take payments.
    Data involved
    Payer's name, contact details, amount and payment reference.
    Where
    Bangladesh

  • bKash

    What they do for us
    Mobile wallet payments that an agency can connect to take payments.
    Data involved
    Payer's mobile number, amount and payment reference.
    Where
    Bangladesh

  • EPS (Easy Payment System)

    What they do for us
    Bangladesh payment gateway that a centre can connect to take payments from students and walk-in candidates.
    Data involved
    Payer's name, contact details, amount and payment reference.
    Where
    Bangladesh

We will tell you at least 30 days before we add or replace a sub-processor that handles your students' information, by email or in the service. If you have a reasonable objection on data protection grounds, tell us at [email protected] within that time. We will try to find a solution. If we cannot, you may end the affected part of the service and receive a refund of any prepaid fees for the remaining period.

We remain responsible to you for the work our sub-processors do.

7.International transfers

The service is hosted in Australia, files are stored in Singapore, and some sub-processors are in the United States, China and other countries. You agree that customer personal data may be transferred to these places for the purposes in this agreement.

Where data protection law requires safeguards for a transfer, we will put them in place, for example contract terms with the sub-processor.

8.Helping you meet your obligations

  • Requests from people. If a student or anyone else asks us directly to see, correct or delete their information, we will pass the request to you and not answer it ourselves unless you ask us to. The service lets you view and correct your students' records, and we will help with anything else, such as a copy or deletion.
  • Assessments. We will give you reasonable information to help with any data protection impact assessment or consultation with a regulator that relates to the service.

9.Personal data breaches

If we become aware of a personal data breach affecting customer personal data, we will tell you without undue delay, and in any case within 72 hours of becoming aware of it.

We will tell you what happened, what data and people are likely to be affected, what the likely consequences are, and what we have done or plan to do about it. If we do not know everything at first, we will send what we know and follow up.

We will take reasonable steps to contain the breach and limit the harm. Telling you about a breach is not an admission of fault.

10.Return and deletion of data

  • While your account is active, you can correct your students' records and download their results and score reports. Ask us if you need records deleted.
  • When the agreement ends, you can ask us for a copy of your customer personal data in a common format within 30 days.
  • We will delete customer personal data within 90 days after the agreement ends. Copies in backups are removed as the backups are replaced.
  • We may keep data longer only where the law requires it, and then only for that purpose, kept confidential.

11.Improving the service

You allow us to use customer personal data to check and improve the accuracy of AI marking, for example by comparing suggested bands with the bands your examiners gave. Any example we keep for this purpose has names and other identifying details removed first. We do not use customer personal data to train AI models, and we do not sell it.

12.Information and audits

On request, we will give you the information you reasonably need to show that we are keeping to this agreement, such as answers to a security questionnaire and a description of our measures.

If that is not enough, or a regulator requires it, you may audit our compliance once a year, with at least 30 days' notice, during business hours, in a way that does not disrupt the service or expose other customers' data. You pay your own costs. Any auditor must agree to keep what they learn confidential.

13.Liability and conflicts

The limits on liability in the Terms of Service apply to this agreement. If this agreement and the Terms of Service disagree about personal information, this agreement wins.

14.Governing law

This agreement is governed by the laws of Bangladesh, unless data protection law requires another law to apply.

15.Contact

For anything about this agreement, including objections to a sub-processor, requests for information and breach contacts: [email protected]. Institify, operated by Pxlhut, Bangladesh.

If your organisation needs a signed copy of this agreement, email us and we will send one.

Other legal pages