Data Processing Terms
Effective: 18 October 2026. Qalamora is provided by ABT Dev Services, Lahore, Pakistan. The English text of this page prevails over any translation.
1. Scope
These Data Processing Terms form part of the agreement between the Customer and ABT Dev Services ("ABT") for Qalamora. They apply to personal data in Customer Data that ABT processes on the Customer's behalf ("School Personal Data"). Words defined in the Terms of Service have the same meaning here.
2. Roles and instructions
The Customer is the controller of School Personal Data and ABT is its processor. ABT processes School Personal Data only to provide the Service, on the Customer's documented instructions (the agreement, the settings the Customer chooses and requests made through the Service or support), unless the law requires otherwise, in which case ABT will tell the Customer first where the law allows.
Subject matter and duration: the Service, for the term of the agreement and the period in section 9. Nature and purpose: hosting, storage, backup, display, printing, messaging, support and security. Types of data: identity, contact, family, academic, attendance, fee, health notes, staff and payroll data, and files. Data subjects: students, guardians, staff and other Users.
3. People who process data
ABT gives access to School Personal Data only to staff and contractors who need it to provide the Service, who are bound by confidentiality and who are trained in data protection. Support access to a school account requires the school's grant, is time-limited and is recorded.
4. Security
ABT keeps technical and organisational measures appropriate to the risk, including: separation of each school's data; encryption of sensitive fields with a key unique to each school; HTTPS for all connections; hashed passwords and optional or required two-step sign-in; role-based permissions; audit logs of sensitive actions; signed, short-lived links for private files; regular backups; restricted and logged access to production systems; and timely security updates.
5. Sub-processors
The Customer authorises ABT to use sub-processors for hosting and backup, network security and content delivery, email delivery, PDF rendering and payment processing, and, only where the Customer uses those features, AI and OCR providers. ABT binds each sub-processor to data protection duties no less protective than these terms and remains responsible for them.
A current list is available on request. ABT will give at least 30 days' notice of a new sub-processor. If the Customer has a reasonable data protection objection that cannot be resolved, it may end the affected part of the Service and receive a refund of unused prepaid fees for it.
Services the Customer connects itself (its SMS, WhatsApp, cloud storage or payment accounts) are the Customer's own providers, not ABT's sub-processors.
6. AI and OCR
AI and OCR features are used only when the Customer chooses them. Requests are sent from queued jobs with sensitive fields removed, results go to a review area and nothing is saved until a person approves it. Where the provider allows, ABT uses settings under which the provider may not use the content to train its models.
7. Help with requests and duties
The Service lets the Customer view, correct, export and delete records. Where the Customer cannot do something itself, ABT will reasonably help it answer requests from data subjects and meet its duties on security, breach notification and impact assessments. ABT will pass to the Customer any request it receives directly about School Personal Data and will not answer it without the Customer's instruction.
8. Personal data breaches
ABT will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting School Personal Data. The notice will describe what happened, the data and people likely affected, the likely consequences and the measures taken or proposed, and ABT will update it as more becomes known.
9. Return and deletion
When the agreement ends, ABT returns and deletes School Personal Data as described in section 17 of the Terms of Service, unless the law requires it to be kept. On request, ABT will confirm deletion in writing.
10. Information and audits
ABT will provide information reasonably needed to show compliance with these terms, including answers to a security questionnaire once a year. Further audits may be agreed in writing at the Customer's cost, with reasonable notice, during working hours and without access to other customers' data.
11. Transfers
School Personal Data may be processed outside Pakistan by ABT's hosting providers and sub-processors. ABT will make sure such processing is protected as these terms require and, where the law of the Customer's country requires a particular transfer mechanism, will cooperate to put it in place.
12. Liability and precedence
Liability under these terms is subject to the limits in the Terms of Service. If these terms conflict with the Terms of Service on personal data, these terms prevail.