Privacy Policy

This Privacy Policy applies to schoolsoftwareindia.com and the EduGradUP mobile/desktop applications (collectively, the "Platform"), operated by EduGradUP ERP Technologies (Proprietorship, GSTIN: 09BOVPY4539L1ZN, Registered Office: Azamgarh, Uttar Pradesh, India — hereafter "Company", "we", "us", or "EduGradUP").

This Policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000 (IT Act), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and other applicable Indian laws.

By using the Platform or providing your data, you agree to this Privacy Policy. If you do not agree, please do not use the Platform.

1. Definitions

• "Data Fiduciary" — EduGradUP ERP Technologies, which determines the purpose and means of data collection (DPDPA Section 2(i))
• "Data Principal" — the individual whose personal data is processed — school admin, teacher, parent, or student (DPDPA Section 2(j))
• "Data Processor" — any third party that processes data on our behalf (cloud hosting, SMS gateway, payment gateway)
• "Personal Data" — any data that can identify an individual — name, email, phone, address, Aadhaar (masked), photographs, etc.
• "Sensitive Personal Data" (SPDI) — passwords, financial information (bank account, UPI), biometric data, health records, and Aadhaar number
• "School" — any educational institution (school, college, coaching center) that registers on the EduGradUP Platform

2. Data Fiduciary Information (Who We Are)

Entity Name	EduGradUP ERP Technologies
Type	Proprietorship
GSTIN	09BOVPY4539L1ZN
Registered Office	Azamgarh, Uttar Pradesh, 276001, India
Website	schoolsoftwareindia.com
Support Email	[email protected]
Phone / WhatsApp	+91 96280 30291

3. What Data We Collect

A. School Registration Data

• School name, board (CBSE/ICSE/State), UDISE code, address, city, state, pin code
• Contact person (Principal/Admin) name, designation, email, mobile number
• Approximate student count and modules selected

B. Educational & Administrative Data (Entered by the School)

• Student Records: Name, class, section, roll number, date of birth, gender, blood group, religion, caste category, nationality, parent/guardian names, phone numbers, address, photographs, Aadhaar (last 4 digits only), previous school details, admission date
• Attendance Records: Daily attendance status (present/absent/late/half-day), date, time, marked-by
• Fee & Financial Data: Fee structures, payment records, receipt numbers, payment mode (UPI/cash/card/bank), outstanding amounts, concessions/discounts, GST details
• Examination Data: Exam schedules, marks/grades, report cards, rank lists, term results, co-scholastic grades
• Staff Data: Employee name, designation, department, qualification, experience, joining date, salary/payroll details, bank account (for salary processing), PAN, Aadhaar (masked), photograph
• Transport Data: Bus routes, stop names, vehicle details, driver/conductor information, student-to-route mapping
• Communication Records: SMS/WhatsApp messages sent, notifications, circular content, parent feedback

C. Automatically Collected Data (Technical)

• IP address, browser type & version, operating system, device type (mobile/desktop)
• Pages visited, features used, session duration, click patterns
• Referral source (Google search, direct, ad campaign)
• Error logs and crash reports (for debugging)

D. Third-Party Data

• Payment confirmation data from payment gateways (Razorpay/UPI) — transaction ID, amount, status
• SMS/WhatsApp delivery reports from messaging providers

4. Legal Basis for Data Collection

Under DPDPA 2023, we process data on the following lawful bases:

• Consent: Explicit consent is obtained during registration and platform use
• Contractual Necessity: To provide the service (to fulfill the subscription agreement)
• Legal Obligation: For tax (GST), accounting, and regulatory compliance
• Legitimate Interest: Platform security, fraud prevention, and service improvement (analytics) — provided this does not override the Data Principal's rights

5. How We Use Data

Purpose	Data Used
Core service delivery (ERP features)	Student, attendance, fees, exam, staff data
Account creation & authentication	Email, password (hashed), mobile, OTP
SMS/WhatsApp notifications	Mobile numbers, message content (attendance alerts, fee reminders)
Fee collection & invoicing	Fee amounts, GST, payment details, receipt generation
Report cards & certificates	Student name, marks, class, school logo
Customer support	Name, email, phone, issue description
Platform improvement (analytics)	Usage patterns, feature popularity (anonymized/aggregated)
Legal compliance	As required by applicable law — GST returns, audit trail
Marketing & communication	Email, phone (only with consent; opt-out available)

6. Data Security

We implement "reasonable security practices" in compliance with IT Act 2000 Section 43A and SPDI Rules 2011 Rule 8:

Technical Measures:

• SSL/TLS (HTTPS) — All data in transit remains 256-bit encrypted
• AES-256 Encryption at Rest — Sensitive fields such as Aadhaar, PAN, and bank account details are stored encrypted in the database
• Schema Isolation (Multi-Tenant Architecture) — Each school's data is isolated in a separate PostgreSQL schema. One school can never access another school's data, even in the event of an application-level bug
• Password Hashing — Passwords are stored hashed using the bcrypt/PBKDF2 algorithm; never stored in plain text
• Role-Based Access Control (RBAC) — Separate permissions for each role — School Admin, Teacher, Student, Parent
• Rate Limiting & DDoS Protection — Request throttling on API endpoints
• Audit Trails — A complete audit log is maintained for critical operations (marks edit, fee modification, attendance change), including who, what, and when

Organizational Measures:

• Daily Automated Backups — Encrypted backups at a geographically separate location
• Access Control — EduGradUP team members are given access on a minimum-necessary access principle
• Incident Response Plan — Defined response procedure in the event of a data breach
• Secure Development Practices — OWASP Top 10 compliance, code reviews, dependency scanning

Disclaimer: No security system is 100% impenetrable. We take reasonable measures, but cannot guarantee absolute security. See Section 12 for what happens in the event of a data breach.

7. Data Sharing & Third-Party Disclosure

We do not sell, rent, or trade your personal data to any third party. Data is shared only in the following limited circumstances:

Third Party	Data Shared	Purpose	Safeguard
Cloud Hosting Provider (AWS Mumbai Region)	All platform data	Infrastructure / Hosting	Data Processing Agreement; AWS SOC-2 certified; data stays in India
SMS Gateway (MSG91 / similar)	Mobile numbers, message text	Attendance alerts, fee reminders	Contractual data protection obligations
WhatsApp Business API Provider	Mobile numbers, message content	Notifications, parent communication	Meta Business compliance; end-to-end encryption
Payment Gateway (Razorpay / similar)	Transaction amount, order ID	Payment processing (UPI, card, netbanking)	PCI-DSS Level 1 certified; RBI guidelines compliant
Email Service Provider	Email address, email content	Transactional emails, OTP, receipts	Data Processing Agreement
Analytics (Google Analytics)	IP (anonymized), device, pages visited	Website usage analysis	IP anonymization enabled; no PII shared
Law Enforcement / Government	As required by law	Legal compliance	Only on valid court order, warrant, or statutory requirement

All third-party Data Processors are bound by contractual obligations to use data only for the specified purpose and to implement adequate security measures.

8. Data Retention & Deletion

Data Category	Retention Period	After Retention
Active subscription data	Duration of subscription	See below
Post-cancellation data	90 calendar days after subscription end	Permanently deleted (database + backups)
Financial/tax records (invoices, GST)	8 years (as per GST Act & Companies Act)	Archived, then deleted
Audit trail / security logs	2 years	Purged
Marketing communication consent	Until consent withdrawn	Immediately deleted
Support tickets	3 years from resolution	Anonymized / deleted
Website analytics	26 months (Google Analytics default)	Auto-purged by Google

A school may request data export (CSV/Excel format) at any time during its subscription period or the 90-day grace period. Export requests are fulfilled within 72 hours.

9. Cross-Border Data Transfer

Primary hosting: All data is stored in the AWS Mumbai (ap-south-1) region — it stays within India.

Certain third-party services (Google Analytics, email delivery) may process data outside India. In such cases, compliance with DPDPA Section 16 and applicable regulations is ensured, including:

• Data Processing Agreements with Standard Contractual Clauses
• Adequacy decisions (where applicable)
• If the Central Government restricts transfer to any specific country, such transfers are stopped immediately

10. Children's Privacy

EduGradUP is a school management platform. Data of students (minors under 18) is stored under the authorization and responsibility of the school administration.

• We do not collect data directly from children
• The School Data Principal (school administration) is responsible for obtaining appropriate consent from parents/guardians (DPDPA Section 9)
• Student data is used only for educational and administrative purposes
• Student data is never used for advertising, profiling, or marketing
• Student data can be deleted/exported at a parent/guardian's request (through the school admin)

11. Cookies & Tracking Technologies

Essential Cookies (always active):

• Session cookie — To maintain the login session (expires on browser close)
• CSRF token — Security — to protect form submissions
• JWT token — API authentication (expires in 24 hours)

Analytics Cookies (optional):

• Google Analytics (_ga, _gid) — To track website usage patterns (anonymized IP)

You can disable non-essential cookies through your browser settings. Disabling essential cookies will prevent login and core features from working.

12. Data Breach Notification

In accordance with IT Act 2000 Section 43A and DPDPA 2023 Section 8(6), in the event of a data breach:

• The Data Protection Board of India (DPBI) will be notified within 72 hours of discovery of the breach
• Affected Data Principals (schools, users) will be informed of the nature, scope, and remedial steps of the breach via email/WhatsApp
• A breach investigation report will be maintained
• Remedial measures (password resets, enhanced monitoring) will be implemented immediately

13. Your Rights (Under DPDPA 2023 & IT Act)

You have the following rights over your personal data:

• Right to Access (DPDPA Section 11) — The right to view your stored data. Response within 30 days of request
• Right to Correction (DPDPA Section 11) — The right to have incorrect, incomplete, or outdated data corrected
• Right to Erasure (DPDPA Section 12) — The right to have data deleted, subject to legal retention obligations
• Right to Data Portability — The right to download your data in a structured, machine-readable format (CSV/Excel)
• Right to Withdraw Consent — The right to withdraw consent at any time. Processing carried out before withdrawal will remain lawful
• Right to Nominate (DPDPA Section 14) — The right to designate a nominee in the event of death or incapacity
• Right to Grievance Redressal (DPDPA Section 13) — The right to file a complaint with the Data Fiduciary, and if unsatisfied, with the Data Protection Board of India (DPBI)

To exercise your rights, email [email protected] or message us on WhatsApp (+91 96280 30291). We will respond within 30 days.

14. Grievance Officer

In compliance with the IT (Intermediary Guidelines) Rules, 2021 Rule 4 and DPDPA 2023, the following person has been appointed as Grievance Officer:

Name	Vinod Kumar Yadav
Designation	Founder & Grievance Officer
Email	[email protected]
Phone / WhatsApp	+91 96280 30291
Response Time	Acknowledgment within 24 hours; resolution within 30 days
Address	EduGradUP ERP Technologies, Azamgarh, Uttar Pradesh, 276001, India

If you do not receive a satisfactory response from the Grievance Officer, you may file a complaint with the Data Protection Board of India (DPBI).

15. Changes to This Policy

• We may update this Privacy Policy from time to time
• Material changes will be communicated to all registered schools via email and WhatsApp notification, at least 15 days in advance
• The "Last updated" date on this page will be kept current
• Continued use after an updated policy constitutes acceptance of the updated policy

16. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of the Republic of India, including:

• Digital Personal Data Protection Act, 2023 (DPDPA)
• Information Technology Act, 2000 (and amendments)
• IT (Reasonable Security Practices) Rules, 2011 (SPDI Rules)
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
• Consumer Protection Act, 2019

The competent courts of Azamgarh, Uttar Pradesh, India shall have exclusive jurisdiction over any dispute.

17. Contact Us

For any privacy-related question, request, or complaint:

• 📧 Email: [email protected]
• 📧 Grievance: [email protected]
• 📞 Phone: +91 96280 30291
• 💬 WhatsApp: Chat Now
• 📍 Address: EduGradUP ERP Technologies, Azamgarh, Uttar Pradesh, 276001, India