Data Protection Policy

1. Purpose

This Data Protection Policy describes how EDUJAC Technologies LLP protects the information processed through the EDUJAC School ERP & Management Platform, and the responsibilities of EDUJAC and subscribing schools.

2. Scope

This policy applies to all institutional and personal data processed through EDUJAC on behalf of subscribing schools, and to website enquiries submitted through our public site.

3. Data-protection principles

• Lawful, purpose-limited processing — data is processed to provide the school-management service and related legitimate purposes.
• Data minimization — the platform is designed to process the information needed for school operations, and no more.
• Accuracy — schools control and can correct their records; users are encouraged to keep information current.
• Storage limitation — information is retained only as long as reasonably necessary (see our Data Retention & Deletion Policy).
• Security and accountability — appropriate technical and organizational safeguards, described below.

4. School data

Schools retain rights and control over their institutional data — including student records, attendance, marks, report cards, parent information, teacher/staff information, fee records, timetables and leave records — subject to applicable law and contractual arrangements. EDUJAC does not claim ownership of school or student data merely because it is stored or processed through the platform.

5. Responsibilities

• EDUJAC: process institutional data on the school's instructions; maintain the safeguards described in this policy; support access, export, correction and deletion requests routed through schools.
• Schools: manage which staff receive accounts and roles; ensure authority/consents for the data they enter (including parental consent where required for children's data); keep credentials confidential; and use the platform's controls (for example, publishing report cards only when ready for parent viewing).

6. Children's data

Children's personal data is processed only for educational, academic, administrative, communication, safety and school-management purposes on the school's behalf. EDUJAC does not sell children's data, use it for targeted or behavioural advertising directed at children, or use it for unrelated commercial profiling.

7. Data minimization

Forms and records are scoped to operational needs; users should avoid entering unnecessary personal information, including in free-text fields and AI prompts.

8. Data accuracy

Schools and authorized users can update records in the platform at any time, keeping institutional data accurate and current.

9. Access controls and role-based authorization

Access is governed by role-based authorization: super administrators (platform operations), school administrators, teachers (limited to their assigned classes) and parents (limited to their own children). Each school's data is isolated from other schools, and parents can only access records published for their own children — draft examination marks remain internal until a school publishes them.

10. Authentication

Access requires an individual account. API access uses signed, token-based authentication (JSON Web Tokens).

11. Password protection

Passwords are hashed using bcrypt and are never stored in plain text. Password-reset links are single-use, stored only in hashed form, expire after a short period (currently 15 minutes), and existing sessions are invalidated when a password is changed.

12. Transmission security

All traffic between users and the platform is protected using HTTPS/TLS encryption in transit.

13. Internal access restrictions

Access to production systems and data by EDUJAC personnel is intended to be limited to operational necessity (for example, support or incident response) and handled under appropriate confidentiality obligations.

14. Third-party service providers

EDUJAC may use service providers for hosting and cloud infrastructure, email delivery, SMS/WhatsApp notification delivery, payment processing, AI-assisted functionality, security/monitoring and technical support. Providers process information only as needed to provide their services and under their own applicable terms and privacy practices.

15. Data retention and deletion

Retention follows our Data Retention & Deletion Policy: information is kept only for the period reasonably necessary for the specified purpose, service delivery, contractual obligations, security, dispute resolution and applicable legal requirements, after which it may be securely deleted or anonymized.

16. School data export

Schools can export several record types directly from the platform (PDF/CSV/Excel) and may request a broader export of institutional data as provided in the applicable agreement and within technical capabilities.

17. Subscription termination

On termination, an appropriate export mechanism or period may be provided per the applicable agreement; thereafter data may be securely deleted or anonymized unless retention is legally, contractually or otherwise required.

18. Backups and recovery

EDUJAC maintains backup and recovery safeguards appropriate to the service as part of its cloud infrastructure, at a level designed to support service continuity.

19. Security incident management

If a personal-data security incident is identified, EDUJAC will take reasonable steps to investigate, contain, mitigate, secure affected systems, preserve appropriate records, cooperate with affected schools, and make notifications required under applicable law.

20. Cross-border processing

Some providers may use infrastructure outside India; where cross-border processing occurs, EDUJAC intends to follow applicable Indian legal requirements and government restrictions.

21. Requests and grievance redressal

Data-protection requests may be submitted using the contact details below; requests about school-controlled records may be coordinated with the relevant school. Grievances are reviewed and answered in accordance with applicable law.

22. Policy review

This policy is reviewed and updated as the platform and applicable law evolve; the "Last updated" date reflects the current version.