Privacy policy

Who is responsible for what

For a student's school records, the institution decides why and how the data is processed. Under the Digital Personal Data Protection Act 2023 the institution is the Data Fiduciary, and Edustians is a processor acting on its documented instructions. If you are a parent or a student and want a record changed or erased, your school is the right place to start, and we will help them do it.

For an Edustians account that exists outside any institution — a parent's own platform account, and anything a family buys directly from us — Edustians is the Data Fiduciary.

Edustians is operated by [YOUR LEGAL ENTITY NAME], [CIN], registered at [YOUR REGISTERED ADDRESS].

What we process

Broadly, four kinds of data, and no more than the product needs to work:

• Identity and contact: name, email address, phone number, and the relationship between a parent and a child.
• School records, on behalf of the institution: enrolment, attendance, marks, fees, documents, transport and photographs.
• Usage of the learning features: which topics a learner has practised and how they answered, used to choose what to show next.
• Technical records: IP address, device and browser, and a log of significant actions — who did what and when — kept because a school records system without an audit trail is not a record.

Children's data

Most of the people this system is about are children, and the Act treats their data more strictly. Consent for a child comes from a parent, is recorded per purpose with what the parent was told at the time, and can be withdrawn from the parent's own account at any time.

Withdrawal takes effect immediately and applies backwards: a photograph consent withdrawn today stops that child appearing in albums shared previously.

We do not carry out behavioural tracking or advertising directed at children. There is no advertising in this product at all, and none is planned.

Where it is held

In India, in the Mumbai region, including backups. Each institution's records are separated inside the database itself by row-level security, and the account the application connects with cannot override that separation.

Who we share it with

Only where the product cannot work otherwise, and never for their own purposes:

• Your school, for a student's own records — which is the point of the system.
• The payment aggregator your school uses, for a payment you make. We are never in the flow of funds.
• Communication providers, to deliver a message your school sends by WhatsApp, SMS or email.
• Our hosting provider, which stores the data in India on our instructions.

What we never do

• We do not sell personal data, and we do not share it with data brokers or advertising networks.
• We do not use a child's data to train machine-learning models.
• We do not place third-party analytics or advertising trackers on the pages a child or a parent uses.

How long we keep it

School records are kept for as long as the institution requires, and are governed by its own retention policy and by any statutory duty it has to keep them. Some records a school must retain for a set period, and an erasure request cannot override that — where that applies we will say so rather than quietly ignoring the request.

Technical logs are kept for [YOUR LOG RETENTION PERIOD]. An account closed by a parent is deleted within [YOUR ACCOUNT DELETION PERIOD], except where a record must be retained.

Your rights

Under the DPDP Act 2023 you may ask for:

• Access to the personal data we hold about you or your child, and a summary of how it is processed.
• Correction of anything inaccurate, and completion of anything incomplete.
• Erasure, where no legal duty requires the record to be kept.
• Withdrawal of a consent you gave, as easily as you gave it.
• To nominate someone to exercise these rights on your behalf if you are unable to.

How to ask

Write to privacy@edustians.com, or to the grievance officer named on our grievance page. We will acknowledge within [YOUR ACKNOWLEDGEMENT PERIOD] and respond within the period the Act requires.

If your request concerns a school record, we will route it to your institution and tell you that we have.

Changes

If we change this policy in a way that affects you, we will say so on this page and, where it matters, tell you directly rather than relying on you to notice.