Your family's trust matters to us. This Privacy Policy explains, in plain language, what personal information we hold about students and parents/guardians, why we hold it, and the choices and rights you have. We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023.
1. Who we are
Suryodya Senior Secondary School ("the School", "we", "us", "our") operates the school and this website. We are the Data Fiduciary responsible for the personal data described in this policy.
2. The personal data we collect
We collect only what we need to run the school, teach and care for students, and meet our legal and regulatory duties. Depending on your relationship with us, this may include:
| Category | Examples |
|---|---|
| Student identity | Name, date of birth, gender, photograph, admission number, class/section, roll number. |
| Family & contact | Parent/guardian names, mobile numbers, email, residential address, relationship to the child. |
| Statutory / KYC | Aadhaar number of the child and parents (where required for admission/benefits), caste and religion (where declared for statutory reporting), category. |
| Academic | Marks, exam results, attendance, homework, teacher remarks, previous school records / transfer certificate. |
| Financial | Fee records, concessions, receipts, and — for staff — salary and bank account details. |
| Transport & medical | Bus route/stop, and any medical or first-aid information you choose to share for the child's safety. |
| Technical | A secure session cookie, and basic security logs (IP address, time of login) used only to protect accounts. See our Cookie Policy. |
3. Why we use your data (purposes)
- Admission & enrolment — processing applications and maintaining student records.
- Education & welfare — teaching, assessment, attendance, reports, and the health, safety and pastoral care of students.
- Communication — contacting parents/guardians about their child, school notices, results and events.
- Fees & administration — billing, receipts, concessions and day-to-day school administration.
- Transport safety — organising and tracking school transport.
- Legal & regulatory — statutory reporting, affiliation/board requirements, and responding to lawful requests.
- Security — protecting our systems and detecting misuse.
We do not use children's data for advertising, behavioural tracking, or profiling, and we do not sell personal data to anyone.
4. Our legal basis
Under the DPDP Act we rely on:
- Consent — the free, informed and specific consent of the parent/guardian (given at admission and renewable), and of staff for their own data.
- Certain legitimate uses permitted by the Act — for example, meeting a legal obligation, or acting to protect a person's safety in an emergency.
Where we ask for consent, we make clear what it is for, and you may withdraw it at any time (see Section 10).
5. Children's data & verifiable parental consent
Because most of the individuals we serve are under 18, the DPDP Act gives them special protection. For a child's data we obtain the verifiable consent of a parent or lawful guardian before processing, and we:
- do not carry out tracking, behavioural monitoring or targeted advertising directed at children;
- do not process a child's data in a way likely to cause harm to the child;
- collect only what is necessary for education and welfare.
Full details are in our Children's Data & Parental Consent Notice.
7. How we protect your data
We apply reasonable technical and organisational safeguards, and follow a principle of "security by design". These include:
- encrypted connections (HTTPS) and hardened server configuration;
- passwords stored only in hashed form, session timeouts, and login-audit logging;
- role-based access so staff see only the data their role requires;
- protection of the most sensitive fields (such as Aadhaar and bank details) and encrypted, off-site backups;
- staff awareness of their data-protection responsibilities.
No system is perfectly secure, but we work continuously to reduce risk. If a personal-data breach occurs, we will act on our breach-response process and notify the Data Protection Board of India and affected individuals as required by law.
8. How long we keep it
We keep personal data only for as long as we need it for the purposes above, or as required by law. As a general rule we retain a student's academic and admission records for approximately 8 years after the student leaves, after which records are securely deleted or anonymised, unless a longer period is required by statute (e.g. certain financial records). We regularly review and purge data we no longer need.
9. Your rights
As a Data Principal (or, for a child, the parent/guardian acting on their behalf) you have the following rights under the DPDP Act:
Know what personal data we hold about you or your child, and how we use and share it.
Ask us to correct inaccurate data or complete incomplete data.
Ask us to erase personal data that is no longer needed, subject to legal retention duties.
Raise a concern with our Grievance Officer and receive a timely response.
Nominate another person to exercise your rights in the event of death or incapacity.
Withdraw consent for processing that relies on it, at any time.
To exercise any right, contact us using Section 12 / our Grievance page. We may need to verify your identity and relationship to the student before acting.
10. Withdrawing consent
Where we rely on your consent, you can withdraw it at any time by contacting the school office or our Grievance Officer. Withdrawal does not affect processing already carried out, and some data may need to be retained where the law requires it or where it is necessary to continue the child's education and safety.
12. Grievance / Data-Protection Officer
If you have a question, concern or complaint about how we handle personal data, please contact:
If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India. Our full grievance process is on the Grievance & Data Rights page.
13. Changes to this policy
We may update this policy from time to time. The "Last updated" date and version at the top of the page show when it last changed. Where changes are material, we will take reasonable steps to inform parents/guardians.