Student & Children's Data Policy

1. Why this is separate

The Digital Personal Data Protection Act, 2023 treats a child's data differently from an adult's, and a school ERP is almost entirely children's data. Rather than scatter that through the Privacy Policy, the rules that follow from it are gathered here.

2. Consent

Consent for processing a child's personal data must come from a parent or lawful guardian. The school obtains it — at admission, in the form the school uses — and is responsible for holding it. We process the data on the strength of the school's instruction that it holds that consent.

A school should be able to show, for any student in the system, that a parent or guardian consented to the school holding that information.

3. What is prohibited outright

None of these are things the platform does, and none are things we will build. There is no advertising in SchoolERP, no analytics profile is constructed about a student, and no student's data leaves the school's tenancy for any purpose of ours.

• Behavioural tracking or profiling of a child.
• Targeted advertising directed at a child.
• Any processing likely to cause a detrimental effect on a child's wellbeing.

4. Photographs and biometrics

A student photograph is held only for identification within the school's own records — an ID card, a class list, an admission record. It is not published anywhere by the platform.

The platform does not collect biometric data. If a school wishes to integrate a biometric attendance device, that is a separate arrangement requiring its own consent and its own assessment; nothing in the standard subscription covers it.

5. What a parent can see

A parent account can see its own children and nothing else — attendance, results, fee records, homework, and the school's announcements. It cannot see another family's records, another class's marks, or any staff record.

6. When a student leaves

A student's record is retained by the school for as long as the school needs it, which for academic and certificate purposes is usually years rather than months. The Data Retention & Deletion Policy sets out the defaults; a school may set a shorter period for its own records.

Contact details of a departed student's guardians should not be used for anything after they leave, and using them for marketing is prohibited by the Acceptable Use Policy.

7. Raising a concern

A parent with a concern about their child's data should raise it with the school first, since the school decides what is held. If that does not resolve it, the Grievance Redressal page sets out how to reach us directly.