Privacy Policy

4.1 Account and Identity Data

• name, username, email address, phone number, photograph, role, and login credentials;
• authentication tokens, session identifiers, and multi-factor authentication records;
• user preferences, language settings, and notification preferences.

4.2 Institution and Configuration Data

• Institution name, branch details, academic structure, branding, subscription plan, and billing contact information;
• administrative settings, permissions, workflows, and module configuration.

4.3 Student and Academic Data

• admission, enrollment, attendance, timetable, examination, grading, report card, promotion, and disciplinary records;
• class, section, subject, teaching group, and academic performance information;
• parent or guardian contact details and communication history.

4.4 Staff and HR Data

• employment details, designation, department, payroll, leave, attendance, and performance records;
• bank or payment details where payroll or reimbursement features are used.

4.5 Financial Data

• fee structures, invoices, receipts, payment status, concessions, scholarships, and related billing records;
• transaction references from payment gateways where payments are processed through integrated services.

4.6 Communications and Support Data

• messages, notifications, announcements, emails, SMS, and in-app communications;
• support tickets, feedback, attachments, and call or chat records submitted to EduGet360.

4.7 Technical and Usage Data

• IP address, browser type, device identifiers, operating system, access logs, audit trails, and feature usage;
• error logs, diagnostics, and security event data.

4.8 Biometric and Device Data

• attendance punches, device identifiers, timestamps, and related metadata received from biometric or attendance devices;
• device configuration and connectivity data where ADMS or similar integrations are enabled.

4.9 AI-Related Data

prompts, inputs, and outputs where AI-powered features are used, subject to Institution configuration and applicable safeguards.

5.1 Institution Entry

Most Institution Data is entered directly by authorized Institution Users, imported through bulk uploads, or synchronized from approved third-party systems.

5.2 User Activity on the Platform

When Users access the Platform, certain technical and usage data is automatically generated through logs, cookies, and security monitoring.

5.3 Integrations and Devices

Personal Data may be received from integrated services such as payment gateways, messaging providers, identity providers, biometric attendance devices, and API-connected systems configured by the Institution.

5.4 Communications with EduGet360

Personal Data may be collected when you contact support, request a demo, subscribe to updates, or otherwise communicate with EduGet360.

5.5 Institution Responsibility for Collection

Where an Institution is the Data Fiduciary, the Institution is responsible for ensuring that Personal Data is collected lawfully and with all required notices and consents before it is entered into the Platform.

7.1 Role of EduGet360 and Institutions

For most Institution Data relating to students, parents, staff, and other members of an Institution community, the Institution acts as the Data Fiduciary and EduGet360 acts as a Data Processor processing such data on the Institution's documented instructions.

For certain data relating to EduGet360's own business operations, such as sales inquiries, account administration, billing, and platform security, EduGet360 may act as a Data Fiduciary.

7.2 Lawful Processing

Personal Data is processed only where permitted under Applicable Law, including where:

• the Data Principal has given valid consent;
• processing is necessary for the performance of a contract or provision of requested Services;
• processing is necessary for compliance with legal obligations;
• processing is for a legitimate use permitted under the DPDP Act; or
• processing is otherwise permitted by Applicable Law.

7.3 Consent

Where processing is based on consent, the Institution is generally responsible for obtaining, recording, and managing consent from Data Principals, including parents or guardians for children's data.

7.4 Notice

Institutions are responsible for providing appropriate privacy notices to Data Principals. EduGet360 provides this Privacy Policy to describe its own processing activities and technical role.

7.5 Data Protection by Design

EduGet360 implements technical and organizational measures designed to support privacy, tenant isolation, access control, and secure processing across the Platform.

7.6 Cross-Border Transfers

Personal Data may be processed on infrastructure located in India or, where applicable, in other jurisdictions used by subprocessors. Where Personal Data is transferred outside India, EduGet360 takes steps to ensure appropriate safeguards as required by Applicable Law.

8.1 Within the Institution

Personal Data may be accessible to authorized Users of the subscribing Institution based on role-based permissions configured by the Institution.

8.2 Service Providers and Subprocessors

EduGet360 may engage infrastructure providers, hosting services, email and messaging providers, analytics tools, payment processors, and other subprocessors that process Personal Data on our behalf under contractual safeguards and data processing terms.

8.3 Integrations Enabled by the Institution

Where an Institution enables third-party integrations, Personal Data may be shared with those services according to the Institution's configuration and the third party's terms.

8.4 Legal and Security Requirements

Personal Data may be disclosed where required by Applicable Law, court order, regulatory request, or to protect the rights, safety, and security of EduGet360, Institutions, Users, or others.

8.5 Business Transfers

In connection with a merger, acquisition, restructuring, or sale of assets, Personal Data may be transferred subject to appropriate confidentiality and continuity protections.

8.6 Aggregated or De-identified Data

EduGet360 may use aggregated or de-identified information that does not identify individuals for analytics, service improvement, and reporting.

9.1 Multi-Tenant Architecture

The Platform uses a multi-tenant architecture designed to logically separate Institution Data by tenant. Institutions are assigned isolated environments within the shared Platform infrastructure.

9.2 Storage Location

Unless otherwise agreed in writing, Personal Data is primarily stored and processed in India. Backup, disaster recovery, support, or subprocessors may involve processing in other locations subject to appropriate safeguards.

9.3 Institution Control

Institutions control much of the data entered into the Platform, including what categories of Personal Data are collected, which modules are enabled, and which integrations are activated.

9.4 Availability and Backup

EduGet360 maintains backup and recovery practices intended to support data availability and resilience, subject to the Institution's subscription terms and technical configuration.

12.1 Institution-Initiated Deletion

Authorized Institution Users may delete or update certain records through the Platform where permissions allow. Institutions may also request bulk deletion or account closure through contractual support channels.

12.2 Processor Deletion

Where EduGet360 acts as a Data Processor, deletion of Institution Data will generally be performed upon the lawful instruction of the Institution or as required by Applicable Law and the applicable subscription agreement.

12.3 Residual Data

Deleted data may persist for a limited period in backups, logs, or disaster recovery systems before being overwritten in the ordinary course of operations.

12.4 Legal Exceptions

Deletion requests may be declined or limited where retention is required for legal compliance, fraud prevention, security investigations, dispute resolution, or protection of the rights of others.

15.1 Institution Control

AI features may be optional or configurable at the Institution level. Institutions are responsible for determining whether and how AI features are used within their organization.

15.2 Inputs and Outputs

AI features may process prompts, institutional records, or other inputs provided by authorized Users to generate outputs. Institutions and Users should avoid submitting Personal Data into AI features unless necessary and permitted.

15.3 Human Review

AI-generated outputs are provided for assistance only. Institutions remain responsible for reviewing outputs before relying on them for academic, administrative, employment, financial, or disciplinary decisions.

15.4 Limitations

AI outputs may be incomplete, inaccurate, or inappropriate. EduGet360 does not guarantee the accuracy, legality, or suitability of AI-generated content.

15.5 Third-Party AI Providers

Where AI capabilities are delivered through third-party providers, Personal Data may be processed by those providers in accordance with applicable contractual and technical safeguards.

16.1 Nature of Integration

EduGet360 receives attendance events, timestamps, device identifiers, and related metadata transmitted by biometric or attendance devices configured by the Institution. EduGet360 does not directly operate or control biometric hardware.

16.2 Institution Responsibility

Institutions are responsible for device procurement, installation, maintenance, enrollment, legal compliance, notices, consents, and verification of attendance records obtained through biometric systems.

16.3 Data Accuracy Disclaimer

EduGet360 depends on data transmitted by biometric devices and Institution systems. EduGet360 does not control device calibration, enrollment quality, network conditions, or capture accuracy and is not liable for inaccuracies, omissions, duplicates, or delays in biometric attendance data.

16.4 Lawful Use

Institutions must ensure that biometric processing complies with Applicable Law, including any requirements relating to notice, consent, storage limitations, and purpose limitation for biometric information.

16.5 Security

Biometric and attendance data is processed using the Platform's security controls, but Institutions must also secure devices, networks, and local environments connected to such systems.

17.1 Right to Access

Data Principals may have the right to request access to Personal Data processed about them, subject to Applicable Law.

Requests should generally be submitted to the Institution responsible for the collection and management of the Personal Data.

17.2 Right to Correction

Where Personal Data is inaccurate, incomplete, or outdated, Data Principals may request correction through the Institution.

EduGet360 provides technical capabilities that enable authorized users of the Institution to update information where permitted by the Institution's configured permissions.

17.3 Right to Erasure

Where permitted by Applicable Law and subject to applicable retention requirements, Data Principals may request deletion of their Personal Data.

As the Data Processor, EduGet360 will process deletion requests only upon the lawful instruction of the Institution or where otherwise required by Applicable Law.

17.4 Right to Withdraw Consent

Where processing is based upon consent obtained by the Institution, Data Principals may withdraw such consent by contacting the Institution.

Withdrawal of consent may affect the Institution's ability to provide educational or administrative services.

EduGet360 is not responsible for determining the legal consequences of consent withdrawal within the Institution.

17.5 Right to Grievance Redressal

Data Principals may raise concerns regarding the processing of their Personal Data with the Institution.

Where concerns relate specifically to EduGet360's processing activities, users may also contact EduGet360 using the contact information provided in this Privacy Policy.

17.6 Verification of Requests

To protect Personal Data and prevent unauthorized disclosures, EduGet360 and the Institution may require reasonable verification of identity before processing privacy-related requests.

Requests submitted by unauthorized persons may be declined.

17.7 Response Time

EduGet360 will provide reasonable assistance to Institutions in responding to valid privacy requests within commercially reasonable timeframes, subject to:

• technical feasibility;
• Applicable Law;
• contractual obligations;
• identity verification; and
• operational limitations.

17.8 Limitations

Certain requests may be refused or restricted where permitted by Applicable Law, including where processing is necessary for:

• legal compliance;
• fraud prevention;
• security investigations;
• contractual obligations;
• establishment or defense of legal claims;
• protection of the rights of other individuals; or
• other lawful purposes.

17.9 Requests Submitted Directly to EduGet360

Where EduGet360 receives a privacy request directly from a student, parent, guardian, employee, or other Data Principal concerning Institution Data, EduGet360 may:

• redirect the request to the Institution;
• notify the Institution of the request where appropriate;
• request additional verification; or
• respond directly where required by Applicable Law.

As the Institution is the Data Fiduciary, EduGet360 generally cannot modify, delete, or disclose Institution Data without the Institution's authorization.

18.1 Compliance

• complying with Applicable Law;
• obtaining all required consents;
• providing legally required privacy notices;
• maintaining internal privacy policies where applicable;
• complying with educational regulations and employment laws.

18.2 Data Quality

The Institution is responsible for ensuring that Personal Data entered into the Platform is:

• accurate;
• complete;
• current;
• relevant;
• lawfully obtained; and
• appropriate for the intended purpose.

18.3 User Management

The Institution is responsible for:

• creating user accounts;
• assigning permissions;
• disabling inactive accounts;
• reviewing access rights;
• protecting administrator accounts;
• preventing unauthorized account sharing.

18.4 Security

The Institution shall implement reasonable administrative and technical safeguards including:

• secure endpoint devices;
• antivirus protection;
• secure local networks;
• staff training;
• password management;
• physical security;
• internal approval processes.

18.5 Biometric Devices

Where biometric attendance systems are used, the Institution remains responsible for:

• device procurement;
• installation;
• maintenance;
• firmware updates;
• biometric enrollment;
• attendance verification;
• network connectivity;
• payroll approvals; and
• compliance with laws governing biometric information.

18.6 AI Usage

Where AI-powered functionality is enabled, the Institution remains responsible for:

• determining acceptable AI use;
• reviewing AI-generated outputs;
• preventing inappropriate disclosure of Personal Data;
• ensuring human review before significant decisions; and
• complying with Applicable Law.

18.7 Third-Party Integrations

The Institution is responsible for evaluating and approving any third-party integrations connected to the Platform, including payment gateways, messaging providers, biometric devices, identity providers, and other external services.

18.8 Responsibility for Decisions

EduGet360 does not make educational, financial, employment, disciplinary, or administrative decisions on behalf of Institutions.

All decisions relating to admissions, attendance approval, examinations, grading, payroll, fees, promotions, disciplinary proceedings, and institutional administration remain solely the responsibility of the Institution.

18.9 Biometric ADMS Data

Where the Platform integrates with biometric attendance devices through ADMS (Attendance Device Management System) or similar protocols, EduGet360 receives and processes attendance data as transmitted by such devices.

EduGet360 does not control device calibration, enrollment quality, or capture accuracy and relies upon data provided by the devices and the Institution. EduGet360 is not liable for inaccuracies, omissions, or delays in biometric attendance data.