School ERP Privacy Notice

1. Who Is Responsible for Your Data

Your school decides what data is kept in the AsmaWebs School ERP and why. Your school is the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”).

AsmaWebs Private Limited provides and hosts the School ERP for your school. We are a “Data Processor”: we handle your data only on your school’s instructions and under a written agreement with it.

This notice explains how the School ERP handles data. Your school’s own privacy notice explains why it collects your data and how long it keeps it. Our website is covered separately by our Privacy Policy.

2. Data in the School ERP

The School ERP holds only what your school enters, depending on the modules it uses:

• Students: name, photo, date of birth, gender, class and section, roll and admission numbers, address, admission documents, attendance, homework, exam marks and results, and fee records.
• Parents and guardians: name, relationship to the student, phone number, email address, address, and fee payment records.
• Teachers and staff: name, photo, contact details, role, subjects and timetable, and attendance.
• Messages: notices and alerts your school sends through the School ERP, including by WhatsApp, SMS, or email.
• Technical data: login records, IP addresses, and activity logs, used to keep accounts secure.

3. How the Data Is Used

Data is used only to run the school services your school has chosen: admissions, student records, attendance, timetables, homework, exams and results, fees, staff management, school communication, parent and student portals, and reports for the school.

AsmaWebs does not sell this data, use it for advertising, or use it for any purpose of its own.

4. Children's Data

Most students are under 18. Your school is responsible for getting verifiable consent from a parent or guardian before processing a child’s data, except where the DPDP Act allows a school to process it for educational activities or for children’s safety without such consent.

The School ERP does not track or behaviourally monitor children, and it never shows them targeted advertising.

5. Who Can See the Data

• Your school’s authorised staff, according to the access your school gives them.
• Parents, guardians, and students, who can see their own records in the parent and student portals.
• AsmaWebs staff, only when needed to host, support, or fix the School ERP, under confidentiality obligations.
• Our service providers, which help us run the School ERP: cloud hosting (such as Amazon Web Services and DigitalOcean), Cloudflare for security and network delivery, Google for system emails, and WhatsApp and SMS providers for school messages. Each is bound by written terms that protect the data.
• Authorities, only where the law requires it. We will tell your school first unless the law forbids it.

6. How the Data Is Protected

Data is encrypted in transit using HTTPS and encrypted when stored. Passwords are kept only as one-way hashes that no one can read, and login tokens are encrypted and expire automatically. Access is limited by role, each school’s data is kept separate, data is backed up regularly, and access to it is logged.

If a data breach affects your data, we will inform your school within 24 hours of becoming aware of it. Your school will then inform you and the Data Protection Board of India as the DPDP Act requires.

7. How Long the Data Is Kept

Your school decides how long to keep records and can delete them at any time. If your school stops using the School ERP, we return its data to the school and delete it from our systems within 60 days, unless the law requires us to keep it longer.

8. Your Rights

Under the DPDP Act, you can ask to access, correct, complete, update, or erase your data, withdraw consent, nominate someone to act for you, and raise a grievance. For a child, a parent or guardian can make these requests.

Please send requests to your school, which is responsible for your data. If you contact us instead, we will pass your request to your school within 5 working days and help it respond.

9. Contact

For questions about your records, contact your school first. For questions about how AsmaWebs handles School ERP data, contact our Grievance Officer:

• Name: Taufik Alam, Grievance Officer
• Email: support@asmawebs.com
• Phone: +91 8340664726 (Mon to Sat, 10:00 AM to 7:00 PM IST)
• Address: AsmaWebs Private Limited, Okhla Phase-2, New Delhi, India - 110025