Privacy Policy

1. Introduction

Komplex Studio ("we", "us", or "our") operates the Shiksha School Management System (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting the privacy of students, parents, teachers, and administrators who use our platform. This policy is designed to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act), Information Technology Act, 2000, and other applicable Indian data protection laws.

2. Data Fiduciary Information

Under the DPDP Act, 2023, Komplex Studio acts as a "Data Fiduciary" for the personal data processed through the Service. The educational institution (Subscriber) may also act as a Data Fiduciary for certain processing activities.

3. Information We Collect

3.1 Information Provided by Schools (Subscribers)

• School/institution name, address, and contact details
• Administrator account information (name, email, phone)
• Billing and payment information
• School logo and branding materials

3.2 Student Personal Data

• Full name, date of birth, gender
• Admission number and roll number
• Parent/guardian names and contact information
• Address and emergency contact details
• Photograph (for ID cards and records)
• Previous school information
• Medical information (allergies, blood group) - if provided
• Aadhaar number (optional, only if provided by school)

3.3 Academic and Administrative Data

• Attendance records
• Examination results and grades
• Fee payment history
• Class and section assignments
• Teacher assignments and evaluations

3.4 Staff/Teacher Data

• Name, contact details, and address
• Employment information (department, designation, salary)
• Qualifications and experience
• Bank account details (for salary processing)
• PAN, Aadhaar (as required for compliance)

3.5 Automatically Collected Information

• Device information (browser type, operating system)
• IP address and approximate location
• Usage data and access logs
• Cookies and similar tracking technologies

4. Legal Basis for Processing

Under the DPDP Act, 2023, we process personal data based on the following lawful grounds:

• Consent: When you or your institution explicitly agrees to data processing
• Contractual Necessity: Processing necessary to fulfill our service agreement
• Legal Obligation: Compliance with applicable laws and regulations
• Legitimate Uses: As specified under the DPDP Act for specific purposes

5. Purpose of Data Processing

We use the collected information for the following purposes:

• Providing and maintaining the school management services
• Managing student admissions, attendance, and academic records
• Processing fee collections and generating invoices
• Facilitating communication between schools, parents, and teachers
• Generating reports and analytics for educational improvement
• Sending notifications via WhatsApp, SMS, or email
• Processing subscription payments
• Providing customer support and technical assistance
• Improving our Service based on usage patterns
• Complying with legal obligations and government requests

6. Children's Data Protection

Our Service processes data of children (students under 18 years) as part of educational administration. In compliance with the DPDP Act, 2023:

• We process children's data only with verifiable parental/guardian consent obtained through the educational institution
• We do not engage in tracking or behavioral monitoring of children for advertising purposes
• We do not process children's data in any manner that could cause harm to their well-being
• Schools are responsible for obtaining appropriate consent from parents/guardians
• Parents/guardians may request access to, correction of, or deletion of their child's data through the school

7. Data Sharing and Disclosure

7.1 We Do NOT:

• Sell personal data to third parties
• Share student data with advertisers or marketing companies
• Use student data for targeted advertising
• Share data with third parties for their own purposes without consent

7.2 We May Share Data With:

• Service Providers: Trusted partners who assist in providing our services (cloud hosting, payment processing, communication services)
• Payment Processors: Razorpay for processing subscription and fee payments
• Communication Services: WhatsApp Business API providers for notification delivery
• Legal Authorities: When required by law, court order, or government directive
• Business Transfers: In connection with merger, acquisition, or sale of assets (with prior notice)

8. Data Storage and Security

8.1 Storage Location

Your data is stored on secure servers provided by Supabase (cloud infrastructure). Data may be stored in servers located in India or other jurisdictions with adequate data protection standards.

8.2 Security Measures

We implement reasonable security practices as required under the IT (Reasonable Security Practices) Rules, 2011:

• Encryption of data in transit (TLS/SSL) and at rest
• Role-based access control (RBAC)
• Regular security audits and vulnerability assessments
• Automated daily backups with encrypted storage
• Multi-factor authentication options
• Activity logging and audit trails
• Employee training on data protection

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Active Subscription: Data retained throughout the subscription period
• After Termination: 30 days to export data, then deletion within 90 days
• Payment Records: Retained for 7 years as required by tax laws
• Audit Logs: Retained for 1 year for security purposes

Schools may request immediate deletion of data upon subscription termination, subject to legal retention requirements.

10. Your Rights Under DPDP Act, 2023

As a Data Principal under the DPDP Act, you have the following rights:

• Right to Access: Request information about your personal data being processed
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal obligations)
• Right to Withdraw Consent: Withdraw previously given consent at any time
• Right to Grievance Redressal: Lodge complaints regarding data processing
• Right to Nominate: Nominate another person to exercise rights on your behalf

10.1 How to Exercise Your Rights

To exercise any of these rights:

• Contact your school administrator for student/parent data requests
• Email privacy@komplexstudio.com for direct requests to Komplex Studio
• We will respond to requests within 30 days as required by law

11. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain your login session (essential cookies)
• Remember your preferences (functional cookies)
• Analyze usage patterns to improve the Service (analytics cookies)

You can control cookies through your browser settings. Disabling essential cookies may affect Service functionality.

12. Third-Party Services

Our Service integrates with the following third-party services:

• Supabase: Database and authentication services
• Razorpay: Payment processing (PCI-DSS compliant)
• WhatsApp Business API: Messaging services

These services have their own privacy policies, and we encourage you to review them.

13. Cross-Border Data Transfer

Your data may be transferred to and processed in countries other than India. When such transfers occur, we ensure:

• Transfers comply with DPDP Act requirements
• Adequate safeguards are in place (contractual clauses, certifications)
• Data is not transferred to countries notified by the Indian government as restricted

14. Grievance Redressal

In accordance with the IT Act, 2000 and DPDP Act, 2023, we have appointed a Grievance Officer to address your concerns:

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India once established under the DPDP Act.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be:

• Posted on this page with an updated "Last updated" date
• Communicated via email for material changes
• Effective 30 days after posting (unless immediate change is required by law)

16. Contact Us

For any questions or concerns about this Privacy Policy or our data practices, please contact us:

17. Consent

By using the Shiksha School Management System, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you are using the Service on behalf of an educational institution, you confirm that you have the authority to consent on behalf of that institution and its users.