Privacy Policy

1. Overview

Eduuis IT operates cloud-based School Enterprise Resource Planning (ERP) software under the brand name SERA, and a student safety application under the brand name SERA+. We act as a Data Fiduciary (as defined under the Digital Personal Data Protection Act, 2023) for data you provide to us directly, and as a Data Processor when we process data on behalf of schools (our clients).

We are committed to complying with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian privacy legislation.

2. Data We Collect

2.1 Information You Provide Directly

• Name, email address, phone number, and designation (demo booking, contact forms)
• School or institution name, address, and student strength
• Account credentials (username, hashed password) for SERA portal access
• Payment information (processed securely via Razorpay; we do not store card details)
• Communications you send us (support tickets, feedback, emails)

2.2 Student & Staff Data (Processed on Behalf of Schools)

When schools use SERA, they may upload personal data of students, parents, and staff including names, dates of birth, contact details, fee records, attendance, and academic information. This data is processed on the school's instruction and governed by our Data Processing Agreement with each school.

2.3 Automatically Collected Data

• IP address, browser type, operating system, and device identifiers
• Pages visited, time spent, and clickstream data (via analytics tools)
• Cookies and similar tracking technologies (see Section 5)

2.4 SERA+ Location and Device Data

The SERA+ application, with explicit consent from parent/guardian, may collect the GPS location of a student's device for safety features. This data is encrypted in transit and at rest, and is accessible only to the authorised parent/guardian account.

3. How We Use Your Data

We do not sell personal data to third parties. We do not use student data for advertising.

4. Data Sharing

We share personal data only in the following circumstances:

• With school administrators: Student and parent data is accessible to authorised staff of the school that manages the account.
• Service providers: We engage trusted sub-processors (e.g., AWS for cloud hosting, Razorpay for payments, Twilio for SMS OTPs) who are bound by data protection agreements.
• Legal requirements: We may disclose data if required by law, court order, or government authority under applicable Indian law.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity with prior notice.

5. Cookies & Tracking Technologies

Our website uses cookies and similar technologies:

• Essential cookies: Required for the website and application to function (cannot be disabled).
• Analytics cookies: Help us understand usage patterns (Google Analytics 4, in anonymised mode). You may opt out via your browser settings.
• Preference cookies: Remember your language or display preferences.

The SERA application does not serve third-party advertising cookies. You can manage cookie preferences through your browser settings.

6. Data Security

We implement industry-standard security measures including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Role-based access controls (RBAC) within the SERA platform
• Regular penetration testing and vulnerability assessments
• Multi-factor authentication for administrative accounts
• Data hosted on AWS data centres located in Mumbai (ap-south-1)

In the event of a data breach that poses a risk to your rights, we will notify you and, where required, the Data Protection Board of India, within 72 hours of becoming aware.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy, subject to the following:

• Active accounts: Data retained for the duration of the service contract plus 2 years.
• Student records: Retained per the school's retention policy; schools may export and delete their data at any time via the SERA admin panel.
• Marketing inquiries: Retained for 24 months from last contact, unless consent is withdrawn earlier.
• Financial records: Retained for 8 years as required by Indian accounting law.

8. Children's Privacy

SERA processes student data (including minors) on behalf of schools. Schools are responsible for obtaining appropriate consent from parents or guardians before enrolling students in SERA, as required under applicable law.

SERA+ location features for students under 18 require explicit, verifiable consent from a parent or guardian. We do not use student data for any commercial purpose beyond providing the contracted service.

9. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data (subject to legal retention requirements).
• Right to Data Portability: Receive your data in a machine-readable format.
• Right to Withdraw Consent: Withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.
• Right to Grievance Redressal: Lodge a complaint with our Data Protection Officer or the Data Protection Board of India.

To exercise any of these rights, please email privacy@eduuis.com. We will respond within 30 days.

10. DPDP Act Compliance

Eduuis IT is committed to full compliance with the Digital Personal Data Protection Act, 2023 (once its provisions come into force by notification).

• We have appointed a Data Protection Officer (DPO): dpo@eduuis.com
• We maintain a register of processing activities as required under the Act.
• We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities, including SERA+ location tracking.
• Our Data Processing Agreements with sub-processors include DPDP Act-compliant clauses.

11. International Data Transfers

All personal data related to Indian schools and students is stored in AWS Mumbai (ap-south-1) data centres located in India. Where technical sub-processors (e.g., global analytics tools) may process anonymised telemetry outside India, we ensure appropriate contractual safeguards are in place.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email (to registered account holders) or a prominent notice on our website at least 14 days before the change takes effect. Your continued use of SERA after the effective date constitutes acceptance of the revised policy.

13. Contact Us

For privacy-related inquiries, requests, or complaints, please contact:

• Data Protection Officer: dpo@eduuis.com
• General Privacy Queries: privacy@eduuis.com
• Postal Address: Data Protection Officer, Eduuis IT Private Limited, Tower B, Cyber City, Gurugram, Haryana 122 002

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is constituted under the DPDP Act, 2023.