1. Roles — who controls your data
For data about students, parents and staff, the school is the Data Fiduciary (it decides why and how the data is processed). Vidyom is a Data Processor, processing that data solely on the school’s documented instructions under a data-processing agreement. For data we collect directly — for example, a sign-up enquiry from this website or billing details of a subscribing school — Vidyom is the Data Fiduciary.
2. What we process and why (purpose limitation)
- School operations — admissions, enrolment, attendance, assessments, fees and accounting, transport, communications.
- Children’s data — student records are processed only for school purposes (curriculum, attendance, assessment, child-safety and statutory reporting).
- Account & billing — to provide the service to a subscribing school and raise tax invoices.
- Website enquiries — to respond to a “register your school” or demo request.
Each category of data is tagged to a specific purpose; we do not repurpose data beyond what notice and consent allow.
3. Children’s data safeguards (Section 9)
Student records carry a hard under-18 flag. For children we do not undertake tracking, behavioural monitoring, profiling, or targeted advertising. Where consent is required, the school obtains verifiable parental consent: the consenting adult is identified (via identity/age data or a DigiLocker virtual token) and the verified parent-child linkage is retained as evidence. Self-declared age or blanket permission slips are not used as a lawful basis.
4. Consent and its withdrawal
Where processing relies on consent, we present a clear, itemised notice (each data category mapped to a purpose) in plain language. Consent is sought per purpose — never bundled — and withdrawing consent is as easy as giving it. Withdrawal triggers the cessation of the affected processing and, where no other lawful basis applies, erasure.
5. Your rights as a Data Principal
- Access — a summary of the personal data processed and the processing activities.
- Correction & completion — to correct inaccurate or incomplete data.
- Erasure — to have data erased where retention is no longer required.
- Nomination — to nominate another individual to exercise rights in case of death or incapacity.
- Grievance redressal — to raise a grievance with the Data Fiduciary.
Access, correction and erasure requests are actioned within a target of 30 days; grievances are resolved within a ceiling of 90 days. Requests for student data are routed to the school as Data Fiduciary; Vidyom assists the school in fulfilling them, including erasure that fans out across linked systems.
6. Security safeguards
Each school’s data is isolated under fail-closed row-level security — one school can never see another’s data. Money and sensitive records are written through audited, append-only trails. We apply encryption, access controls and anomaly detection, and we do not send student personal data to any third-party large-language-model service.
7. Personal data breach notification
On becoming aware of a personal data breach, we operate a dual-clock response: a technical/forensic report to CERT-In within 6 hours, and notification to affected Data Principals and the Data Protection Board without delay, followed by a detailed report to the Board within 72 hours. As a Processor, Vidyom alerts the school promptly so the school can meet its own obligations.
8. Retention and erasure
Personal data is retained only as long as the purpose requires or the law mandates (for example, statutory record-keeping). When a retention clock ends, we provide advance notice before deletion and then erase the data, including across linked systems.
9. Processors and sub-processors
Where we engage sub-processors (for example, communication or hosting providers), they are bound by contract to the same protections, restricted to documented instructions, and recorded in a sub-processor register. Data is hosted in India.
10. Grievances and contact
For data about your school, contact your school’s grievance officer. For questions about this policy or data we hold as Fiduciary, contact us at info.vidyom@gmail.com. The name and contact details of our Data Protection / Grievance Officer will be published here on finalisation.
11. Changes
We will post any changes to this policy on this page with a revised “last updated” date.