Data protection

Last updated: 3 October 2026

1. Commitment to Data Protection

Patashala360 protects the personal and academic data of every school, student, parent and staff member in line with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them. For school records the school is the Data Fiduciary, and we process the data only on its instructions.

2. Data Collection & Minimization

• We collect only the data needed to run the school's records, fees, attendance and exams.
• Our mobile app is launching soon. Before it launches, we will update this page with what the app asks for, including permission to show notifications.
• On a bus driver's phone, the app shares the bus location only while the driver runs a trip. We do not collect the location of parents, students or teachers.
• The website enquiry form collects only what we need to call you back. See "Website enquiries" in our Privacy Policy.

3. Data Usage & Processing

• Data is used solely for educational, administrative, and legal purposes as described in our Privacy Policy.
• We do not sell data, show advertising, or profile children.

4. Security Measures

• All traffic is encrypted in transit, and data is stored on encrypted disks.
• Passwords are stored only as one-way hashes.
• Each school's data is kept separate, and an automated test on every code change checks for queries that could reach another school's data.
• Every action is checked against the user's permissions on the server.
• Accounts lock after repeated failed sign-ins, sensitive actions are logged, and every support session inside a school is recorded.

5. Data Sharing & Third Parties

• Data is shared only with authorized school staff, our service providers, or government authorities when the law requires it.
• Our service providers are Google Cloud (application in Mumbai, backups in Delhi, and this website through Firebase), MongoDB Atlas (database in Mumbai), Cloudflare (secure connection and spam protection), Mailjet (service emails) and Zoho Mail (our own inbox).
• Our providers act on our instructions and may not use the data for their own purposes.

6. Data Retention & Deletion

• We keep a school's data while the school uses Patashala360.
• A school that leaves can download all of its data to Excel. We then delete it within 90 days of the end of the agreement, or sooner if the school asks in writing. Backup copies are deleted within 30 days after that.
• Security logs, such as sign-ins and sensitive actions, are kept for one year and then deleted automatically.
• Bus trip locations are deleted automatically 30 days after the trip ends.
• Website enquiries are deleted 12 months after our last contact with the person who sent them.
• A person can ask for their own account to be deleted. See how to delete your account.

7. User Rights & Consent

• Users can ask to access, correct or delete their data, and to withdraw consent.
• For school records, contact the school first. We work with the school and reply within 30 days.

8. Children’s Data

• Children’s data is processed only for the school's purposes. The school obtains a parent's consent as the law requires.
• We do not track children, monitor their behaviour or target them with advertising.

9. Breach Notification

• If a data breach happens, we tell the affected school without delay, report it to CERT-In within 6 hours, and inform the Data Protection Board of India and affected people as the law requires.

10. Changes to This Policy

This Data Protection Policy may be updated periodically. Changes will be posted on this page with the updated date.

11. Contact Us

If you have questions or concerns about data protection, please contact us at:

• Grievance Officer: Kiran Reddy
• Email: hello@patashala360.com
• Address: Patashala360, Behind Indur Engineering College, Siddipet, Telangana, India
• We reply to every grievance within 30 days.