Institutional Privacy Policy & Data Governance

1. Scope and Legal Roles

This Privacy Policy applies to the services, platforms, and mobile applications provided by Schoyo Technologies LLP (“Schoyo”, “we”, “our”, or “us”) to schools, colleges, universities, and educational institutions (“Institutions”), as well as their enrolled students, faculty, staff, and parents (“End Users”).

Under the Digital Personal Data Protection (DPDP) Act 2023 of India, the partnering Institution is the Data Fiduciary that determines the purposes and means of processing personal data. Schoyo serves as a Data Processor, processing institutional records strictly in accordance with written service agreements.

2. Categories of Information Processed

We process the following categories of data solely on behalf of the Institution:

• Student Demographic & Academic Data: Names, dates of birth, admission numbers, roll numbers, grades, attendance records, exam marks, and teacher remarks.
• Parent & Guardian Information: Parent names, verified contact numbers, email addresses, emergency contacts, and residential addresses.
• Fee & Financial Transactions: Transaction reference IDs, invoice amounts, payment receipts, fee heads, and settlement statuses. (Note: Card numbers and UPI PINs are processed directly by RBI-licensed payment gateways and are never stored on Schoyo servers).
• Institutional Staff Records: Teacher names, employee IDs, attendance logs, timetable assignments, qualification credentials, and administrative roles.
• SHAPE Developmental Data: Self-reflection responses, peer evaluations, extracurricular records, and holistic skill assessments submitted for career exploration and NEP 2020 Holistic Progress Cards.

3. Purpose of Processing

Institutional data is processed exclusively for authorized educational workflows, including:

• Executing classroom operations, timetable scheduling, and digital learning activities.
• Automating fee invoices, digital collection, and tax-ready parent receipts.
• Facilitating parent-teacher announcements, student attendance alerts, and transport notifications.
• Enabling institutions to fulfill statutory regulatory mandates including NEP 2020 Holistic Progress Cards and UDISE+ submissions.
• Synthesizing multi-dimensional guidance insights in the SHAPE engine.

4. Protection of Children's Personal Data

Recognizing that a substantial portion of platform end users are minors, Schoyo maintains rigorous child data safeguards:

• We do not perform behavioral tracking of children for commercial exploitation or advertising.
• We do not deploy automated decision-making engines that create irreversible negative educational outcomes for students.
• Parental consent workflows are managed in collaboration with the partnering school before student portal access is provisioned.

5. Data Security & Storage Architecture

Schoyo implements multi-layered security controls to safeguard institutional records:

• Encryption: AES 256-bit encryption for all data at rest and TLS 1.3 encryption for data in transit.
• Multi-Tenant Isolation: Logical separation of databases ensuring zero cross-tenant data leakage between institutions.
• Role-Based Access Control (RBAC): Granular permissions ensuring staff members only access records required for their specific job functions.
• Regular Automated Backups: Hourly incremental snapshots with geo-redundant storage within Indian cloud regions.

6. Data Retention & Portability

Institutions maintain 100% ownership of their data. Upon termination of a SaaS subscription agreement, the Institution may request a complete export of all historical student, academic, and financial databases in open formats (CSV/JSON/SQL). Following verified contract closure and data handoff, all primary and backup copies are purged in accordance with our certified data destruction schedule within 90 days.

7. Contact the Data Protection Officer

For questions concerning this Privacy Policy, data subject rights under the DPDP Act 2023, or institutional security verifications, please contact our Data Governance Officer: