Data Protection Policy

Effective Date: 17 June 2026

Applicable to: All students (ages 3-8), parents/guardians, staff, and visitors of Ultra

1. Purpose & Scope

This Data Protection Policy explains how undefined (“the School”) governs personal data across all its operations, including data collected on paper at admission, data held in School systems, and data processed through the Ultra Super App (“the App”) used by Parents, students, and staff for attendance, communication, fee payment, homework, and photo/update sharing. It supplements the Privacy Policy by setting out the School's internal data-governance framework under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and DPDP Rules, 2025.

2. Roles & Responsibilities

• Data Fiduciary: Ultra is the Data Fiduciary, accountable for deciding the purpose and means of processing personal data of students, parents, and staff.
• Data Processor: The vendor operating the Ultra Super App, and any other vendor processing personal data on the School's behalf (payment gateway, transport tracking, learning platform), acts as a Data Processor under a written agreement with the School.
• Data Protection Officer / Grievance Officer (DPO): Appointed by the School as the single point of contact for all data-protection questions, consent withdrawal requests, and grievances.

Data Protection Officer: [Data Protection Officer / Grievance Officer Name] Email: [dpo@ultraschool.in] Phone: +91 81369 46055 Address: 1st Floor, The Quadrant, adjacent to JJ Square, Jawahar Nagar, Elamkulam, Kochi, Ernakulam, Kerala 682020

3. Data Protection Principles

1. Lawfulness & Consent: Personal data, especially of children, is processed only on the basis of verifiable parental consent or another lawful basis recognized under the DPDP Act.
2. Purpose Limitation: Data is collected only for clearly stated educational, administrative, safety, or communication purposes, and not reused for unrelated purposes without fresh consent.
3. Data Minimization: Only data reasonably necessary for the stated purpose is collected, including within the App (e.g., the App will not request access to a parent's contacts, photos gallery, or location beyond what a specific feature genuinely requires).
4. Accuracy: The School and the App allow Parents to view and request correction of inaccurate student/family data.
5. Storage Limitation: Data is retained only as long as necessary, per the Data Retention & Disposal Policy.
6. Security: Appropriate technical and organizational measures protect data against unauthorized access, alteration, or loss (Section 5).
7. Accountability: The School maintains records of consent, processing activities, and vendor agreements to demonstrate compliance.

4. Personal Data Processed via the Super App

• Account data: parent/staff name, phone number, email, login credentials, role (parent/teacher/admin).
• Student data: name, class, attendance, homework, report cards, fee status, photos/videos shared with the parent of that specific child.
• Communication data: messages between Parents and teachers, circulars, and notifications sent through the App.
• Payment data: fee payment status and transaction reference numbers; full card/bank details are handled directly by the payment gateway, not stored by the School or the App.
• Device/technical data: device type, app version, and login activity, used only for security and support purposes.

5. Security Measures

5.1 Technical Measures

• Encryption of data in transit (HTTPS/TLS) and at rest for the App's database and the School's digital records.
• Role-based access control so each App user (parent, teacher, admin) sees only the data relevant to their own child/class/role.
• OTP or password-based authentication for App accounts, with an option for Parents to enable additional verification.
• Regular security updates and periodic vulnerability checks of the App, coordinated with the App vendor.

5.2 Organizational Measures

• Staff are granted access to student data strictly on a need-to-know basis tied to their role.
• Staff sign confidentiality undertakings as part of the Staff Code of Conduct.
• Periodic staff training on data handling, password hygiene, and recognizing phishing/social-engineering attempts.

6. Vendor & Processor Management

1. Before onboarding the App vendor or any other data processor, the School obtains a written Data Processing Agreement requiring the vendor to: process data only on the School's instructions; implement adequate security safeguards; assist with data-subject requests and breach response; and delete or return data on termination of the agreement.
2. The School conducts reasonable due diligence on where the App vendor hosts/stores data and, where data is stored or processed outside India, confirms this is permitted under DPDP Act requirements applicable at the time.
3. The School periodically reviews vendor compliance with this Policy.

7. Data Breach Response

1. Any suspected data breach (including suspected unauthorized access to the App, lost/stolen staff device, or a vendor-reported incident) must be reported immediately to the DPO.
2. The DPO assesses the scope and impact of the breach and coordinates containment with the App vendor/IT support.
3. Where required under the DPDP Rules, 2025, the School notifies the Data Protection Board of India without delay, with a fuller report (cause, impact, remedial steps) typically within 72 hours of becoming aware of the breach, and notifies affected Parents/staff within a similar timeframe where the breach is likely to affect them.
4. A post-incident review is conducted to prevent recurrence.

8. Data Protection Impact Assessment (DPIA)

Before introducing any new significant data-processing activity (e.g., a new App feature involving biometric attendance, location tracking, or AI-based analysis), the School/DPO will assess the necessity, proportionality, and risk to children's data, and put in place additional safeguards if required, before go-live.

9. Rights of Parents & Staff

• Right to be informed about what data is collected and why (see Privacy Policy and in-App consent screens).
• Right to access and correct their own and their child's data.
• Right to withdraw consent for non-essential processing (e.g., public photo use, optional App features) at any time.
• Right to raise a grievance with the DPO, and subsequently with the Data Protection Board of India if unresolved.

10. Children's Data — Special Care

Because all students are children, the School and the App vendor do not undertake behavioral monitoring, targeted advertising, or tracking of children, and do not process children's data in any manner likely to cause detrimental effect on their wellbeing, in line with Section 9 of the DPDP Act.

11. Review

This Policy is reviewed at least annually, and whenever the App or the School's data processing activities materially change, to remain aligned with the DPDP Act and DPDP Rules.