Data Retention & Disposal Policy
Effective Date: 17 June 2026
Applicable to: All students (ages 3-8), parents/guardians, staff, and visitors of Ultra
This Data Retention & Disposal Policy sets out how long undefined (“the School”) keeps different categories of personal data — collected on paper, in School systems, and through the Ultra Super App — and how that data is securely disposed of once it is no longer needed, in line with the Data Protection Policy and the DPDP Act, 2023.
Data Category | Retention Period | Disposal Method |
Admission & enrollment documents (forms, ID/address proof, birth certificate) | Duration of enrollment + 5 years after the child leaves | Secure shredding (physical) / permanent deletion (digital) |
Academic & attendance records, report cards | Duration of enrollment + 5 years (for transfer/reference requests) | Secure shredding / permanent deletion |
Health, medical & allergy records | Duration of enrollment + 3 years | Secure shredding / permanent deletion |
Photographs & videos (internal use) | Duration of enrollment + 2 years, or until no longer needed for records | Permanent deletion from internal drives/App |
Photographs & videos (public — website/social media) | Until consent is withdrawn or the content is no longer current, reviewed at least annually | Removal from live site/social channel; cannot recall third-party shares |
CCTV footage | 30–90 days, unless required longer for an active investigation | Automatic overwrite / secure deletion |
Fee & financial records | 8 years (statutory/accounting requirement) | Secure shredding / permanent deletion |
Staff HR & recruitment records (incl. background verification) | Duration of employment + 5 years | Secure shredding / permanent deletion |
POSH / grievance / safeguarding complaint records | 8 years, or longer if a legal matter is pending | Restricted-access secure storage, then secure deletion |
Ultra Super App account data, chat/communication logs, login activity | Duration of active account + 1 year after account closure | Permanent deletion by vendor per Data Processing Agreement |
Payment transaction references (excluding full card/bank details) | 8 years (statutory/accounting requirement) | Secure deletion |
Consent records (admission, photo/media, App onboarding) | Duration of enrollment/employment + 5 years (evidence of compliance) | Secure shredding / permanent deletion |
Where data is backed up (including App vendor backups), backup copies are subject to the same retention limits and are purged or overwritten on a rolling basis consistent with this schedule, except where a longer backup-cycle is technically unavoidable, in which case access to expired data within backups is restricted.
A Parent or staff member may request earlier deletion of specific personal data (e.g., withdrawal of photo consent) by contacting the Data Protection Officer: [Data Protection Officer / Grievance Officer Name], [dpo@ultraschool.in], +91 81369 46055. Such requests are honored unless the School has a legal obligation or legitimate administrative need to retain the data for the period specified above.
The Principal/School Administrator, supported by the Data Protection Officer, is responsible for ensuring records (physical and digital, including on the App) are reviewed periodically and disposed of in line with this schedule, and for instructing the App vendor and other processors to do the same under their Data Processing Agreements.
This Policy is reviewed annually alongside the Data Protection Policy.