Privacy & Data Protection Policy

Effective Date: 17 June 2026

Applicable to: All students (ages 3-8), parents/guardians, staff, and visitors of Ultra

1. Purpose

Ultra (“the School”, “we”, “us”) respects the privacy of its students and families. This Privacy Policy explains what personal data we collect, why, how we use and protect it, and the rights Parents/Guardians have, in line with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law. Because our students are children (under 18 years), this policy gives special weight to verifiable parental consent.

2. Data Fiduciary

For the purposes of the DPDP Act, Ultra is the Data Fiduciary responsible for personal data collected through admission, attendance, the Ultra Super App, and communication with Parents. The School's Data Protection Officer (DPO) is the designated contact for all privacy queries — see Section 12. A detailed internal governance framework is set out in the Data Protection Policy, and how long data is kept is set out in the Data Retention & Disposal Policy.

3. What Personal Data We Collect

• Child's data: name, date of birth, gender, photograph, address, health/medical/allergy information, attendance, academic and behavioral records.
• Parent/Guardian data: name, relationship to child, phone number, email, address, occupation, payment details (processed by School-approved payment partners, not stored in full by the School).
• Emergency contact and authorized pick-up person details.
• Photographs and videos taken during School activities (see Photo, Video & Media Consent Policy).
• Technical data where the School uses a parent-communication app or learning app (device identifiers, login activity), only to the extent the chosen vendor requires.

4. Verifiable Parental Consent

As our students are children, the School collects and processes student personal data only on the basis of verifiable consent given by a Parent or lawful guardian, obtained at the time of admission and renewed if the purpose of processing materially changes. Consent is recorded in writing (physical or digital form) and Parents may withdraw consent for non-essential processing (such as photo use) at any time, as described in Section 8.

5. Purpose of Collection & Use

1. Admission, enrollment, and academic record-keeping.
2. Communicating with Parents about attendance, progress, fees, and School activities.
3. Ensuring child safety, health, and emergency response.
4. Internal administration, including staff training related to safeguarding.
5. With specific consent only: sharing photographs/videos on the School website or official social media, or in the School prospectus.

The School does not use children's personal data for behavioral monitoring, targeted advertising, or tracking, and does not undertake any processing likely to cause detrimental effect on the well-being of a child.

6. Sharing of Data with Third Parties

• The School may share limited data with school-bus/transport operators, school-management software providers, or payment gateways strictly for operational purposes, under written confidentiality and data-protection terms.
• The School does not sell or rent student or parent data to any third party.
• Data is shared with government or regulatory authorities only where legally required (e.g., POCSO reporting obligations, education department requirements).

7. Data Retention

Student records are retained for the duration of enrollment and for a reasonable period thereafter (typically up to 5 years) for academic reference, transfer certificate issuance, and legal compliance, after which records are securely destroyed or anonymized.

8. Parental Rights

• Right to access the personal data the School holds about their child.
• Right to request correction or updating of inaccurate data.
• Right to withdraw consent for non-essential processing (e.g., photo/media use) at any time, without affecting the child's continued enrollment.
• Right to raise a grievance regarding data handling through the Grievance Redressal Policy, and subsequently with the Data Protection Board of India if unresolved.

9. Data Security

The School takes reasonable technical and organizational measures — including restricted access to student files, secured digital systems, and staff confidentiality undertakings — to protect personal data against unauthorized access, loss, or misuse.

10. Children Under DPDP Act

In accordance with Section 9 of the DPDP Act, 2023, the School treats all students as children requiring verifiable parental consent, does not undertake tracking or behavioral monitoring of children, and does not process children's data in a manner likely to cause harm.

11. Changes to this Policy

This Policy may be updated periodically. Material changes affecting how children's data is used will be communicated to Parents and, where required, fresh consent will be sought.

12. Contact Us

For privacy-related questions or to exercise any of the rights above, contact the Data Protection Officer: [Data Protection Officer / Grievance Officer Name] Email: [dpo@ultraschool.in] Phone: 081369 46055 Address: 1st Floor, The Quadrant, adjacent to JJ Square, Jawahar Nagar, Elamkulam, Kochi, Ernakulam, Kerala 682020