This Privacy Policy explains how Demo Transport ("the School", "we", "us") collects, uses, stores and protects personal data through this website, the parent and student portal, the school mobile app and our school management system. We follow the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it.
1. Data we collect
- Enquiries and admissions: the child's name, date of birth, gender, class sought and previous school; parent or guardian names, phone numbers, email and address; documents you upload with an application.
- Student records: attendance, marks, report cards, homework, timetable, health and allergy notes you give us, transport stop, house and event participation, photographs taken at school activities.
- Government identifiers: where required by education authorities, UDISE+ / EMIS / PEN / APAAR numbers and, only with a parent's consent, verification of identity through DigiLocker. We keep only the last 4 digits of an Aadhaar number, never the full number.
- Fees and payments: fee dues, receipts and transaction references. Card, UPI and net-banking details are entered on our payment gateway's secure page and are never stored by the School.
- App and portal use: login details, device notification tokens, and — only while the driver screen is open — the live location of school buses.
- Mobile app permissions: the app asks only for what a feature needs — notifications (alerts and reminders), camera or photos (only when you choose to upload a picture or document), and location (only for bus drivers and attendants, and only while the trip screen is open). You can turn any permission off in your phone's settings. The app has no advertising and no third-party tracking.
- Website visits: basic technical data such as browser type and pages visited, used to keep the site secure and working.
2. Why we use it
- To process enquiries and admissions and to keep you informed at each step.
- To teach, assess and care for students, and to share progress with parents.
- To collect fees, issue receipts and keep accounts as the law requires.
- To send notices, reminders and alerts (school bus, homework, meetings, events) by app notification, SMS, WhatsApp or email.
- To meet legal and regulatory duties, including reports to education authorities.
- To keep our systems safe and prevent misuse.
We do not sell personal data and we do not use children's data for advertising, tracking or behavioural profiling.
3. Children's data and parental consent
Most of our users are children. We process a child's personal data only with the verifiable consent of a parent or lawful guardian, or where the law allows it without consent (for example, to provide education and keep the child safe). A parent can review or withdraw consent at any time by contacting the Grievance Officer below. Withdrawing consent may mean some services (for example online verification or app features) can no longer be provided.
4. Who we share it with
Only with service providers who help us run the school's systems, under contract, and only what each one needs:
- Hosting: our systems and databases run on Microsoft Azure, and the data is stored in Microsoft's secure data centres.
- Messaging: SMS, WhatsApp and email providers, to deliver notices you have asked for or need to receive.
- Payments: our payment gateway (such as CCAvenue), to take online fee payments.
- App notifications: Google Firebase Cloud Messaging, to deliver alerts to the mobile app.
- Identity verification: DigiLocker, through an authorised partner, only when a parent chooses to verify.
- Staff assistant tools: some staff tools use an AI service to help draft text; it is not used to make decisions about students.
We also share data with education boards and government authorities when the law requires it.
5. Online fee payments
When you pay fees, transport charges or event fees online, you are taken to the secure page of our payment gateway (such as CCAvenue), a licensed payment aggregator regulated by the Reserve Bank of India.
- What the gateway handles: your card number, expiry date, CVV, UPI ID or net-banking login are entered only on the gateway's page. They are processed under the gateway's own privacy policy and the PCI-DSS card-security standard. The School never sees or stores them.
- What the School keeps: the student's name and admission number, the fee items paid, the amount, the date and time, the gateway's order and transaction reference, the payment mode (for example "UPI" or "Card") and the status (successful, failed or refunded). We need these to issue receipts, update fee records and keep accounts as tax law requires.
- What we share with the gateway: only what is needed to complete the payment — the amount, an order reference, and the payer's name, email and mobile number for the payment confirmation.
- Security: payment pages open over an encrypted (HTTPS) connection, and every payment response from the gateway is checked against its digital signature before a fee is marked as paid.
- Refunds: refunds go back to the same card, UPI or bank account that was used, as described in our Refund & Cancellation Policy.
6. How long we keep it
We keep student records for as long as the child studies with us and afterwards for the period required by education and tax laws (for example transfer certificates, mark records and fee receipts). Enquiries that do not lead to admission are deleted or anonymised after they are no longer needed. Backups are kept for a short, limited time and then overwritten.
7. How we protect it
Access is limited to staff who need it for their role and every login is personal. Connections to this website are encrypted (HTTPS), sensitive credentials are stored encrypted, changes to records are logged, and data is backed up every day. If a personal data breach occurs we will inform the Data Protection Board of India and affected families as the law requires.
8. Your rights
Under the DPDP Act a parent (for a child) or an adult user can:
- ask what personal data we hold and how it is used;
- ask us to correct, complete or update it;
- ask us to erase data we no longer need to keep by law;
- withdraw consent;
- nominate another person to exercise these rights in case of death or incapacity;
- raise a grievance with us, and if not satisfied, with the Data Protection Board of India.
9. Cookies
This website uses only the cookies needed for it to work — for example to keep you signed in to the portal. We do not use advertising cookies.
10. Grievance Officer
If you have a question or complaint about your personal data, please contact:
The Principal
Demo Transport, Campus address will appear here
Email: info@school.edu · Phone: +91 00000 00000
We will acknowledge your request and respond within the time the law requires.
11. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page with the date it was last updated.