SCHOOL DESK
Schooldesk Privacy Policy
1. Who We Are and Who This Policy Covers
Schooldesk is a school management platform (web portal at app.schooldesk.org and the Schooldesk mobile apps) provided by Kanakia School desk Pvt. Ltd. ("Schooldesk", "we", "us"). This notice explains what personal data is processed through Schooldesk, why, who it is shared with, and how you can exercise your rights under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP law") and the Information Technology Act, 2000.
Schooldesk works in two roles:
- For data of a school's students, parents/guardians and staff, your school is the Data Fiduciary. It decides what is collected and why. Schooldesk is the school's Data Processor and processes that data only on the school's instructions. Requests about this data are best raised with your school first; we will help the school respond.
- For data we collect for our own purposes – enquiries made to Schooldesk, our own employees and vendors, and the security and device data needed to run the platform – Schooldesk is the Data Fiduciary.
This notice is available in English. To receive it in Hindi or another language of the Eighth Schedule to the Constitution, write to the Grievance Officer (section 13).
2. Personal Data We Process and Why
Your school chooses which of the items below it uses. Each item is processed only for the purposes shown next to it.
| Whose data | Personal data | Purpose |
|---|---|---|
| Students | Name, date of birth, gender, photo, signature, address, class and roll details, school and government IDs (GR, PEN, APAAR, UDISE+), Aadhaar number (where the school requires it), nationality, religion, caste and category, mother tongue, blood group, height and weight, attendance, homework, marks and report cards, fee records, uploaded documents | Admission, academic administration, attendance, assessment, communication with parents, fee collection, government education portal reporting, certificates and records the school must keep by law |
| Students – health | Allergies, medical and vaccination history, family medical history, first-aid records, health assessment forms, disability status | Care and safety of the child at school; shared only with the school nurse, doctor or staff the school authorises |
| Parents / guardians | Name, relationship, mobile, email, address, photo, education, occupation, employer, annual income, Aadhaar and PAN (where the school requires them) | Admission, communication, fee collection and receipts, scholarship or fee-concession assessment, pick-up and safety checks |
| Admission applicants and enquiries | Enquiry details (name, date of birth, mobile, email, photo), admission form and documents, previous school, call records, IP address and how you found us | Processing the admission application and following up on the enquiry |
| School staff | Identity and contact details, photo, signature, address, qualifications and experience, Aadhaar, PAN, PF/UAN/ESIC numbers, bank account and IFSC, salary, leave and attendance, fingerprint or face template (on attendance devices), punch-in photo and location (on the mobile app) | Employment, payroll, statutory filings, attendance and HR administration |
| Vendors / service providers | Contact person, phone, email, business address, PAN, GST, documents | Purchasing, payments and tax compliance |
| Visitors to a school | Name, mobile, email, photo, identity document type and number | Campus safety and visitor records |
| All users | Login ID, password (stored only as a one-way hash), one-time codes, sign-in and device history, IP address, device model and identifier, app version, push-notification token | Signing you in, keeping accounts secure, detecting misuse, sending notifications, and keeping security logs |
Payments. Online payments are processed by payment gateways (see section 6). Schooldesk does not store card numbers, CVV or card expiry dates; we keep only the transaction reference, amount and payer contact details.
Aadhaar. Aadhaar is collected only where the school needs it for government education portals or statutory staff filings. Schooldesk does not use Aadhaar to authenticate anyone and does not perform eKYC.
3. Legal Basis: Consent and Legitimate Uses
Personal data is processed either with consent, or for a legitimate use permitted by Section 7 of the DPDP Act, such as employment, complying with a law or court order, responding to a medical emergency, or a purpose for which you have voluntarily provided the data.
Where consent is needed, it is asked for separately and recorded with the date, time and device used, for example when you accept an admission policy, a fee policy or a new version of a school policy.
4. Withdrawing Consent and Opting Out
You may withdraw consent at any time, as easily as you gave it:
- Write to your school, or to the Grievance Officer (section 13), stating what you wish to withdraw.
- Switch off app notifications for any channel in the mobile app settings.
- Ask us to stop SMS, WhatsApp or email messages that are not essential to your child's schooling.
Withdrawal does not affect processing already carried out. Some school services may not be possible without certain data (for example, admission records or fee receipts), and data the school must keep by law will be retained for that period.
5. Mobile App Permissions
The Schooldesk app asks for a device permission only when you use the feature that needs it:
- Camera, photos and microphone – to upload photos, videos or files of student work, profile photos and support attachments, and to scan QR codes.
- Location – for staff attendance punch-in only, read once at the time of punching. The app does not track location in the background.
- Notifications – to deliver school messages and alerts.
The app does not access your contacts, call logs or SMS, does not collect advertising identifiers, and contains no advertising or analytics software.
6. Who We Share Data With
We do not sell, trade or rent personal data. Data is shared only with:
- Your school's authorised staff, according to the roles the school assigns.
- Service providers who process data for us, under contract and only for the purpose stated:
- Hosting and backup providers – storing the platform and its data;
- SMS gateway, email service and Meta (WhatsApp Business) – sending one-time codes, alerts and school messages;
- Google Firebase – delivering mobile push notifications;
- Google Workspace – school email, calendar and document storage, where the school uses it;
- Google and Apple – signing in with your Google or Apple account, if you choose to;
- Payment gateways (Juspay / HDFC Bank, Razorpay, CCAvenue) – processing fee payments;
- AI service providers – only when you use the optional AI assistant, which sends the question and the related school information you ask about.
- Government authorities, when the school or Schooldesk is required to share data by law, regulation or court order (for example, education portal reporting or a lawful request from CERT-In).
7. Transfers Outside India
Some service providers listed in section 6 (such as Google, Meta and AI service providers) may process data on servers outside India. We transfer data only to countries not restricted by the Government of India under Section 16 of the DPDP Act, and only to providers bound by contract to protect it.
8. How We Protect Data
We take reasonable security safeguards to prevent personal data breaches, including:
- Encryption of data in transit (HTTPS);
- Passwords stored only as salted one-way hashes; one-time codes and two-step verification for sign-in, mandatory for administrator accounts;
- Role-based access, so staff see only what their role requires;
- Automatic blocking after repeated failed sign-in attempts, sign-in alerts, and the ability to sign out other devices;
- Logs of sign-ins, changes and approvals, kept for at least one year to detect and investigate misuse;
- Regular database backups.
9. If a Data Breach Occurs
If a personal data breach occurs, we will inform the affected school without delay. The school, or Schooldesk where it is the Data Fiduciary, will inform the Data Protection Board of India and affected individuals as required by the DPDP Rules, and report cyber security incidents to CERT-In within the time it prescribes. The notice to you will explain what happened, the likely impact, the steps taken, and what you can do to protect yourself.
10. How Long We Keep Data
Personal data is kept only as long as needed for the purpose it was collected for, or as long as a law requires (for example, school academic and fee records, tax records and staff statutory records). When the purpose is served, or consent is withdrawn and no law requires us to keep the data, it is erased or anonymised, on the school's instruction for school data. Security logs are kept for at least one year.
11. Children's Data
Under the DPDP law a child is anyone under 18. Children's data is processed through Schooldesk on behalf of the school, for education and for the child's safety. The school obtains the consent of a parent or lawful guardian where the law requires it. Schooldesk does not use children's data for advertising, does not show targeted advertising to children, and does not track or monitor children's behaviour except as the school needs for educational activities or safety.
12. Your Rights
Subject to the DPDP law, you have the right to:
- Access – a summary of your personal data being processed, the processing activities, and the identities of others it has been shared with;
- Correction and updating – to correct inaccurate or misleading data and complete or update incomplete data;
- Erasure – to have data erased when it is no longer needed for its purpose, unless a law requires it to be kept;
- Withdraw consent – as described in section 4;
- Nominate – to name another person to exercise your rights in the event of your death or incapacity;
- Grievance redressal – to raise a complaint and receive a response (section 13).
You can view your profile in the Schooldesk portal and app at any time. To make any other request, contact your school or the Grievance Officer. We may need to verify your identity before acting. A parent or lawful guardian may exercise these rights on behalf of a child.
13. Grievance Officer and Complaints
Questions, requests and complaints about personal data may be sent to our Grievance Officer:
- Name: Sohanlal Kumavat
- Email: info@schooldesk.org
- Phone: +91 9821283658
- Address: Kanakia School desk Pvt. Ltd., 1st Floor, B Wing, Vilco Center, Subhash Rd, Vishnu Prasad Society, Navpada, Vile Parle (East), Mumbai 400 057
We will acknowledge your complaint and respond within 90 days, and sooner where we can. If you are not satisfied with the response, you may complain to the Data Protection Board of India in the manner it prescribes.
14. Cookies
The Schooldesk website and portal use only essential cookies, which keep you signed in, protect your session and remember your settings. We do not use advertising or third-party tracking cookies. You can delete cookies through your browser settings, but you will then need to sign in again.
15. Changes to This Policy
We may update this Privacy Policy to reflect changes in law or in our services. The new version will be posted on this page with a new "Last Updated" date. Where a change affects how we use data you consented to, we will ask for your consent again.
Contact Us
For general questions about this Privacy Policy:
- Email: info@schooldesk.org
- Phone: +91 9821283658
- Address: 1st Floor, B Wing, Vilco Center, Subhash Rd, Vishnu Prasad Society, Navpada, Vile Parle (East), Mumbai 400 057