Privacy Policy

VS Campus Care ("VSCC", "we", "us" or "our") provides a multi-tenant school management platform (the "Platform") together with this marketing website (the "Website"). We are committed to protecting the privacy and security of the personal data entrusted to us by schools, administrators, teachers, students, parents and website visitors.

This Privacy Policy explains what personal data we collect, why we collect it, how we use, store, share and protect it, and the rights available to you. It applies to the Website and, unless a separate agreement provides otherwise, to the Platform.

This Policy is designed to comply with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act") and the Information Technology Act, 2000 and rules thereunder, and reflects internationally recognised principles such as those of the EU General Data Protection Regulation ("GDPR") where relevant.

Our responsibilities depend on the context in which we handle personal data:

• As a Data Fiduciary / Controller — for data we collect directly, such as details submitted through our contact and demo forms, newsletter subscriptions, billing contacts and Website analytics. We determine the purposes and means of this processing.
• As a Data Processor / Service Provider — for data entered into the Platform by a school ("Customer Data"), including student, parent, teacher and staff records. Here, the school (the "Institution") is the Data Fiduciary/Controller and we process Customer Data strictly on its documented instructions and under our service agreement.

Individuals whose data is stored in the Platform by an Institution should direct privacy requests to that Institution in the first instance. We will support Institutions in fulfilling such requests.

a) Data you provide to us directly

• Contact and demo requests: name, email address, phone number, school/organisation name, role and message contents.
• Account and billing information: authorised contact details, subscription plan, invoicing and payment records (card details are handled by our PCI-DSS-compliant payment providers and are never stored on our servers).
• Support communications: correspondence, attachments and call/chat records when you contact us.

b) Data processed on behalf of Institutions (Customer Data)

• Student and guardian records, admissions data, attendance, grades and examination results, fee and payment records, timetable, transport, hostel, library, health and disciplinary records, as configured by the Institution.
• Staff and HR records including payroll data, where the Institution enables those modules.

c) Data collected automatically

• Device and usage data: IP address, browser type, operating system, pages visited, referring URLs, timestamps and approximate location derived from IP.
• Cookies and similar technologies as described in the Cookies section.
• Platform logs: sign-in events, security events and audit trails necessary for the integrity of the service.

We process personal data for the following purposes and on the following legal bases:

• To provide the service — operating the Platform, authenticating users, processing transactions and providing support (performance of contract).
• To respond to enquiries — handling demo requests, sales enquiries and support tickets (consent and/or legitimate use).
• To secure our systems — monitoring, fraud prevention, abuse detection, backups and disaster recovery (legitimate use / legal obligation).
• To improve our products — aggregate, de-identified analytics on usage patterns; we do not use Customer Data to train third-party AI models.
• To communicate — service notices, security alerts, invoices and, with your consent, marketing communications which you may opt out of at any time.
• To comply with law — tax, accounting, regulatory and lawful government requests.

We do not sell personal data, and we do not use Customer Data for advertising.

The Platform is designed for use by educational institutions and necessarily involves processing data of minors. We process children’s data only on behalf of, and under the instructions of, the Institution, which is responsible for obtaining verifiable parental/guardian consent where required by the DPDP Act and other applicable laws.

• We do not use children’s data for behavioural tracking, targeted advertising or profiling.
• Access to student data is role-restricted within the Platform (e.g., a parent sees only their own child’s records).
• The Website itself is not directed at children, and we do not knowingly collect data from children through it.

We share personal data only with:

• Sub-processors and service providers — cloud hosting, email delivery, SMS gateways, payment processors and analytics providers, each bound by contractual confidentiality and data-protection obligations and engaged only to the extent necessary to deliver the service.
• The relevant Institution — data within a school’s tenant is accessible to that Institution’s authorised users according to their roles.
• Legal and safety recipients — courts, regulators or law enforcement where required by law, or where necessary to protect the rights, property or safety of any person; where lawfully permitted, we will notify the affected Institution before disclosure.
• Business transfers — in connection with a merger, acquisition or asset sale, subject to this Policy continuing to apply to transferred data.

Each Institution’s data is logically isolated in its own tenant. No Institution can access another Institution’s data.

We use a minimal set of cookies and similar technologies:

• Strictly necessary cookies — session management, authentication, CSRF protection and load balancing. These cannot be disabled as the service will not function without them.
• Functional cookies — remembering preferences such as language or dismissed notices.
• Analytics cookies — aggregate measurement of Website traffic and performance, used only in de-identified or pseudonymised form.

You can control cookies through your browser settings. Disabling non-essential cookies does not affect your ability to use the Website.

We apply administrative, technical and physical safeguards appropriate to the sensitivity of the data we handle, including:

• Encryption in transit (TLS 1.2+) for all connections, and encryption at rest for databases and backups.
• Tenant-level data isolation, role-based access control and the principle of least privilege for both customers and our own personnel.
• Hardened infrastructure, network segregation, firewalling and continuous security monitoring and logging.
• Regular backups with tested restoration procedures and a documented disaster-recovery plan.
• Vulnerability management, dependency patching and periodic security reviews of the codebase.
• Confidentiality obligations and security training for personnel with data access.

In the event of a personal data breach affecting your data, we will notify affected Institutions and, where required, the Data Protection Board of India and affected individuals, without undue delay and in accordance with applicable law.

• Customer Data is retained for the duration of the Institution’s subscription. Upon termination, Institutions may export their data; we delete or irreversibly anonymise Customer Data within 90 days of contract termination, except where retention is required by law.
• Enquiry and marketing data is retained for up to 24 months after last contact, or until you withdraw consent.
• Billing and transaction records are retained for the periods mandated by tax and accounting laws.
• Security logs are retained for a limited period consistent with our security and audit obligations.

Subject to applicable law, you have the right to:

• Access — obtain a summary of the personal data we hold about you and how it is processed.
• Correction & erasure — request correction of inaccurate data, completion of incomplete data, or erasure of data no longer required.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Grievance redressal — lodge a complaint with our Grievance Officer and, if unresolved, with the Data Protection Board of India or your local supervisory authority.
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.

For data held within an Institution’s tenant, please contact the Institution directly; we will assist it in responding. We respond to verified requests within the timelines prescribed by applicable law.

Our primary infrastructure is hosted in data centres located in India. Where any data is transferred outside India — for example, to a specialised service provider — we do so only to jurisdictions not restricted by the Government of India under the DPDP Act, and subject to contractual safeguards requiring an equivalent standard of protection.

We may update this Privacy Policy from time to time to reflect changes in law, technology or our services. Material changes will be notified on this page and, for Platform customers, by email or in-app notice at least 15 days before they take effect. The "Last updated" date at the top of this page indicates the latest revision. Continued use of the Website or Platform after the effective date constitutes acceptance of the updated Policy.

For privacy questions, requests or complaints, contact our Grievance Officer:

• Grievance Officer — Data Protection & Privacy
• Email: info@vscampuscare.com
• Phone: +91 90000 00000

We acknowledge grievances promptly and aim to resolve them within the timelines prescribed under the DPDP Act and other applicable rules.