4.1 What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's comprehensive data privacy law. It came into effect to protect the personal data of every Indian citizen. This notice explains what the law means for you as a user of the Smart Attendance System — whether you are a parent, guardian, teacher, or staff member.
Under this law, you are called a "Data Principal" — the person whose data is being used. Your child is also a Data Principal, but since they are a minor, you exercise their data rights on their behalf.
4.2 Who is Responsible for Your Data?
Your school (identified after you sign in) — Data Fiduciary
Your school decides what personal data to collect and why. Under the DPDP Act, the school is the primary entity responsible for protecting your data. The school appoints a Grievance Officer whom you can contact for any data-related concern.
School-specific details are available after you sign in.
Ganat Infotech — Data Processor
Ganat Infotech builds and operates this platform as a technology service provider. It processes your data only on behalf of your school, under a written agreement. Ganat Infotech does not independently decide what to do with your data, does not sell it, and does not use it for advertising or profiling.
support@ganatinfotech.com
4.3 What Data Does the School Collect Through This Platform?
About your child (student): Name, roll number, class, section, date of birth, RFID card number, and daily attendance records showing when they tapped in and out.
About you (parent/guardian): Name, mobile number, email address, your relationship to the student, and your WhatsApp consent status (whether you have opted in or out of attendance messages).
About you (teacher/staff): Name, mobile number, email, your role, login times, what you accessed in the system, and your leave/attendance records.
4.4 Why Is This Data Collected?
In simple terms: to run the attendance system. Specifically:
- To record when your child arrives and leaves school each day
- To send you a message (WhatsApp, SMS, or app notification) when your child taps in or out
- To let you see your child's attendance history
- To let teachers and the principal track attendance for their classes
- To generate attendance reports for the school's records
- To manage leave requests
- To keep an audit trail of who accessed what data and when (required by law)
Your data is not used for advertising, selling to third parties, profiling, or any purpose other than what is listed above.
4.5 Special Protection for Children's Data
Because student data belongs to minors, the DPDP Act requires extra care:
- Attendance processing relies on the educational-institution exemption under the Fourth Schedule of the DPDP Rules 2025. Consent (as parent/guardian) is sought separately, only for WhatsApp messaging. Attendance recording continues regardless of WhatsApp opt-out, because it is a school obligation rather than a consented activity.
- No tracking beyond attendance and child safety; no advertising; no profiling.
- Data processing is limited to what is strictly necessary for attendance management and school operations.
- Ganat Infotech is contractually prohibited from using student data for any purpose other than operating this platform for your school.
4.6 Your Rights — What You Can Do
The DPDP Act gives you these rights. You can exercise them at any time:
- See your data: You can ask the school to show you a summary of what personal data they have about you or your child. Use the "Data Rights" section in your account settings, or contact the Grievance Officer.
- Fix mistakes: If any data is wrong — your phone number, your child's name spelling, an attendance record — you can ask for it to be corrected. For attendance corrections, use the correction request feature in the platform.
- Delete your data: You can ask the school to delete personal data that is no longer needed. Note: the school may need to keep some records for legal reasons (education board requirements, financial records). They will tell you if a deletion request cannot be fully fulfilled and why.
- Withdraw consent: If you previously said "yes" to something (like WhatsApp messages), you can change your mind at any time. For WhatsApp: reply "STOP" followed by your child's name to the school's WhatsApp number. For broader consent: contact the Grievance Officer or use account settings. Withdrawing consent does not make past processing illegal — it only stops future processing.
- File a complaint: If you think your data rights are not being respected, you can file a grievance. See section 4.9 below.
- Nominate someone: The DPDP Act, 2023 gives you the right to nominate another person to exercise your data rights on your behalf (Section 14). To use this right today, contact the Grievance Officer (details above).
4.7 WhatsApp — Opting In and Out
If your school uses WhatsApp to send you attendance alerts:
- To opt in: Send "HI" to the school's WhatsApp Business number. The system will show you which of your children are enrolled and let you choose.
- To opt out: Reply "STOP" followed by your child's name at any time. Your consent status is updated immediately.
What happens when you opt out:
- You stop receiving WhatsApp attendance messages for that child
- Your child's attendance continues to be recorded normally — opting out only stops the messages, not the attendance tracking
- Your opt-out is logged in the system for compliance and audit purposes
- You can opt back in at any time by messaging "HI" again
Important: WhatsApp messages are also processed by Meta Platforms Inc. (the company that owns WhatsApp) under their own privacy policy. The school and Ganat Infotech control the content of the message and who receives it, but the delivery infrastructure is Meta's.
4.8 How Long Is Your Data Kept?
Your school's retention period is shown here once your school administrator configures it in Settings → DPDP.
Some records may be kept longer if required by law — for example, education board regulations may require attendance records to be retained for a specific number of years.
4.9 What If You Have a Complaint?
Step 1: Contact your school's Grievance Officer (details above). They are required to acknowledge your complaint and respond within 90 days.
Step 2: If you are not satisfied with the school's response, you can submit a grievance through the Grievance Redressal page on this platform. You will receive a reference number to track your complaint.
Step 3: If you are still not satisfied, you have the right to approach the Data Protection Board of India — the independent body established under the DPDP Act to hear complaints and take action.
4.10 Contact
School-specific contacts are available after you sign in.
Platform operator: Ganat Infotech
support@ganatinfotech.com
For questions about this notice, contact your school's Grievance Officer first. For platform-level issues (system errors, security concerns), contact Ganat Infotech directly.