1.2 Platform Operator (Data Processor)
This attendance management system is operated by Ganat Infotech as a technology service provider. Under the DPDP Act, Ganat Infotech is a Data Processor — it processes personal data solely on behalf of and under the written instructions of your school.
Ganat Infotech does NOT independently collect, sell, share, or use student, parent, or staff data for any purpose beyond providing the attendance management service to your school. Ganat Infotech does NOT use any personal data for advertising, profiling, behavioural tracking, or any purpose not authorised by the school.
Platform contact: support@ganatinfotech.com
1.3 What Personal Data is Processed
Student data: Full name, roll number, class, section, date of birth, gender, RFID card identifier, daily attendance records (date, time, entry/exit status), and photographs (if uploaded for identification purposes).
Parent/guardian data: Full name, relationship to student, mobile number, email address, occupation, WhatsApp consent status and interaction history, and login/access records.
Staff data (teachers, principals, administrative staff): Full name, mobile number, email address, employee identifier, role and permissions, login timestamps, IP addresses, browser/device information, actions performed in the system (audit trail), and leave/attendance records.
1.4 Purpose of Processing
Personal data is processed for the following lawful purposes:
For parents and students:
- Recording and tracking daily student attendance via RFID tap-in/tap-out
- Sending attendance notifications to parents/guardians (via WhatsApp, SMS, or in-app)
- Managing leave applications and approvals
- Generating attendance reports and certificates
- Enabling parental access to their child's attendance records
- Verifying parental consent for data processing and messaging
For class teachers:
- Viewing and managing attendance for assigned classes
- Submitting manual attendance corrections
- Managing student leave approvals
- Recording parental consent
- Generating class-level attendance reports
For administrative staff and principals:
- Managing school-wide attendance operations
- Configuring system settings (devices, RFID cards, academic calendar)
- Processing data subject requests (access, correction, erasure)
- Maintaining audit trails for compliance
- Generating school-wide reports and analytics
- Managing user accounts and permissions
1.5 WhatsApp Messaging and Consent
If your school uses WhatsApp Business messaging for attendance alerts, the following applies:
- Messages are sent from your school's verified WhatsApp Business number, not from Ganat Infotech.
- Your phone number and message content are processed by Meta Platforms Inc. under Meta's own privacy policy (https://www.whatsapp.com/legal/privacy-policy), in addition to this privacy policy.
- Consent is parent-initiated: you opt in by messaging "HI" to the school's WhatsApp Business number, and opt out at any time by replying "STOP" followed by your child's name.
- Your consent status (opted in, opted out, or pending) is recorded in this system and visible to authorised school staff (Principal, Admin Staff) for compliance and audit purposes.
- Opting out of WhatsApp messages does not erase your existing personal data or affect your child's attendance records.
- The school may also record consent collected on a signed physical form at the time of admission. Physical form consent is treated identically to digital consent for all compliance purposes.
- Meta Platforms Inc. acts as an independent data controller for WhatsApp message data. Neither your school nor Ganat Infotech controls how Meta processes your data within the WhatsApp platform itself.
1.6 Children's Data (DPDP Act, Section 9)
All student data is treated as children's personal data under the DPDP Act, regardless of the student's age. This means:
- Verifiable parental or guardian consent is obtained before any processing of student data. Consent may be obtained via WhatsApp opt-in, OTP verification, parent app confirmation, or a signed physical consent form.
- Student data is never used for advertising, profiling, behavioural tracking, or any commercial purpose.
- Student data is never sold or shared with third parties for purposes unrelated to attendance management and school operations.
- Data processing is limited to what is necessary for attendance management, parent communication, and school operations (purpose limitation).
- The school acts as the child's data fiduciary and makes decisions regarding data processing in the best interest of the child.
1.7 Legal Basis for Processing
Under the DPDP Act, 2023, your school processes personal data on the following legal bases:
- Consent (Section 6): For WhatsApp messaging, attendance notifications, and processing of student data where verifiable parental consent has been obtained.
- Legitimate use (Section 7): For obligations arising from the school's relationship with parents (admission agreement), staff (employment relationship), and compliance with applicable education laws and regulations.
You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and does not affect processing based on legitimate use.
1.8 Data Sharing
Your personal data may be shared with:
- Your school's authorised staff (principal, admin staff, class teachers) — only the data relevant to their role, enforced through role-based access controls.
- Ganat Infotech — as the Data Processor operating this platform, under a Data Processing Agreement with your school.
- Meta Platforms Inc. — if your school uses WhatsApp Business messaging, your phone number and message content are shared with Meta for message delivery.
- Government/regulatory authorities — if required by law, court order, or regulatory direction, including the Data Protection Board of India.
- Cloud hosting providers — personal data is stored on cloud servers located in India, operated by hosting providers under contractual data protection obligations.
Your personal data is NOT shared with advertisers, data brokers, analytics companies, or any third party for purposes unrelated to attendance management and school operations.
1.9 Data Retention
Your school's data retention period will be displayed here once configured by your school administrator in Settings → DPDP.
Consent records and audit trail logs are retained for the full retention period for regulatory compliance purposes.
1.10 Your Rights Under the DPDP Act, 2023
As a Data Principal, you have the following rights:
- Right to Access (Section 11): You may request a summary of your personal data or your child's personal data that is being processed, including the categories of data, the purposes of processing, and the identities of parties with whom data has been shared.
- Right to Correction (Section 12): You may request correction of inaccurate, incomplete, or misleading personal data. Attendance correction requests are processed through the correction workflow in this platform.
- Right to Erasure (Section 12): You may request deletion of personal data that is no longer necessary for the purpose for which it was collected. This right is subject to legal retention requirements.
- Right to Withdraw Consent (Section 6): You may withdraw consent at any time. For WhatsApp messaging, reply "STOP" followed by your child's name. For broader data processing consent, contact the school's Grievance Officer or use the Data Rights section in your account settings.
- Right to Grievance Redressal (Section 13): You may file a grievance if you believe your data rights have been violated. See the Grievance Officer details above, or visit the Grievance Redressal page on this platform.
- Right to Nominate (Section 14): You may nominate another person to exercise your data rights on your behalf in case of your death or incapacity.
1.11 Security Measures
We protect your personal data through:
- Encryption: Data is encrypted in transit (TLS/HTTPS) and at rest.
- Access controls: Role-based authorization ensures staff can only access data relevant to their role. Class teachers see only their assigned classes. Parents see only their own children.
- Audit logging: All data access, modifications, exports, and administrative actions are logged with timestamps and user identity for compliance and security review.
- Data masking: RFID card identifiers and WhatsApp numbers are masked in the interface (only last 4 digits shown). Attendance notifications use "your ward" instead of student names.
- Session management: Login sessions expire after inactivity. Login activity is recorded with device and IP information.
- Secure storage: Data is stored on servers located in India, in compliance with data localisation requirements.
1.12 Changes to This Policy
This privacy policy may be updated from time to time to reflect changes in our practices, the law, or the platform. When changes are made, the "Last updated" date at the top is revised. Continued use of the platform after changes constitutes acceptance. For significant changes, the school may notify users through the platform or other channels.