---

1. Scope of This Policy

This Policy applies, as relevant, to:

• School administrators, management and authorised employees.
• Teachers, non-teaching staff and other school personnel.
• Students, parents and legal guardians using school services.
• Visitors to our website and individuals registering for our services.
• Users of our web portals, mobile applications and connected school systems.

A school may also maintain its own privacy notices and policies. Where a school decides why and how student or school data is processed, the school may have responsibilities as the relevant data fiduciary under applicable law. Worivakiya's role depends on the particular service and processing activity.

2. Information We May Collect

A. Account and contact information

Name, email address, phone number, username, account credentials, school name, designation and other information needed to create and manage an account.

B. Student and academic information

Where a school uses the relevant features, this may include student names, admission details, class and section, parent or guardian contacts, attendance, examination results, grades, homework, report cards and other educational records.

C. School administration and financial records

Fee records, invoices, payment status, receipts, staff records, payroll-related information and school operational records may be processed where required to provide the relevant service. Actual payment card or banking details may be handled by the payment provider rather than stored by Worivakiya.

D. Device, usage and technical information

Browser and device information, IP address, login timestamps, diagnostic logs, application activity and technical information needed for service operation, security and troubleshooting.

E. Location and attendance information

If a school enables GPS, geofencing, transport tracking or location-based attendance, the relevant location information may be processed for those purposes. Location access should be subject to the applicable device permissions and service configuration.

F. Biometric and device verification information

If biometric attendance or device-verification features are enabled, the system may process relevant verification data, such as biometric templates, attendance events or registered device information. Access to such information should be restricted to authorised purposes and users.

Biometric and location features are not necessarily used by every school or account. Their availability and actual data handling depend on the features enabled and the applicable school arrangements.

3. How Information Is Collected

Information may be obtained:

• Directly from users when they register, sign in or contact support.
• From a school or its authorised personnel when they create or manage records.
• Through use of the website, portals and mobile applications.
• From connected devices, integrations or service providers where a feature requires it.

Schools and authorised users should ensure that information entered into the platform is accurate and that they have the necessary authority to provide it.

4. Purposes for Processing Information

Depending on the service and its configuration, information may be used to:

• Create accounts and authenticate authorised users.
• Provide student administration, attendance, examination and academic features.
• Manage fees, receipts, invoices and other school financial workflows.
• Support staff administration, payroll and school operations.
• Provide parent, student, teacher and transport-related services.
• Send essential service notifications, account messages and security alerts.
• Respond to support requests and investigate technical issues.
• Protect accounts, detect suspicious activity and prevent misuse.
• Maintain service reliability, troubleshoot errors and improve functionality.
• Meet applicable legal obligations and respond to lawful requests.

Personal data should be processed only for a lawful and specified purpose, using an appropriate legal basis and the permissions or consents required by applicable law.

5. Student Data and Children's Privacy

School records can contain personal information about children. We recognise the importance of protecting such information and limiting its use to legitimate educational and administrative purposes.

• Access to student records should be limited according to authorised roles and school permissions.
• Schools should provide required notices and obtain applicable parental or guardian consent where legally required.
• Children's information must not be used for unrelated advertising, profiling or other unauthorised purposes.
• Student records should not be disclosed to unauthorised individuals.

The Digital Personal Data Protection Act, 2023 and the applicable rules and commencement provisions may impose specific duties concerning children's personal data. The requirements applicable to a particular processing activity must be assessed before it is carried out.

6. Sharing and Disclosure of Information

We do not intend to sell personal information as a commercial data product. Information may be disclosed, where appropriate and lawful, to:

• The relevant school: authorised school management and personnel who need the information for their duties.
• Service providers: hosting, infrastructure, messaging, email, payment, maintenance and technical-support providers involved in delivering the service.
• Connected services: third-party integrations enabled by the school or required for a requested feature.
• Legal authorities: where disclosure is required by applicable law or a valid legal process.
• Security and continuity: where reasonably necessary to investigate misuse, protect users or maintain the service.

Disclosures should be limited to information relevant to the purpose. Third-party providers may process information under their own terms and privacy policies, as well as applicable contractual and legal requirements.

7. Data Storage, Security and Access

We seek to apply appropriate technical and organisational safeguards to protect personal information against unauthorised access, alteration, disclosure, loss or misuse. Depending on the service, these safeguards may include access controls, authentication, permissions, secure communications, backups, monitoring and restricted administrative access.

Security measures vary by feature and deployment. No online service or storage method can be guaranteed to be completely secure. We therefore cannot promise that every category of information is encrypted at rest or protected by every safeguard unless that protection has been verified for the relevant system.

8. Data Retention and Deletion

Personal information should be retained only for as long as necessary for the stated purposes, the school's legitimate operational needs and applicable legal obligations.

Retention periods may differ for academic records, financial records, attendance logs, security logs, backups and account information. When information is no longer required, it should be deleted, anonymised or otherwise handled in accordance with applicable law and the relevant service arrangements, subject to lawful retention requirements.

Schools should contact the platform administrator or the relevant support channel to request account closure, data correction or deletion where available and legally permitted. Deletion from backups or third-party systems may take additional time.

9. Data Breaches and Security Incidents

We aim to investigate suspected security incidents and take reasonable steps to contain and address them. Where applicable law requires notification of a personal data breach, the required notices will be provided to the relevant persons or authorities within the applicable timelines.

10. Cookies and Similar Technologies

The website or applications may use cookies, sessions or similar technologies to maintain login sessions, support security, remember preferences and understand service performance. The technologies actually used depend on the deployed application.

Disabling essential cookies or session functionality may prevent some features from working correctly. Any optional analytics or tracking technologies should be used in accordance with applicable notice and consent requirements.

11. Third-Party Services and External Links

The platform may link to or integrate with third-party services. Those services may have separate privacy practices, terms and security controls. We encourage users to review the applicable policies before using an external service. This Policy does not replace a third party's own privacy notice.

12. Your Privacy Rights and Requests

Subject to applicable law, users may have rights or entitlements concerning their personal data, including:

• Requesting information about the personal data being processed.
• Requesting correction or updating of inaccurate or incomplete information.
• Requesting deletion where applicable and where retention is not legally required.
• Withdrawing consent where processing is based on consent, subject to applicable law.
• Raising a privacy concern or submitting a grievance.
• Exercising any other rights available under applicable data protection law.

Requests may require identity verification. Where a school controls the relevant student or staff records, users may need to contact that school first. We will direct requests appropriately where possible.

13. Privacy Grievances and Contact

For privacy questions, data requests or complaints relating to Worivakiya SMART School Hub, contact us through the official contact channel published on our website. Please include enough information for us to understand your request, but do not send passwords, authentication codes or unnecessary sensitive data.

If your request concerns records maintained by your school, please also contact the school administrator. Applicable grievances will be handled in accordance with the law and the procedures that apply to the relevant service.

14. Changes to This Privacy Policy

We may update this Policy when our services, data practices or legal obligations change. The revised version will be published on this page with an updated revision date. Where required by law, users will receive additional notice or be asked to provide consent before the relevant processing begins.

15. Applicable Law

This Policy is intended to operate subject to the laws of India, including applicable provisions of the Digital Personal Data Protection Act, 2023, the rules made under it as they become applicable, and other relevant laws. Nothing in this Policy is intended to remove any right or protection that cannot lawfully be excluded.