Royal Senior Secondary School

1. Introduction

Royal Senior Secondary School ("we", "our", or "the School") is committed to protecting the privacy and personal information of students, parents, teachers, and all other users of our School Management Portal (royalschool.local) and the Royal School Android application.

This Privacy Policy explains what data we collect, why we collect it, how it is used, and the rights you have in relation to your personal data. By accessing or using our portal or mobile app you agree to the practices described in this policy.

2. Information We Collect

We collect different types of information depending on your role:

Student Information

• Full name, date of birth, gender, and photograph
• Admission number, roll number, class, and section
• Academic records — marks, grades, rank, and attendance
• APAAR ID / UDISE code (where applicable)
• Parent/guardian name and contact details (phone number & email)
• Fee payment records and receipts

Staff & Teacher Information

• Full name, employee number, designation, and photograph
• Contact details and email address
• Attendance records and assigned subjects/classes
• QR code data for biometric check-in

Technical & Usage Data

• Login timestamps and session activity logs
• OTP verification records for secure login
• Device information when using the Android app (device model, OS version)
• IP address and browser type for security monitoring

3. How We Use Your Information

We use the information collected solely for educational and administrative purposes, including:

• Managing student enrolment, class assignments, and academic records
• Generating mark sheets, report cards, admit cards, and ID cards
• Tracking attendance and sending automated notifications to parents
• Processing fee payments and generating official receipts
• Communicating important notices, events, and updates via SMS or push notifications
• Maintaining school administration, staff scheduling, and seating plans
• Ensuring platform security and preventing unauthorised access
• Complying with government and regulatory reporting requirements (e.g., UDISE)

4. Sharing of Information

We do not sell, rent, or trade personal information to any third party. Information may only be shared in the following limited circumstances:

• Government Authorities: When required by law, regulations, or court orders (e.g., submission to the Education Department of Assam, UDISE reporting).
• Service Providers: Trusted third-party vendors (such as SMS gateway providers or cloud hosting) who process data solely on our behalf and are bound by confidentiality obligations.
• Parents / Guardians: Relevant student information (attendance, marks, fee status) is shared with the student's registered parent/guardian via SMS, app notifications, or the portal.
• Emergency Situations: Where disclosure is necessary to protect the safety of a student or other person.

5. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure:

• Password hashing using industry-standard algorithms (bcrypt)
• OTP-based two-factor authentication for sensitive logins
• Role-based access control — users can only access data relevant to their role
• Session management with automatic timeout to prevent hijacking
• Regular database backups stored securely
• HTTPS encryption for all data transmitted over the network

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes outlined in this policy or as required by applicable law:

7. Your Rights

Subject to applicable law, you (or a parent/guardian on behalf of a student) have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of any inaccurate or incomplete data.
• Deletion: Request deletion of personal data where it is no longer necessary (subject to legal retention obligations).
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to the processing of your data for specific purposes.
• Portability: Receive your data in a structured, commonly used format where technically feasible.

To exercise any of these rights, please contact the school office using the details provided in the Contact Us section.

8. Cookies & Local Storage

Our portal uses browser sessions and local storage for the following purposes:

• Session Cookies: To keep you logged in during your visit and maintain authentication state.
• Security Tokens: Short-lived tokens used for OTP verification and form security (CSRF protection).
• Preference Storage: To remember display preferences (where applicable).

We do not use tracking cookies, advertising cookies, or any third-party analytics cookies. Session data is cleared when you log out or close your browser.

9. Children's Privacy

As an educational institution, we routinely handle data belonging to minors (students below 18 years of age). This data is collected and processed with the knowledge and consent of their parents or guardians at the time of admission.

Parents and guardians may review, update, or request deletion of their child's data by contacting the school administration. Student portal accounts are only activated after parent consent is recorded.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes, we will update the "Last Updated" date at the top of this page.

We encourage you to review this page periodically. Continued use of the portal after any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please reach out to us: