Privacy Policy

1. Introduction

Protoco (“Company,” “we,” “us,” or “our”), operating from Dibrugarh, Assam, India, is committed to protecting the privacy and personal data of all individuals who interact with our platform. This Privacy Policy (“Policy”) explains how we collect, use, store, share, and protect your personal data when you use our digital fee management platform at protoco.in and all related services (collectively, the “Service”).

This Policy is published in compliance with the Information Technology Act, 2000 (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Digital Personal Data Protection Act, 2023 (“DPDPA”).

By using the Service, you consent to the collection, use, and processing of your personal data as described in this Policy. If you do not agree with this Policy, please do not use the Service.

2. Definitions

For the purposes of this Policy, the following terms have the meanings set out below, consistent with the Digital Personal Data Protection Act, 2023:

• “Data Principal” means the individual to whom the personal data relates. In the context of our Service, this includes School Administrators, parents, guardians, and students.
• “Data Fiduciary” means the entity that determines the purpose and means of processing personal data. The School using Protoco acts as the primary Data Fiduciary for student and parent data. Protoco acts as a Data Fiduciary for School Administrator account data and as a Data Processor for student and parent data.
• “Data Processor” means any entity that processes personal data on behalf of a Data Fiduciary. Protoco acts as a Data Processor when handling student and parent data on behalf of Schools.
• “Personal Data” means any data about an individual who is identifiable by or in relation to such data.
• “Processing” includes collection, storage, use, sharing, modification, deletion, and any other operation performed on personal data.

3. Data We Collect

We collect different categories of data depending on your relationship with the Service:

3.1 School Administrator Data

When a School registers and creates an account, we collect:

• School name and address
• Administrator name, email address, and phone number
• Login credentials (password stored in hashed form)
• School logo (if uploaded)

3.2 Student Data

Schools enter the following student data on the Platform:

• Student full name
• Class, section, and roll number
• Fee category and assigned fee structure
• Admission or enrolment details

3.3 Parent / Guardian Data

Schools enter the following parent/guardian data:

• Parent/guardian full name
• Phone number (used for WhatsApp communications)
• Relationship to student

3.4 Fee & Payment Records

Schools record the following payment data:

• Fee amounts, due dates, and fee heads
• Payment records including: date of payment, amount paid, payment mode (cash, UPI, bank transfer, cheque)
• Payment reference identifiers: UPI transaction IDs, bank transfer reference numbers, cheque numbers
• Outstanding balance and payment history

3.5 Automatically Collected Data

When you access the Platform, we automatically collect:

• Device information (browser type, operating system, device type)
• IP address
• Pages visited, features used, and timestamps
• Referral URLs
• Cookies and similar tracking technologies (see Section 11)

4. How We Use Your Data

We process personal data only for the following specific, legitimate purposes:

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects on individuals. We do not sell personal data to third parties.

5. Data Storage & Security

5.1 Storage Infrastructure

All data is stored on Supabase, a managed database platform hosted on Amazon Web Services (AWS) cloud infrastructure. Data may be stored on servers located outside India (see Section 8 on cross-border transfers). We select infrastructure providers that maintain industry-standard security certifications, including SOC 2 Type II and ISO 27001 compliance.

5.2 Security Measures

We implement reasonable security practices and procedures consistent with the SPDI Rules, including:

• Encryption: Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 encryption (as provided by Supabase/AWS).
• Access Controls: Role-based access controls ensure that only authorised personnel can access personal data. Each School’s data is logically isolated and accessible only to that School’s authorised users.
• Authentication: Passwords are hashed using industry-standard algorithms. We support secure authentication mechanisms.
• Monitoring: We employ logging and monitoring to detect and respond to security incidents.
• Backups: Regular automated backups are maintained to prevent data loss.

5.3 Data Breach Notification

In the event of a personal data breach, we will notify the affected Data Fiduciary (School) without unreasonable delay and, where required, notify the Data Protection Board of India in accordance with Section 8 of the DPDPA, 2023. We will also take immediate steps to mitigate the breach and prevent recurrence.

6. Data Sharing & Third Parties

We do not sell, rent, or trade personal data. We may share data only in the following limited circumstances:

All third-party service providers are contractually bound to process personal data only for the specified purposes and to maintain appropriate security measures. We conduct reasonable due diligence on our service providers’ data protection practices.

7. Data Retention & Anonymization

We retain data in accordance with purpose limitation principles and applicable Indian statutory requirements:

• Active account data: Retained in full for the duration of your active subscription to provide the fee management Service.
• 90-Day Grace Period: Following account suspension, cancellation, or termination, all institutional and student records are preserved in full for a 90-day grace period to allow the School to complete data exports or renew the subscription.
• Personal Data Anonymization: Upon expiration of the 90-day grace period, all personal and identifying data (including student names, parent/guardian names, contact numbers, email addresses, and staff login credentials) is permanently anonymized and erased from our operational database systems.
• Financial Transaction Records (6-Year Retention): In compliance with mandatory Indian tax record-keeping requirements (including the Income-tax Act, 1961 and Goods and Services Tax regulations), financial ledger records (such as payment amounts, receipt numbers, payment modes, fee heads, and transaction dates) are retained in anonymized form for a period of 6 years from the end of the relevant financial year, after which they are permanently deleted.
• Backup cycling: Encrypted automated database backups cycle and permanently purge deleted records within 30 days.

8. Cross-Border Data Transfers

Our infrastructure provider, Supabase (hosted on AWS), may store and process data on servers located outside India. Any transfer of personal data outside India is conducted in compliance with Section 16 of the DPDPA, 2023, and is only made to countries or territories not restricted by the Central Government of India.

We ensure that appropriate safeguards are in place for cross-border transfers, including contractual obligations on our service providers to maintain data protection standards substantially equivalent to those required under Indian law. If the Central Government notifies restrictions on transfers to specific jurisdictions, we will take necessary steps to comply, including data localisation where required.

9. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access (Section 11): You have the right to obtain confirmation of whether we are processing your personal data and to request a summary of such data and the processing activities.
• Right to Correction & Erasure (Section 12): You have the right to request correction of inaccurate or misleading personal data, completion of incomplete data, and erasure of personal data that is no longer necessary for the purpose for which it was collected.
• Right to Grievance Redressal (Section 13): You have the right to register a grievance with us regarding our handling of your personal data, and to escalate unresolved grievances to the Data Protection Board of India.
• Right to Nominate (Section 14): You have the right to nominate another individual to exercise your data protection rights in the event of your death or incapacity.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. Note that withdrawal may affect our ability to provide certain features of the Service.

How to Exercise Your Rights

Data Principals may exercise their rights by contacting us at:

We will verify your identity before processing any request and respond within 30 days. For student and parent data, requests should be directed to the relevant School (as Data Fiduciary) in the first instance. The School may then coordinate with us to fulfil the request.

10. Children’s Data

Protoco processes data of students who may be children (below 18 years of age) as defined under the DPDPA, 2023. We take special care with children’s data:

• Consent: Processing of children’s personal data requires verifiable consent from a parent or legal guardian, as mandated by Section 9 of the DPDPA, 2023. Schools, as Data Fiduciaries, are responsible for obtaining this consent before entering student data on the Platform.
• No harmful processing: We do not process children’s data in any manner that is likely to cause detrimental effect to their well-being.
• No tracking or profiling: We do not engage in behavioural tracking, targeted advertising, or profiling of children.
• Minimal collection: Only data necessary for the fee management purpose is collected — we do not collect biometric data, health data, or any sensitive personal data of children beyond what is specified in Section 3.2.

11. Cookies & Tracking Technologies

We use cookies and similar technologies to enhance your experience on the Platform:

11.1 Types of Cookies We Use

• Essential Cookies: Required for the Platform to function correctly, including authentication and session management. These cannot be disabled.
• Functional Cookies: Remember your preferences and settings to provide a personalised experience.
• Analytics Cookies: Help us understand how users interact with the Platform so we can improve the Service. These use anonymised and aggregated data.

11.2 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may impair the functionality of the Platform. We do not use cookies for cross-site tracking or targeted advertising.

12. WhatsApp Communications & Privacy

Our Service uses the WhatsApp Business API to send fee-related notifications to parents and guardians. Here is how we handle data in this context:

• Data shared: Parent/guardian phone numbers and message content (fee amounts, student name, payment status, due dates) are shared with the WhatsApp Business API provider for message delivery.
• Consent: Schools are responsible for obtaining consent from parents/guardians before their phone numbers are used for WhatsApp communications.
• Message types: Only transactional messages related to fee management are sent. We do not send promotional or marketing messages.
• Opt-out: Parents/guardians may opt out of WhatsApp notifications by informing their School. Schools must honour opt-out requests and update the Platform accordingly.
• Third-party terms: Messages delivered via WhatsApp are also subject to WhatsApp’s Privacy Policy and Terms of Service.

13. Payment Data Disclaimer

The payment-related data we store consists solely of records manually entered by School Administrators after payments have already been received directly by the School. This includes transaction reference numbers (UPI IDs, bank transfer references, cheque numbers), payment amounts, dates, and payment modes. This data serves as a digital ledger for record-keeping purposes only and does not enable us to initiate, process, or reverse any financial transaction.

14. Data Fiduciary Obligations

In accordance with the DPDPA, 2023, we fulfil the following obligations as a Data Fiduciary (for School Administrator data) and Data Processor (for student/parent data):

• Purpose limitation: We process personal data only for the specific, lawful purposes stated in this Policy.
• Data minimisation: We collect only the data that is reasonably necessary for the stated purposes.
• Storage limitation: We do not retain personal data beyond the period necessary for its intended purpose, except where required by law.
• Accuracy: We take reasonable steps to ensure that personal data in our systems is accurate and up to date, and we provide mechanisms for correction.
• Security safeguards: We implement reasonable security safeguards to prevent personal data breaches, as detailed in Section 5.
• Breach notification: We will notify relevant parties and the Data Protection Board of India in the event of a personal data breach, as required under the DPDPA, 2023.

15. Grievance Redressal

In compliance with the Information Technology Act, 2000, the SPDI Rules, and the DPDPA, 2023, we have appointed a Grievance Officer to address your concerns regarding personal data:

• Grievances will be acknowledged within 24 hours of receipt.
• We will investigate and resolve grievances within 15 days from the date of receipt.
• If you are dissatisfied with our resolution, you may escalate your grievance to the Data Protection Board of India under Section 13 of the DPDPA, 2023.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes:

• We will update the “Last Updated” date at the top of this page.
• We will notify registered School Administrators via email or in-app notification of material changes.
• We will provide at least 15 days’ notice before material changes take effect.
• Your continued use of the Service after the updated Policy takes effect constitutes your acceptance of the changes.

17. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of Dibrugarh, Assam, India, subject to the arbitration provisions in our Terms of Service.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: