Privacy Policy

1. Introduction

This Privacy Policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act") of India.

Tutionwale ("Platform") is owned and operated by Sentriqo IT Solutions Private Limited ("Company," "we," "our," or "us"), a company incorporated under the Companies Act, 2013, having its registered office in India.

This Policy explains how we collect, use, store, disclose, and protect the personal data of our users, including tuition centre owners, administrators, teachers, students, and parents/guardians who access or use our Platform.

By accessing or using the Platform, you consent to the collection and processing of your data as described herein. If you do not agree with this Policy, please refrain from using the Platform.

2. Definitions

• "Data Principal" means the individual to whom the personal data relates (as defined under the DPDP Act, 2023).
• "Data Fiduciary" means Sentriqo IT Solutions Private Limited, which determines the purpose and means of processing personal data.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Sensitive Personal Data or Information" (SPDI) means data as defined under Rule 3 of the SPDI Rules, 2011, including passwords, financial information, biometric data, and similar categories.
• "Processing" includes collection, storage, use, disclosure, sharing, and erasure of personal data.

3. Information We Collect

3.1 Personal Data Provided by You

• Full name, email address, mobile number
• Tuition centre business details (name, address, GSTIN if applicable, logo)
• Student information (name, admission number, date of birth, class/batch details)
• Parent/guardian name, contact number, email address
• Login credentials (password stored in hashed/encrypted format)

3.2 Sensitive Personal Data or Information (SPDI)

• Payment and billing information (processed via PCI DSS compliant third-party gateways; we do not store card details)
• Biometric attendance data (fingerprint device identifiers used for attendance tracking)
• Passwords (stored using industry-standard bcrypt hashing)

3.3 Automatically Collected Data

• IP address, browser type, operating system, device information
• Access timestamps and usage patterns
• Cookies essential for authentication and session management

4. Purpose of Data Collection

We collect and process your data for the following lawful purposes:

• To provide, operate, and maintain tuition management services
• To process student attendance and send real-time notifications to parents/guardians
• To generate fee invoices and facilitate payment processing
• To enable communication via SMS, email, and WhatsApp notifications
• To manage subscriptions and billing for tuition centre accounts
• To improve Platform functionality, performance, and user experience
• To provide customer support and respond to queries
• To comply with applicable legal and regulatory obligations
• To detect, prevent, and address fraud, security issues, or technical problems

5. Lawful Basis for Processing

Under the DPDP Act, 2023, we process personal data based on:

• Consent: Obtained at the time of registration and use of the Platform
• Legitimate Use: For performance of services you have requested
• Legal Obligation: To comply with applicable Indian laws and regulations

6. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share information only in the following circumstances:

• Payment Processors: Razorpay or other RBI-authorised payment gateways for processing transactions
• Communication Service Providers: Email (SMTP), SMS gateways, and WhatsApp Business API providers for sending authorised notifications
• Tuition Centre Administrators: Student and attendance data is accessible to the registered tuition centre that manages the student
• Parents/Guardians: Attendance records, fee invoices, and announcements related to their ward
• Legal & Regulatory Authorities: When required by law, court order, government directive, or under the provisions of the IT Act, 2000 or DPDP Act, 2023
• Professional Advisors: Auditors, legal counsel, or consultants bound by confidentiality obligations

7. Data Storage & Security

In accordance with Section 43A of the IT Act, 2000 and the SPDI Rules, 2011, we implement reasonable security practices and procedures, including:

• TLS 1.2/1.3 encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Bcrypt hashing for passwords (irreversible)
• Role-based access controls (RBAC) and least privilege principles
• Regular security audits and vulnerability assessments
• Automated daily encrypted backups with redundant storage
• Multi-tenant data isolation ensuring strict separation of each centre's data

All data is stored on servers located in India or with service providers who comply with Indian data protection laws.

8. Data Retention

• Personal data is retained for as long as the account remains active or as necessary to provide services
• Upon account termination, data is retained for a maximum of 90 days for backup and recovery purposes, after which it is securely erased
• Financial and transaction records are retained for a minimum of 8 years as required under the Income Tax Act, 1961 and GST regulations
• Data required to comply with legal obligations, resolve disputes, or enforce agreements may be retained longer

9. Rights of Data Principals

Under the DPDP Act, 2023, you have the following rights:

• Right to Access: Request a summary of your personal data and the processing activities performed
• Right to Correction: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to Withdraw Consent: Withdraw consent at any time; however, this may affect your ability to use the Platform
• Right to Nominate: Nominate another individual to exercise your rights in case of death or incapacity
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer or the Data Protection Board of India

To exercise any of these rights, contact our Grievance Officer at the details provided below.

10. Cookies

We use strictly necessary cookies for authentication, session management, and CSRF protection. We do not use third-party tracking cookies or cookies for advertising purposes. By using the Platform, you consent to the use of these essential cookies.

11. Children's Data

The Platform processes student data on behalf of tuition centres. In accordance with the DPDP Act, 2023, personal data of children (below 18 years of age) is collected and processed only with verifiable consent from their parent or lawful guardian, obtained through the tuition centre registration process. We do not directly solicit data from children.

12. Cross-Border Data Transfer

We primarily store and process data within India. In the event data is transferred to jurisdictions outside India, such transfer shall be carried out in compliance with the provisions of the DPDP Act, 2023 and only to countries or entities notified by the Central Government as permissible.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The revised policy will be posted on this page with an updated "Last updated" date. Where changes are significant, we will notify registered users via email. Continued use of the Platform after such changes constitutes acceptance of the revised Policy.

14. Grievance Officer

In compliance with Section 13 of the DPDP Act, 2023 and Rule 5(9) of the SPDI Rules, 2011, the details of the Grievance Officer are as follows:

15. Contact Us

For questions or concerns about this Privacy Policy, please contact: