VEYHO TECHNOLOGIES PRIVACY POLICY

Effective Date: Jul 10, 2026

This Privacy Policy (“Policy”) describes how Veyho Technologies LLP, a company incorporated under the Companies Act, 2013, having its registered office at Cavansite Society, Mumbai Bangalore Highway, Warje, Pune 411058, Maharashtra, India (“Veyho”, “Company”, “we”, “our” or “us”), collects, uses, stores, discloses and otherwise processes personal data of Users of the Veyho School ERP web application, mobile application, website and related services (collectively, the “Platform”).

This Policy is issued in accordance with, and forms an integral part of, the Terms of Use governing the Platform. It applies to Schools, students, parents/guardians, teachers, administrative staff and any other authorised person who accesses or uses the Platform (“User”, “you”).

This Policy is framed in compliance with applicable Indian law, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Digital Personal Data Protection Act, 2023 (“DPDP Act”) together with the rules framed or to be framed thereunder. By using the Platform, you consent to the collection, use and disclosure of your personal data as described in this Policy.

1. Definitions

“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
“Sensitive Personal Data or Information (SPDI)” means data such as passwords, financial information, health information and biometric data, as defined under the SPDI Rules.
“Data Fiduciary” means Veyho, which determines the purpose and means of processing personal data on the Platform, jointly or severally with the School as applicable.
“Data Principal” means the individual to whom the personal data relates, and where such individual is a child, includes the parent or lawful guardian of such child.
“Child” means an individual who has not completed the age of eighteen years, as defined under the DPDP Act.
“Processing” means any operation performed on personal data, including collection, storage, use, disclosure, sharing, retention and erasure.
“Consent Manager” means a mechanism through which a Data Principal may give, manage, review or withdraw consent, where implemented by Veyho or the School.

2. Information We Collect

2.1 Information provided by the School

Student information: name, date of birth, gender, photograph, class/section, roll number, admission details, address, parent/guardian details, academic records, attendance records, examination results, disciplinary records and health/medical information (where provided for school records such as allergies or medical conditions).
Parent/Guardian information: name, contact number, email address, residential address, relationship to student and communication preferences.
Employee/Staff information: name, contact details, qualifications, employment records, attendance and payroll-related information.

2.2 Information provided directly by Users

Account credentials such as user ID and password.
Communications sent through the Platform, including messages, complaints or queries raised with the School or Veyho.
Fee payment details processed through third-party payment gateways (Veyho does not itself store card or bank credentials).

2.3 Information collected automatically

Device information such as device type, operating system and unique device identifiers.
Log data such as IP address, browser type, access timestamps and pages viewed.
Usage data collected through cookies or similar tracking technologies, used solely for functional and security purposes.

3. Purpose of Collection and Use

Personal data is collected and processed only for purposes that are specific, lawful and clearly communicated, including:

providing, operating and maintaining the Platform and its ERP modules (attendance, examinations, fees, timetable, transport, library and communication);
enabling communication between the School, parents, students and staff;
facilitating online fee payment through authorised payment gateways;
maintaining academic, administrative and disciplinary records on behalf of the School;
verifying identity and preventing unauthorised access;
complying with applicable law, regulatory requirements or lawful directions of a court or government authority;
improving the functionality, security and performance of the Platform.

Personal data shall not be processed for any purpose other than those disclosed in this Policy, except where required by law or with the further explicit consent of the Data Principal.

4. Consent

By creating an account, accessing or using the Platform, Users provide free, specific, informed, unconditional and unambiguous consent to the processing of their personal data for the purposes set out in this Policy, in accordance with Section 6 of the DPDP Act.

Where personal data relating to a student is collected, the School, acting on behalf of and with the authorisation of the parent/lawful guardian, is responsible for obtaining verifiable parental/guardian consent prior to enrolment of the student on the Platform, in accordance with Section 9 of the DPDP Act. Parents/guardians shall be treated as having provided such consent on accessing or authorising use of the Platform for their child.

Data Principals have the right to withdraw consent at any time, subject to applicable law and the terms of enrolment with the School. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal, and may result in Veyho or the School being unable to continue providing certain services.

5. Processing of Children's Data – Additional Safeguards

In accordance with Section 9 of the DPDP Act, in relation to personal data of children, Veyho shall not:

undertake processing of personal data that is likely to cause any detrimental effect on the well-being of a child;
undertake tracking or behavioural monitoring of children or targeted advertising directed at children, except for processing that is necessary for the School to fulfil its educational and administrative obligations, subject to conditions as may be prescribed.

The School shall ensure that verifiable consent of the parent or lawful guardian is obtained before a child's personal data is uploaded to or processed on the Platform, and shall be responsible for the accuracy of representations made in this regard.

6. Disclosure of Information

Personal data may be shared only in the following circumstances:

with the School, its authorised administrators and staff, to the extent necessary for academic and administrative purposes;
with parents/guardians, restricted to information relating to their own child;
with third-party service providers such as payment gateways, SMS/WhatsApp/email service providers and cloud hosting providers, solely for the purpose of enabling the relevant service and under contractual confidentiality obligations;
where required under applicable law, regulation, court order or a lawful direction of a government or regulatory authority, including under Section 36 of the DPDP Act;
with the prior consent of the Data Principal, for any purpose not otherwise covered under this Policy.

Veyho does not sell, rent or trade personal data to any third party for marketing or commercial purposes.

7. Data Storage, Security and Retention

Veyho implements reasonable security practices and procedures, including administrative, technical and physical safeguards, commensurate with the requirements of the SPDI Rules and the DPDP Act, to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include access controls, encryption of data in transit, and periodic security review.

Personal data is retained only for as long as necessary to fulfil the purposes described in this Policy, to comply with the School's record-retention obligations under applicable education laws, or as otherwise required by law. Upon expiry of the applicable retention period, or upon a valid erasure request where the purpose of processing no longer subsists, Veyho shall erase the personal data unless retention is required for legal compliance.

8. Data Breach Notification

In the event of a personal data breach, Veyho shall take prompt remedial measures to mitigate the impact of such breach and shall notify the Data Protection Board of India and the affected Data Principals in the manner and within the timelines prescribed under Section 8(6) of the DPDP Act and rules made thereunder.

9. Rights of Data Principals

Subject to the provisions of the DPDP Act, Data Principals (or, in the case of a child, their parent/lawful guardian) have the following rights:

the right to obtain a summary of personal data being processed and the processing activities undertaken (Section 11);
the right to correction, completion, updating and erasure of personal data (Section 12);
the right to grievance redressal in relation to any act or omission of Veyho regarding processing of personal data (Section 13);
the right to nominate another individual to exercise these rights in the event of death or incapacity (Section 14).

Requests to exercise these rights may be made through the School administration or directly to the Grievance/Data Protection contact provided in Section 12 below. Veyho shall respond within a reasonable time and in accordance with the timelines prescribed under applicable law.

10. Cross-Border Transfer of Data

Where personal data is processed or stored on servers located outside India, such transfer shall be undertaken in accordance with Section 16 of the DPDP Act and any notifications issued by the Central Government restricting transfer of personal data to specified countries or territories. Appropriate contractual and technical safeguards shall be maintained with any such overseas service provider.

11. Cookies and Tracking Technologies

The Platform may use cookies and similar technologies strictly for authentication, session management, security and functional purposes. Such technologies do not collect information for behavioural advertising or profiling of children. Users may control cookie settings through their browser, though this may affect certain functionalities of the Platform.

12. Grievance Officer / Data Protection Contact

In accordance with the Information Technology Act, 2000, the SPDI Rules and the DPDP Act, Veyho has designated a Grievance Officer to address any queries, concerns or complaints relating to the processing of personal data:

Name: Veyho Support
Designation: Grievance Officer / Data Protection Officer
Company: Veyho Technologies LLP
Registered Office: Cavansite Society, Mumbai Bangalore Highway, Warje, Pune 411058, Maharashtra, India
Email: support@veyho.com
Phone: +91 - XXXXXXXXXX

Users may also approach the Data Protection Board of India in accordance with the provisions of the DPDP Act, where their grievance remains unresolved.

13. Third-Party Links and Services

The Platform may contain links to or integrations with third-party websites or services, including payment gateways. This Policy does not apply to the privacy practices of such third parties, and Users are encouraged to review the privacy policies of such third-party service providers independently.

14. School's Obligations as Joint Controller of Data

The School remains responsible for the accuracy of information uploaded to the Platform, for obtaining necessary consents from parents, guardians and staff, for managing access rights of Users, and for ensuring compliance with applicable data protection and education laws in respect of data uploaded or generated by the School.

15. Changes to this Policy

Veyho may revise this Policy from time to time to reflect changes in law, regulatory requirements or the Platform's functionality. The updated Policy shall be posted on the Platform with a revised effective date. Continued use of the Platform after such revision constitutes acceptance of the updated Policy.