Privacy Policy

1. Introduction & Statutory Commitment

Unite Nexus Private Limited (“Unite”, “Company”, “we”, “our”, or “us”), operating under the brand name Unite India, is dedicated to upholding the highest standards of data security, privacy, and integrity.

This Privacy Policy describes our practices regarding the collection, storage, processing, transfer, retention, and deletion of personal data across our cloud applications, including Unite One, Unite ERP, Unite Attendance, Unite Admissions, Unite App, Unite Websites, Unite Docs, Unite Fees/Finance, and Unite Office.

We process personal data in strict compliance with the Digital Personal Data Protection Act (DPDP Act 2023), the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Scope and Legal Roles (Data Fiduciary vs. Data Processor)

Depending on the context of processing, legal responsibilities are established as follows:

• Institutional Customer as Data Fiduciary: When schools, trusts, or colleges collect, upload, and manage records of their students, teachers, staff, and parents, the educational institution acts as the primary Data Fiduciary determining the purpose of data collection. Unite acts strictly as a Data Processor executing processing operations under institutional instructions.
• Unite as Data Fiduciary: Unite acts as a Data Fiduciary strictly with respect to administrative account creation, institutional billing, customer support, and direct website visitor inquiries.

3. Information We Collect & Process

We process only information strictly necessary to deliver authorized ERP and administrative services:

• Account & Administrative Data: Institutional officer names, official email addresses, mobile numbers, designations, and role-based permissions.
• Student & Parent Academic Records: Student full names, roll numbers, admission identifiers, class and division allocations, academic performance, report cards, parent/guardian contact numbers, and emergency information.
• Attendance & Biometric Vectors: Daily roll-call punches, biometric check-in timestamps, RFID card identifiers, and mathematical facial recognition embeddings (128-dimensional numerical vectors).
• Billing & Payment Records: Fee receipt numbers, payment status, transaction identifiers, and invoice schedules. Note: Unite does not store bank account passwords, CVVs, or full payment card numbers; all transactions are routed through licensed payment aggregators (e.g. Razorpay).
• Device & Telemetry Data: IP addresses, browser types, session tokens, operating systems, and device identifiers collected to enforce multi-device limits and session security.

4. Specific Safeguards for Children's Personal Data (DPDP Act Sec. 9)

We recognize that children's personal records necessitate heightened legal care. In accordance with Section 9 of the DPDP Act 2023:

• Verifiable Parental Consent: Educational institutions are contractually required to secure verifiable consent from parents or legal guardians before registering minor students on the platform.
• Zero Targeted Advertising & Profiling: Unite strictly prohibits any form of commercial profiling, behavioral tracking, or targeted advertising directed at children or derived from student activity.
• Protection of Minor Well-being: Student data is never commercialized, monetized, or shared with third-party data brokers.

5. Biometric Data & Facial Recognition Safeguards

Unite's optional automated biometric attendance module operates with advanced mathematical lossy encryption:

• Irreversible Mathematical Embeddings: When a student registers for facial check-in, the system converts facial geometry into a 128-dimensional floating point vector. The vector is an irreversible mathematical abstraction; it is technically impossible to reconstruct or reverse-engineer the original face photograph from the numerical array.
• No Raw Verification Photos: Raw facial photographs are never retained for identity verification.
• Right to Permanent Erasure: School administrators can permanently delete facial descriptors upon student transfer, graduation, or parent opt-out with instantaneous database purging.

6. Cloud Hosting & Indian Data Localization

100% Indian Data Sovereignty: All Unite databases, application nodes, and S3 file storage are physically located within the sovereign borders of India at the Amazon Web Services (AWS) Asia Pacific (Mumbai) Region (`ap-south-1`).

Personal data is never transferred outside of India without explicit legal authorization. Storage volumes and database snapshots are protected with AES-256 server-side encryption.

7. Disclosure & Sharing of Information

Unite does not sell, rent, or trade personal data. Disclosures are limited to:

• Cloud & Infrastructure Vendors: AWS (hosting, secure storage, and database services).
• Payment Gateways: Licensed payment partners (e.g. Razorpay) to settle fees securely. Review Razorpay's privacy policy at https://razorpay.com/privacy-policy/.
• Authorized School Personnel: Teachers, principals, and administrative staff designated by the educational institution.
• Statutory Authorities: Law enforcement, courts, or CERT-In where mandated by formal legal processes under Indian law.

8. Data Retention, CERT-In Log Compliance & Permanent Deletion

In strict adherence to Section 8(7) of the DPDP Act 2023 (Purpose Limitation & Erasure) and relevant Indian cyber security regulations:

• Active Subscription Term: Institutional records are maintained for the active duration of the Customer's subscription term to service educational operations.
• Account Offboarding Grace Period: Upon contract termination, schools are provided a ninety (90) day grace period to perform verified data exports, after which all student identities, academic records, and biometric descriptors are permanently purged from active databases.
• CERT-In 180-Day System Logging Mandate: In compliance with the Cyber Security Directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, 2000, ICT application logs, authentication events, and source IP addresses are securely preserved within Indian territory for a rolling one hundred and eighty (180) day period for statutory security auditing.

9. Rights of Data Principals (Parents, Staff & Students)

Subject to applicable Indian law and institutional verification, Data Principals hold the following rights:

• Right of Access: Request a summary of personal information processed by the institution.
• Right to Correction & Updation: Rectify inaccurate, obsolete, or misleading records.
• Right to Grievance Redressal: Submit formal privacy concerns to our Grievance Officer.

10. Data Protection & Grievance Redressal Officer (DPDP Act Section 8(9))

In accordance with Section 8(9) of the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Unite has appointed a designated Grievance Redressal & Data Protection Officer: