This Privacy Policy explains how Kurripedu Educational Suite ("Kurripedu", "we", "us", "our"), operated by KurippEdu Technologies Pvt. Ltd., a company incorporated in India, collects, uses, discloses, and protects Personal Data in connection with our website, platform, mobile applications, and related services (collectively, the "Platform").
This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable Indian data protection laws and rules made thereunder.
Kurripedu provides its Platform to universities, colleges, and schools ("Institutions" or "Customers"), who use it to manage academic, administrative, and student-related activities. Please read this Policy carefully to understand how we handle Personal Data.
1. Scope of this Policy
This Policy applies to:
- Visitors to our website who make enquiries, request demos, or interact with our sales/support teams;
- Institutions (universities, colleges, schools) that subscribe to or use the Platform, and their authorised staff/administrators; and
- Students, faculty, and other individuals whose Personal Data is entered into, or generated by, the Platform by an Institution ("End Users").
Where Kurripedu processes Personal Data of End Users on behalf of and under the instructions of an Institution, the Institution acts as the Data Fiduciary and Kurripedu acts as a service provider processing such data strictly for the purposes instructed by the Institution. Section 9 explains this relationship in more detail.
2. Personal Data We Collect
2.1 Data collected directly by Kurripedu (from Institutions/website visitors)
When you interact with our website or engage with us directly (e.g., to request a demo, sign a contract, or contact support), we may collect:
- Institution/organisation name, designation, and department;
- Contact person's name, email address, and phone number;
- Billing and payment-related information;
- Technical information such as IP address, browser/device type, cookies, and usage data on our website; and
- Any other information you voluntarily submit to us (e.g., via contact forms or support tickets).
2.2 Data processed on behalf of Institutions (End User data)
As instructed by an Institution, the Platform may collect and process the following categories of Personal Data relating to students, faculty, and staff:
- Identity and contact details: name, date of birth, gender, photograph, address, phone number, email, nationality;
- Academic records: enrolment/admission details, grades, attendance, course and examination data, certificates;
- Family/guardian details: parent/guardian name and contact information (particularly for students who are minors);
- Institutional identifiers: roll number, registration number, employee ID;
- Attendance and access data: biometric or facial recognition data (only where the Institution has enabled such features), location data, device identifiers, IP address;
- Financial data: fee payment details, scholarship information, bank details (where applicable); and
- Any other data the Institution chooses to record on the Platform in the course of its academic or administrative operations.
Note: The exact categories of data collected depend entirely on the modules and features an Institution chooses to activate.
3. Consent
3.1 Kurripedu relies on the consent obtained by the Institution from its students, faculty, and staff (or, where applicable, their parents/guardians) as the lawful basis for processing their Personal Data on the Platform. Institutions are responsible for obtaining valid, informed consent before entering End User data into the Platform.
3.2 Children's Data: Under the DPDP Act, any individual under the age of 18 is treated as a "child," and processing of a child's Personal Data requires verifiable consent from a parent or lawful guardian. Institutions using Kurripedu to manage student data for minors are responsible for obtaining such verifiable parental/guardian consent before enrolling a minor's data on the Platform. Kurripedu does not knowingly:
- undertake tracking or behavioural monitoring of children, or
- serve targeted advertisements directed at children,
through the Platform.
3.3 For website visitors and Institution representatives, consent is obtained through clear opt-in mechanisms (such as checkboxes on contact/demo-request forms) at the point of data collection.
4. Purposes for Which We Use Personal Data
We (and, where applicable, Institutions using the Platform) may use Personal Data for the following purposes:
- To provide, operate, and maintain the Platform and its features (e.g., attendance, examinations, fee management, communication tools);
- To create and manage user accounts and institutional profiles;
- To communicate with Institutions and, where relevant, End Users regarding the services;
- To process payments and manage billing;
- To provide customer support and respond to queries or complaints;
- To improve, secure, and troubleshoot the Platform;
- To detect and prevent fraud, unauthorised access, or misuse of the Platform;
- To comply with applicable laws, regulations, and lawful requests from government or regulatory authorities;
- To send administrative communications, service updates, and (with consent) marketing communications; and
- For any other purpose specifically notified to you at the time of data collection.
5. Disclosure of Personal Data
We may disclose Personal Data to:
- Group companies and affiliates of Kurripedu, where necessary to provide the Platform;
- Third-party service providers who support our operations (e.g., cloud hosting, payment processors, communication tools), bound by confidentiality and data protection obligations;
- The relevant Institution, where End User data is being managed on that Institution's behalf;
- Government authorities, regulators, or law enforcement agencies, where required under applicable law; and
- Any party to whom you have specifically authorised disclosure.
We do not sell Personal Data to third parties.
6. Data Hosting and Storage
6.1 Personal Data collected or processed through the Platform is hosted on cloud servers located within India, with appropriate technical and organisational security safeguards.
6.2 As of the date of this Policy, we do not transfer Personal Data outside India. If this changes in the future, we will update this Policy and, where required, put in place appropriate safeguards consistent with the DPDP Act and rules issued by the Central Government.
7. Data Security
We implement reasonable security safeguards to protect Personal Data against unauthorised access, use, alteration, disclosure, or destruction, including:
- Encryption of data in transit and at rest;
- Role-based access controls and authentication mechanisms;
- Regular security assessments and monitoring; and
- Internal policies governing access to and handling of Personal Data.
Facial recognition/biometric data (where enabled by an Institution) is stored with additional access restrictions and is used solely for the purpose of attendance/identity verification as configured by the Institution.
8. Data Retention
8.1 We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including to comply with legal, accounting, or reporting obligations.
8.2 For End User data processed on behalf of an Institution, the Institution determines the applicable retention period, subject to any minimum periods required under applicable law (e.g., academic record-keeping requirements). Upon termination of an Institution's subscription, data will be retained or deleted in accordance with the agreement between Kurripedu and that Institution, and we will provide reasonable prior notice before permanent deletion.
9. Relationship with Institutions (Data Fiduciary vs. Service Provider)
9.1 Institutions (universities, colleges, schools) are the primary point of contact for End Users (students, faculty, staff) regarding the processing of their Personal Data on the Platform.
9.2 Kurripedu processes End User data strictly under the instructions of, and pursuant to a written agreement with, the relevant Institution.
9.3 If you are a student, parent, or staff member of an Institution using Kurripedu and wish to exercise your rights regarding your Personal Data (access, correction, erasure, grievance, or withdrawal of consent), please contact your Institution's administrator directly, as they control the settings and data held on the Platform. Kurripedu will support Institutions in fulfilling such requests as required under our agreements and applicable law.
10. Your Rights Under the DPDP Act
Subject to applicable law, Data Principals (individuals) have the right to:
- Obtain a summary of the Personal Data being processed about them and the processing activities undertaken;
- Request correction, completion, or updating of their Personal Data;
- Request erasure of their Personal Data (where retention is no longer necessary);
- Nominate another individual to exercise their rights in the event of death or incapacity;
- Withdraw consent at any time (which may affect our/the Institution's ability to continue providing services); and
- Register a grievance regarding the processing of their Personal Data.
Requests relating to End User data should be directed to the relevant Institution (see Section 9). Requests relating to data collected directly by Kurripedu (e.g., from website visitors or Institution representatives) can be sent to our Grievance Officer (Section 13).
We will endeavour to respond to valid requests within the timelines prescribed under the DPDP Act and its rules.
11. Data Breach Notification
In the event of a Personal Data breach, Kurripedu will:
- Promptly assess the nature and scope of the breach;
- Notify the Data Protection Board of India and affected Institutions/Data Principals as required under the DPDP Act and applicable rules; and
- Take reasonable remedial measures to contain and mitigate the impact of the breach.
12. Cookies and Similar Technologies
Our website may use cookies and similar technologies to:
- Enable core website functionality;
- Understand how visitors use our website; and
- Improve website performance and user experience.
You can manage or disable cookies through your browser settings; however, this may affect certain website features.
13. Grievance Officer / Contact Us
If you have questions about this Policy, wish to raise a grievance, or want to exercise your rights under the DPDP Act (in relation to data collected directly by Kurripedu), please contact:
Grievance Officer / Data Protection Officer
KurippEdu Technologies Pvt. Ltd.
Registered Address: CIRI, MCC–MRF Innovation Park, Madras Christian College, Chennai – 600059
Email: sales@kurippedu.in
We will acknowledge and address your grievance within the timelines prescribed under applicable law.
14. Third-Party Links
Our website or Platform may contain links to third-party websites. We are not responsible for the privacy practices of such third parties, and we encourage you to review their privacy policies separately.
15. Updates to this Policy
We may update this Policy from time to time to reflect changes in our practices, legal requirements, or the DPDP Act and its rules. The updated Policy will be posted on our website at kurippedu.in/privacy-policy with a revised "Last Updated" date. Continued use of the Platform after such changes constitutes acceptance of the updated Policy.