01
Who we are and what this notice covers
St. John's Higher Secondary School, Barama (“the school”, “we”, “us”) is a religious minority educational institution managed by the Diocese of Bongaigaon. For the purposes of the Digital Personal Data Protection Act, 2023 (“the DPDP Act”) the school is the Data Fiduciary — the body that decides why and how personal data is processed. If you are a student, parent, guardian, member of staff or a visitor to this website, you are a Data Principal.
This notice explains what personal data we hold, why we hold it, who processes it on our behalf, how long we keep it and the rights you can exercise. It applies to:
- this website, stjohnshsschoolbarama.com;
- the school's management system, Academica ERP, and the parent and student app built on it;
- records kept in the school office, the classroom, the laboratories, the hostels and on the campus generally, including RFID gate attendance and CCTV.
It does not apply to websites we link to. Those are governed by their own policies, which you should read before using them.
02
The personal data we hold
We collect only what the school actually needs to admit, teach, safeguard and account for its students, and to run the institution. Broadly, it falls into three groups.
Students, parents and guardians
- Identity and contact: name, date of birth, gender, photograph, address, parents' or guardian's names, occupation, phone numbers and email address.
- Admission and statutory: previous school records, transfer and birth certificates, category and, where a scheme requires it, Aadhaar or UDISE-linked identifiers collected in the form prescribed by the education department.
- Academic: class and section, attendance, assessment marks, board registration and results, remarks and conduct records.
- Fees and payments: fee heads due and paid, receipts, payment references and bank details supplied for a refund.
- Health and welfare: blood group, allergies and medical conditions disclosed by parents so the school can act in an emergency.
- Campus safety: RFID card identifier and the entry and exit scans recorded at the school gate, transport route and bus stop, hostel records, and CCTV footage of common areas.
Staff and applicants
- Identity and contact details, qualifications, experience, appointment and service records, attendance and leave, payroll, statutory numbers such as PAN and provident fund, and bank details for salary.
Visitors to this website
- What you send us: the enquiry form on the contact page does not transmit anything to a server of ours — it opens a message in your own mail application, addressed to the school office. Whatever you choose to send in that email reaches us as an ordinary email.
- Technical data: IP address, browser and device type, referring page and pages viewed. This is handled by Cloudflare, which serves and protects the site, and by Google Analytics in aggregate form. See the Cookie Policy.
What we do not do
We do not sell personal data. We do not rent or trade contact lists. We do not run behavioural advertising of any kind on this website, and we do not profile students for commercial purposes.
03
Why we process it, and on what basis
Under the DPDP Act personal data may be processed either with the consent of the Data Principal or for certain legitimate uses recognised by the Act. Our purposes are:
| Purpose | What it covers | Basis |
|---|---|---|
| Admission and enrolment | Assessing an application, verifying documents, allotting a class and creating the student record in Academica ERP | Consent of the parent or guardian |
| Teaching and assessment | Attendance, class work, examinations, results, transcripts and certificates | Performance of the school's function as an educational institution |
| Safety and safeguarding | RFID attendance at the gate, CCTV in common areas, transport and hostel records, emergency medical response | Protecting the interests of the child; consent for the health information you disclose |
| Fees and accounts | Raising demands, collecting payments, receipts, audit and taxation | Compliance with law and the school's contract with the family |
| Statutory reporting | Returns to SEBA, AHSEC, UDISE+ and the education department | Compliance with law |
| Communication | Circulars, notices, results and emergency messages by app, SMS or email | Performance of the school's function; consent for non-essential messages |
| Publicity | Photographs and video of school events used on this website, the app and in the prospectus | Consent, which may be withdrawn at any time |
| Employment | Recruitment, service records, payroll and statutory filings for staff | Employment purposes and compliance with law |
| Website measurement | Aggregate page and traffic statistics | Consent, where analytics cookies are set |
04
Children's data and parental consent
Almost every student at St. John's is a child in law. The DPDP Act places particular obligations on anyone processing a child's personal data, and we take them as the floor rather than the ceiling.
- We process a child's personal data only with the verifiable consent of a parent or lawful guardian, taken at admission and refreshed when a new purpose arises.
- We do not undertake tracking or behavioural monitoring of children, and we do not serve targeted advertising directed at children. No advertising or profiling technology is used on this website.
- We do not process a child's personal data in any way that is likely to cause a detrimental effect on the child's well-being.
- Photographs and video of students are published only where consent has been given, and are removed on request. Names are not published alongside images of students except for academic and sporting achievement, where the family has agreed.
- Parent and guardian accounts in Academica ERP and the school app are issued to the person recorded as the guardian. Please tell the office promptly if guardianship or custody arrangements change.
The same protections apply to a student with a disability who has a lawful guardian.
Withdrawing consent for photographs
A written note to the school office naming your child and class is enough. We will stop using new images and remove existing ones from the website and app within a reasonable time.
05
The systems and partners that process data for us
Some processing is carried out on our instructions by service providers, who act as Data Processors. They may use the data only for the purposes we specify, under contract, and must protect it with security safeguards. Responsibility to you remains with the school.
| Provider | What it does for us | Where processed |
|---|---|---|
| Academica ERP | School management system (admissions, attendance, fees, results, parent portal and school app) | India |
| Techimpace Innovations | IT partner for the school app, website and online teaching platform | India |
| Google Analytics (Google LLC) | Aggregate website traffic measurement | United States and other Google data centres |
| Cloudflare, Inc. | Authoritative DNS, content delivery, TLS and bot / attack protection for this website | Global edge network |
Academica ERP
Academica ERP is the school's system of record. Admissions, attendance, examination marks, fee accounting, circulars and the parent and student app all run on it, and access is restricted by role — a class teacher sees their class, the accounts section sees fee data, and parents see only their own child. Our data-protection practice is aligned to how that system is configured: consent taken at admission is recorded against the student record, access is logged, and correction requests are actioned in the ERP so that every downstream report and certificate carries the corrected value.
Google Analytics
We use Google Analytics to understand, in aggregate, which pages families find useful — for example how many people read the admission page in a given week. We do not use it to identify individuals and we do not link analytics data to a student record. Analytics cookies are set only where consent is given; see the Cookie Policy.
Cloudflare
Cloudflare provides authoritative DNS for our domain and serves this website through its network, with TLS encryption and protection against bots and denial-of-service attacks. To do that it necessarily processes technical data such as your IP address and request headers. This is a strictly necessary security function.
Techimpace Innovations
Our IT partner builds and maintains the school app, this website and the online teaching platform. Their access to live data is limited to what a support task requires.
07
How long we keep it
We erase personal data once the purpose it was collected for is served and no law requires us to keep it. Because a school issues certificates and verifies records decades after a student leaves, some academic records are kept permanently as the register of record.
| Record | Kept for | Why |
|---|---|---|
| Admission records and academic history | Permanently, as the school's register of record | Statutory and archival obligation; needed to issue transcripts and duplicate certificates years later |
| Attendance, RFID gate logs and CCTV footage | RFID logs for the academic session; CCTV normally 30–90 days unless retained for an incident | Safety, attendance accuracy and incident investigation |
| Fee and payment records | 8 years from the end of the financial year | Accounting, audit and tax obligations |
| Enquiry emails from this website | Until the enquiry is closed, and up to 12 months thereafter | To answer follow-up questions from the same family |
| Staff employment records | For the duration of service and as required after it by labour and provident-fund law | Employment and statutory obligation |
| Website analytics | Up to 14 months in aggregate form | Understanding which pages families use |
08
How we protect it
We take reasonable security safeguards to prevent personal data breaches, including:
- role-based access in Academica ERP, so staff see only the records their duties require, with individual logins rather than shared ones;
- encryption in transit — this website and the ERP are served over HTTPS, with TLS terminated at Cloudflare's edge;
- physical controls on the office and record room, RFID access at the gate and CCTV in common areas;
- backups of the ERP database, and restricted administrative access held by the Principal and the IT partner;
- instructions to staff not to hold student data in personal spreadsheets, private messaging groups or personal devices.
No system is perfectly secure, and data sent over the internet always carries some risk. If a breach does occur we will act on it as set out in section 11.
09
Your rights as a Data Principal
The DPDP Act gives you the following rights in respect of personal data the school holds about you, or about your child where you are the parent or guardian.
Access to information
Ask for a summary of the personal data the school holds about you or your child, the processing carried out, and the parties it has been shared with.
Correction and completion
Ask the school to correct inaccurate data or complete data that is incomplete — a misspelt name, a wrong date of birth, an out-of-date address or phone number.
Erasure
Ask for erasure of personal data that is no longer needed for the purpose it was collected for, unless the school must keep it to comply with the law.
Withdrawal of consent
Where processing rests on your consent — photographs used in publicity, for example — withdraw that consent at any time. Withdrawal does not undo processing already carried out lawfully.
Nomination
Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
Grievance redressal
Raise a grievance with the school's Grievance Officer, and escalate to the Data Protection Board of India if the response does not satisfy you.
How to exercise them
Write to the Grievance Officer named in section 12, from the email address or phone number registered with the school, or hand a signed application in at the office. Tell us the student's name and class, what you want done and how we should reply. We may ask for proof of identity or guardianship — that check protects the child.
We will respond within 30 days of receiving a complete request. There is no charge.
Your duties
The Act also asks Data Principals to act in good faith: to give authentic information, not to impersonate another person, not to suppress material information in a statutory form, and not to file false or frivolous complaints. Please keep the contact details on the ERP current — a great deal of what the school sends is time sensitive.
11
If a personal data breach occurs
If personal data in our care is lost, disclosed or accessed without authorisation, we will act promptly to contain it, assess what has been affected and restore the records. In the manner and within the time required by the DPDP Act and the rules made under it, we will give notice of the breach to the Data Protection Board of India and to each affected Data Principal, describing what happened, its likely consequences, the measures being taken and what you can do to protect yourself.
If you believe an account, an RFID card or a login has been compromised, tell the school office at once so that it can be suspended.
12
Grievance redressal
If you are unhappy with how the school has handled your personal data or answered a request, raise it with our Grievance Officer. Please give the student's name and class, what happened and what you would like done.
Grievance Officer — Data Protection
- Officer
- The Principal, St. John's H.S. School, Barama
- Telephone
- +91 88762 81051
- By post
- Barama, Baksa, Assam — 781346, India
- We respond within
- 30 days of a complete request
If our response does not resolve the matter, you may complain to the Data Protection Board of India in the manner provided by the DPDP Act.
13
Changes to this notice
We review this notice when the law changes, when we add or replace a system, or when the school begins processing personal data for a new purpose. The current version is always published on this page with the date it took effect. Where a change materially affects how we use data you have given us, we will tell parents through the school app, a circular or email.
A note on how this notice was written
This notice describes the school's actual practice and is written to meet the requirements of the Digital Personal Data Protection Act, 2023. It is not legal advice, and it does not replace the specific consents you sign at admission. Where a consent form and this notice differ on a particular point, the signed form governs that point and we will correct this page.