Privacy Notice
This notice explains how the school (the Data Fiduciary) uses your personal data in the Question Bank system, as required by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
1. Personal data we keep
- For staff who use the system: full name, login name, role, and (only if given) email and mobile number.
- Your password is never stored; only a one-way protected form of it (PBKDF2 hash) is kept.
- Security logs: date and time of each login, the IP address, and what you changed, deleted, printed or exported.
- No personal data of students is collected. Question papers carry only blank Name / Roll No. boxes.
2. Why we use it
- To let you sign in and use the screens your role allows.
- To keep the question bank and question papers secure and confidential, and to find out who made a change if needed.
- This is use for the purposes of your work with the school (a legitimate use under Section 7 of the Act). The data is not used for anything else, not sold and not shared for marketing.
- The optional "Generate with AI" button for blueprint instructions sends only the blueprint details (class, subject, question types, marks) – never personal data.
3. How long we keep it
- Your account details: as long as you are a user. When the Admin removes your account, your name, login name, email, mobile and passwords are erased; only "Deleted user #number" remains so that records still show they were made by someone.
- Login history and activity log: 365 days (for security, as the DPDP Rules require logs for at least one year), then removed automatically.
4. How it is protected
- Passwords are hashed; accounts lock after repeated wrong passwords; logins end after 30 minutes without use.
- Every screen checks your login and role; pages with question papers are not kept in the browser cache.
- The connection should be encrypted (HTTPS) and the database is kept on the school's protected server with backups.
- In case of a personal data breach, the school will inform the Data Protection Board of India and the affected persons as the Rules require.
5. Your rights
- Access and correction: see and correct your own name, email and mobile, and see your recent logins, on My Profile.
- Erasure: ask the Admin or the Grievance Officer to remove your account when you no longer need it.
- Grievance: contact the Grievance Officer below; you will get a reply within 90 days. If you are not satisfied, you may complain to the Data Protection Board of India.
- Nomination: you may name a person to use these rights for you in case of death or incapacity, by writing to the Grievance Officer.
6. Grievance Officer / contact
Please contact the school office or the Admin of this system. (Admin: enter the Grievance Officer in Web.config – GrievanceOfficerName, GrievanceOfficerEmail, GrievanceOfficerPhone.)