1. Acceptance of Terms
By accessing or using the Shalalink platform (“Platform”), including its web application and mobile application, you (“User”) agree to be bound by these Terms of Use and Privacy Policy (“Agreement”). If you do not agree to any part of this Agreement, you must immediately cease using the Platform.
This Agreement is an electronic record as defined under the Information Technology Act, 2000 and does not require a physical or digital signature to be legally binding. For school staff and teachers, participation in the Platform as part of their employment at the School constitutes acceptance of this Agreement.
IT Act 2000 — Section 10A | Indian Contract Act 1872
2. Eligibility & Authorised Users
The Platform is restricted to authorised personnel of Sri Markandeshwara English Medium Primary and High School, Hospet and their registered parents or guardians. Access is granted only through an official invitation issued by the school administration.
By using the Platform, you represent that:
- You are at least 18 years of age, or a parent/guardian acting on behalf of a minor student;
- You have the legal authority to enter into this Agreement;
- All information you provide is accurate and current.
Minor users (students below 18 years) may not directly access the Platform. Access to a student's data is provided only to the registered parent or guardian of that student.
Parent consent at every login. Parents and guardians must accept this Agreement in the mobile app before they can enter it: by ticking three separate boxes (1. these Terms and Privacy Policy; 2. processing of the child's data; 3. notifications and messages) and tapping “I Agree & Continue”. This is checked every time a parent logs in, and repeated whenever these terms change materially. A parent who does not accept cannot use the app; the School will continue to serve the child and will communicate with the parent by other means.
3. Platform Access & User Accounts
Access to the Platform requires phone-number-based OTP (One-Time Password) authentication. You are solely responsible for maintaining the confidentiality of your registered phone number and any active session on the Platform.
You agree not to:
- Share your account access with any unauthorised person;
- Use another person's credentials to access the Platform;
- Attempt to bypass authentication mechanisms.
Holalkere Technologies (OPC) Private Limited reserves the right to suspend or terminate your account if misuse is detected.
4. Prohibited Conduct
You agree not to use the Platform to:
- Upload, share, or transmit any content that is unlawful, abusive, defamatory, obscene, or harassing;
- Impersonate any person or entity;
- Introduce any virus, malware, or disruptive code;
- Attempt unauthorised access to any system, server, or database connected to the Platform;
- Collect or harvest personal data of other users without authorisation;
- Use the Platform for any commercial purpose other than its intended use as a school management tool;
- Violate any applicable Indian or international law.
Violations may be reported to the appropriate authorities under Sections 43, 66, 66C, 66D, and 67 of the IT Act, 2000.
5. Intellectual Property
All software, design, code, text, logos, and features of the Shalalink Platform are the exclusive intellectual property of Holalkere Technologies (OPC) Private Limited. No portion of the Platform may be copied, modified, distributed, reverse-engineered, or used for commercial purposes without prior written consent.
Data entered by users (student records, attendance, fees, etc.) remains the property of Sri Markandeshwara English Medium Primary and High School, Hospet. Holalkere Technologies (OPC) Private Limited acts as a data processor on behalf of the School.
6. Disclaimer & Limitation of Liability
The Platform is provided on an “as is” and “as available” basis. Holalkere Technologies (OPC) Private Limited makes no warranties, express or implied, regarding the Platform's uninterrupted availability, accuracy, or fitness for a particular purpose.
To the fullest extent permitted by applicable Indian law, Holalkere Technologies (OPC) Private Limited shall not be liable for:
- Any loss of data resulting from user error;
- Service interruptions due to third-party infrastructure;
- Indirect, incidental, or consequential damages arising from use of the Platform;
- Actions of third parties who gain unauthorised access due to user negligence (e.g., sharing credentials);
- Acts or omissions of the School, its staff or other users, or the accuracy of records entered by the School (see Section 22).
Our maximum liability in any event shall not exceed the amount paid (if any) by the School for Platform services in the three months preceding the incident.
Nothing in this Agreement limits any liability that cannot be limited under Indian law, or takes away any right of a Data Principal under the DPDPA 2023. To the extent permitted by law, the User shall compensate Holalkere Technologies (OPC) Private Limited for losses arising from the User's breach of this Agreement, misuse of the Platform, unlawful content posted, or false declarations made.
7. Termination
Holalkere Technologies (OPC) Private Limited reserves the right to suspend or terminate access to the Platform at any time, with or without notice, for:
- Breach of this Agreement;
- Non-payment of service fees (if applicable);
- Closure or discontinuation of the school's subscription;
- Compliance with any court order or government directive.
Upon termination, the School's data will be retained for the period described in Section 15 and then permanently deleted.
8. Governing Law & Dispute Resolution
This Agreement shall be governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka, India.
Before initiating legal proceedings, parties agree to attempt good-faith resolution within 30 days. If unresolved, disputes may be referred to arbitration under the Arbitration and Conciliation Act, 1996. Nothing in this section prevents a Data Principal from approaching the Data Protection Board of India or any other forum available under law.
9. Roles — Data Fiduciary and Data Processor
Under the Digital Personal Data Protection Act, 2023, the entity that decides why and how personal data is processed is the Data Fiduciary; an entity that processes data on its behalf is a Data Processor.
Data Fiduciary: Sri Markandeshwara English Medium Primary and High School, Hospet
The School decides what student and parent data is entered, how accurate it is, who at the School can see it, and how long it is kept.
Contact: smsschoolhpt@gmail.com
Data Processor: Holalkere Technologies (OPC) Private Limited
Platform: Shalalink — School Management Platform (shalalink.com)
Contact Email: sumukha@holalkeretechnologies.com
Country: India
Holalkere Technologies (OPC) Private Limited provides the Platform to the School as a technology service provider. It processes personal data only on the School's instructions and under its contract with the School (DPDPA 2023, Section 8(2)), and does not decide what data is collected, how accurate it is, who at the School may access it, or how long the School keeps it.
Limited exception. Holalkere Technologies (OPC) Private Limited is itself the responsible party only for (a) records it must keep to prove consent and to secure the Platform (consent evidence, security and audit logs) and (b) enquiries made through its own website (waitlist).
10. Personal Data We Collect
| Category | Data Points | Whose Data |
|---|---|---|
| Identity Data | Full name, role (teacher / parent / admin), profile photograph (if set) | All users |
| Contact Data | Mobile phone number, email address, home address (if provided) | All users |
| Student Identity Data | Name, class, section, roll number, admission number, date of birth, gender, address, photograph | Students (minors) |
| Health & Emergency Data | Blood group, allergies, medical conditions, vaccination notes, emergency contact | Students (minors) |
| Student Academic Data | Marks, grades, report cards, attendance, timetable, lesson plans, syllabus progress | Students (minors) |
| Financial Data | Fee structure, fee payment records, salary records (staff) | Students, Staff |
| Behavioural Data | Attendance check-in/check-out, early pickup records, leave requests | Students, Staff |
| Communication Data | Chat messages between parents and teachers, school announcements | Parents, Teachers |
| Device Data | FCM token (push notifications); crash reports (device type, OS and app version) | All users |
| Consent Records | Date and time of consent (server time), IP address, phone make and model, OS and app version, random app-install ID, language and time zone, and the exact text accepted | Parents |
| Documents | Student documents uploaded by administration | Students |
11. Purpose of Processing
We process personal data solely for the following specified, explicit, and legitimate purposes:
- School Operations: Managing student records, attendance, classes, and timetables;
- Academic Management: Recording marks, lesson plans, syllabus coverage, and report generation;
- Parent Communication: Real-time attendance notifications, announcements, and parent-teacher chat;
- Fee Management: Tracking fee structures, payment records, and generating receipts;
- Staff Management: Managing teacher records, leave requests, early pickup approvals, and salary information;
- Safety & Security: Student entry/exit tracking, visitor logs, and late arrival records;
- Push Notifications: Sending relevant notifications for attendance, announcements, and fees.
We do not use personal data for advertising, profiling, or any purpose beyond school management.
DPDPA 2023 — Section 4 (Purpose Limitation)
12. Legal Basis for Processing
We process personal data under two separate legal bases depending on the user type, as recognised under the DPDPA 2023:
👨👩👧 Parents & Guardians — Consent
A child's data is processed on the parent's verifiable consent(DPDPA 2023 Section 9(1)); the parent's own data on consent under Section 6 — free, specific, informed, unconditional and unambiguous. Consent is given in the app by ticking three separate boxes (none pre-ticked) and tapping “I Agree & Continue”, and is checked at every login.
👨🏫 Teachers, Staff & Admin — Legitimate Use
Processing of staff data is based on legitimate use for employment purposes under DPDPA 2023 Section 7(c). By being employed at the School and using this Platform as part of their official duties, teachers and staff acknowledge and accept the processing of their personal data. No separate consent is required under this provision.
Notice Obligation
In all cases, as required under DPDPA 2023 Section 5, users are informed of: (a) what data is collected; (b) the purpose of processing; and (c) their rights — through this published Privacy Policy.
Withdrawal of Consent / Objection to Processing
Parents: May withdraw consent at any time, as easily as it was given, in the app under More → Terms, Privacy & Consent → Withdraw consent (DPDPA 2023 Section 6(4); SPDI Rules Rule 5(7)), or by writing to the School or the Grievance Officer. The parent is logged out and cannot use the app until consent is given again. Withdrawal does not affect processing done before it, and does not by itself delete school records the School must keep by law — requests for correction or erasure go to the School or the Grievance Officer. Records of consent and withdrawal are kept for at least 3 years (Limitation Act, 1963) to prove or defend legal claims.
Teachers & Staff: Since processing is based on legitimate employment use (not consent), formal withdrawal of consent is not applicable under DPDPA 2023 Section 7. However, staff may request erasure of their data upon cessation of employment by submitting a request through the school administration, which will officially communicate it to Holalkere Technologies (OPC) Private Limited.
DPDPA 2023 — Section 5 (Notice) | Section 6 (Consent) | Section 7(c) (Legitimate Use — Employment)
13. Children's Data (Students)
Our Obligations
- Verifiable Parental Consent: Student data is processed only on the basis of verifiable consent from the student's registered parent or guardian.
- No Behavioural Tracking: We do not track, profile, or monitor student behaviour for any commercial purpose.
- No Targeted Advertising: Student data is never used for advertising or marketing.
- No Detrimental Processing: We do not process student data in any manner detrimental to the child's wellbeing.
- Access Control: Student records are accessible only to the student's registered parent/guardian, assigned teachers, and authorised school administrators.
- Photographs: Student photographs are used only for School purposes and are never used by Shalalink for advertising or promotion.
Parent's Rights over Student Data
Parents and guardians may request access to, correction of, or deletion of their child's data through the school administration or the Grievance Officer at any time.
DPDPA 2023 — Section 9 | SPDI Rules 2011 — Rule 5
14. Data Storage, Security & Localisation
Where Data Is Stored
All personal data is stored on Google Firebase (Firestore Database and Cloud Storage), which uses servers in multiple regions. Firebase is operated by Google LLC and complies with international security standards (ISO 27001, SOC 2 Type II). Consent records are processed by cloud functions running in Mumbai, India.
Security Measures (SPDI Rules 2011 — Rule 8)
- OTP-based authentication — no passwords stored in the system;
- Role-based access control (RBAC) — users can only access data authorised for their role;
- All data transmitted over HTTPS / TLS encryption;
- Firebase Security Rules restricting database access by role and school;
- Session guard preventing concurrent unauthorised logins;
- Error monitoring and security logging.
SPDI Rules 2011 — Rule 8 | DPDPA 2023 — Section 8(5)
15. Data Retention
| Data Category | Retention Period |
|---|---|
| Active user account data | Duration of school subscription + 1 year |
| Student academic records | Duration of enrolment + 3 years |
| Fee and financial records | 7 years (as required under Indian tax law) |
| Chat messages | 1 year from date of message |
| Attendance records | Duration of enrolment + 3 years |
| Audit / activity logs | 2 years |
| Consent and withdrawal records | At least 3 years after consent ends (Limitation Act, 1963) |
| Data after account deletion request | Permanently deleted within 30 days, except records the law requires to be kept |
After the applicable retention period, data is permanently and securely deleted from all systems.
DPDPA 2023 — Section 8(7) (Storage Limitation) | Income Tax Act 1961 (7-year financial records)
16. Third-Party Service Providers
We currently use the following third-party services to operate the Platform:
| Service | Provider | Purpose | Data Shared |
|---|---|---|---|
| Firebase (Auth, Firestore, Storage, Messaging) | Google LLC | Database, authentication, file storage, push notifications | All user data |
| Sentry | Functional Software Inc. | Error monitoring and crash reporting | Device info, error logs (no personal data) |
| Resend | Resend Inc. | Transactional email notifications | Email address only |
Right to Change Third-Party Providers
Holalkere Technologies (OPC) Private Limited reserves the right, at its sole discretion, to substitute, add, or remove third-party service providers (including data processors, infrastructure providers, and communication services) at any time as necessary to operate, improve, or maintain the Platform. Such changes may be made without prior individual notification to the School or its users, provided that:
- The replacement provider maintains security standards equivalent to or higher than those of the replaced provider;
- The purpose and nature of data processing remain unchanged;
- This Privacy Policy is updated to reflect any material changes to the list of providers.
We do not sell, rent, or trade personal data to any third party for commercial purposes.
SPDI Rules 2011 — Rule 6 (Disclosure) | DPDPA 2023 — Section 8(2) (Data Processor)
17. Your Rights as a Data Principal
Under the DPDPA 2023, you have the following rights:
- Right to Access Information (Section 11): Request a summary of the personal data we hold about you and how it is being processed.
- Right to Correction and Erasure (Section 12): Request correction of inaccurate data or erasure of data no longer necessary for the stated purpose. Requests will be processed within 30 days.
- Right to Grievance Redressal (Section 13): File a complaint with our Grievance Officer. If unsatisfied, escalate to the Data Protection Board of India once it is established by the Government.
- Right to Nominate (Section 14): Nominate another individual to exercise your rights in the event of your death or incapacity.
For school staff and teachers: Requests for access, correction, or erasure of data must be submitted through the school administration, which will formally communicate the request to us.
DPDPA 2023 — Sections 11–14 | SPDI Rules 2011 — Rule 5(6)
18. Grievance Officer
As required under Rule 5(9) of the SPDI Rules, 2011 and Rule 3(2) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed the following Grievance Officer:
Grievance Officer
Name: Sumukha H R
Designation: Founder, Holalkere Technologies (OPC) Private Limited
Email: sumukha@holalkeretechnologies.com
Address: No. 61, JP Nagar, Omkar Layout, Mysore, Karnataka, India
Response Time: Acknowledgement within 24 hours; resolution within 15 days of receiving the complaint
School contact: Sri Markandeshwara English Medium Primary and High School, Hospet — smsschoolhpt@gmail.com
Complaints may be submitted by email with the subject line: “Data Privacy Complaint — Shalalink”. Please include your full name, registered phone number, and a clear description of your concern.
SPDI Rules 2011 — Rule 5(9) | IT Intermediary Rules 2021 — Rule 3(2) | DPDPA 2023 — Section 13
19. Data Breach Notification
In the event of a personal data breach, Holalkere Technologies (OPC) Private Limited will:
- Take immediate steps to contain and assess the breach;
- Promptly inform the School (the Data Fiduciary) so that it can meet its own notification duties;
- Notify the Data Protection Board of India (once operational) as required under the DPDPA 2023;
- Notify affected users within a reasonable time, describing the nature of the breach, data affected, and remedial steps taken;
- Maintain an internal record of all data breaches.
DPDPA 2023 — Section 8(6) & Schedule I
20. Amendments to This Policy
We reserve the right to amend this Policy at any time to reflect changes in law, our practices, or the Platform's features. When we make material changes, we will:
- Update the “Effective Date” at the top of this document;
- Notify active users via the app or email at least 15 days before changes take effect;
- Ask parents to accept the new version in the app at their next login — where the change is material they cannot continue until they do;
- Obtain fresh consent wherever else applicable law requires.
For school staff, continued use of the Platform after the effective date of changes constitutes acceptance of the revised Policy. Parents must accept the revised version afresh in the app.
21. Your Responsibilities (DPDPA 2023, Section 15)
- Give correct information and keep it up to date.
- Keep your phone, OTP and login private; do not let anyone else use your account, and tell the School at once if your phone is lost.
- Do not copy, screenshot, share or post other children's or staff members' information, class lists or chats outside the app.
- Do not impersonate anyone, suppress material information, or file a false or frivolous grievance.
- Follow all applicable laws.
DPDPA 2023 — Section 15 (Duties of Data Principal)
22. School Content, Accuracy & Emergencies
Attendance, marks, fees, announcements, timetables, health information and every other record shown in the app are entered and controlled by the School. Holalkere Technologies (OPC) Private Limited does not verify them and is not responsible for the School's decisions, teaching, fees, safety arrangements or communications. Questions or disputes about them are between the parent and the School.
Notifications may be delayed or fail (network, phone settings, third-party services). The app is not an emergency channel — in an emergency, call the School directly.
23. Language
English is the authoritative text. The app also shows a Kannada summary of the key points and the consent statements for convenience. A parent may ask the School for a full Kannada explanation of this notice before giving consent (DPDPA 2023, Section 5(3)).
24. Contact Us
Holalkere Technologies (OPC) Private Limited
Email: sumukha@holalkeretechnologies.com
Website: shalalink.com
Platform: Shalalink — School Management Platform
Address: No. 61, JP Nagar, Omkar Layout, Mysore, Karnataka, India