1. Acceptance of Terms
By accessing or using the Shalalink platform (“Platform”), including its web application and mobile application, you (“User”) agree to be bound by these Terms of Use and Privacy Policy (“Agreement”). If you do not agree to any part of this Agreement, you must immediately cease using the Platform.
This Agreement is an electronic record as defined under the Information Technology Act, 2000 and does not require a physical or digital signature to be legally binding. For school staff and teachers, participation in the Platform as part of their employment at the School constitutes acceptance of this Agreement.
IT Act 2000 — Section 10A | Indian Contract Act 1872
2. Eligibility & Authorised Users
The Platform is restricted to authorised personnel of Shri Markandeshwara English Medium School, Hospet and their registered parents or guardians. Access is granted only through an official invitation issued by the school administration.
By using the Platform, you represent that:
- You are at least 18 years of age, or a parent/guardian acting on behalf of a minor student;
- You have the legal authority to enter into this Agreement;
- All information you provide is accurate and current.
Minor users (students below 18 years) may not directly access the Platform. Access to a student's data is provided only to the registered parent or guardian of that student.
3. Platform Access & User Accounts
Access to the Platform requires phone-number-based OTP (One-Time Password) authentication. You are solely responsible for maintaining the confidentiality of your registered phone number and any active session on the Platform.
You agree not to:
- Share your account access with any unauthorised person;
- Use another person's credentials to access the Platform;
- Attempt to bypass authentication mechanisms.
Holalkere Technologies (OPC) Private Limited reserves the right to suspend or terminate your account if misuse is detected.
4. Prohibited Conduct
You agree not to use the Platform to:
- Upload, share, or transmit any content that is unlawful, abusive, defamatory, obscene, or harassing;
- Impersonate any person or entity;
- Introduce any virus, malware, or disruptive code;
- Attempt unauthorised access to any system, server, or database connected to the Platform;
- Collect or harvest personal data of other users without authorisation;
- Use the Platform for any commercial purpose other than its intended use as a school management tool;
- Violate any applicable Indian or international law.
Violations may be reported to the appropriate authorities under Sections 43, 66, 66C, 66D, and 67 of the IT Act, 2000.
5. Intellectual Property
All software, design, code, text, logos, and features of the Shalalink Platform are the exclusive intellectual property of Holalkere Technologies (OPC) Private Limited. No portion of the Platform may be copied, modified, distributed, reverse-engineered, or used for commercial purposes without prior written consent.
Data entered by users (student records, attendance, fees, etc.) remains the property of Shri Markandeshwara English Medium School, Hospet. Holalkere Technologies (OPC) Private Limited acts as a data processor on behalf of the School.
6. Disclaimer & Limitation of Liability
The Platform is provided on an “as is” and “as available” basis. Holalkere Technologies (OPC) Private Limited makes no warranties, express or implied, regarding the Platform's uninterrupted availability, accuracy, or fitness for a particular purpose.
To the fullest extent permitted by applicable Indian law, Holalkere Technologies (OPC) Private Limited shall not be liable for:
- Any loss of data resulting from user error;
- Service interruptions due to third-party infrastructure;
- Indirect, incidental, or consequential damages arising from use of the Platform;
- Actions of third parties who gain unauthorised access due to user negligence (e.g., sharing credentials).
Our maximum liability in any event shall not exceed the amount paid (if any) by the School for Platform services in the three months preceding the incident.
7. Termination
Holalkere Technologies (OPC) Private Limited reserves the right to suspend or terminate access to the Platform at any time, with or without notice, for:
- Breach of this Agreement;
- Non-payment of service fees (if applicable);
- Closure or discontinuation of the school's subscription;
- Compliance with any court order or government directive.
Upon termination, the School's data will be retained for the period described in Section 15 and then permanently deleted.
8. Governing Law & Dispute Resolution
This Agreement shall be governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka, India.
Before initiating legal proceedings, parties agree to attempt good-faith resolution within 30 days. If unresolved, disputes may be referred to arbitration under the Arbitration and Conciliation Act, 1996.
9. Identity of the Data Fiduciary
Under the Digital Personal Data Protection Act, 2023, the entity that determines the purpose and means of processing personal data is the Data Fiduciary.
Data Fiduciary: Holalkere Technologies (OPC) Private Limited
Platform: Shalalink — School Management Platform
Website: shalalink.com
Contact Email: sumukha@holalkeretechnologies.com
Country: India
The School (Shri Markandeshwara English Medium School, Hospet) is the Data Controller — the entity that instructs us on how to process data. Holalkere Technologies (OPC) Private Limited acts as the Data Processor on the School's behalf.
10. Personal Data We Collect
| Category | Data Points | Whose Data |
|---|---|---|
| Identity Data | Full name, role (teacher / parent / admin) | All users |
| Contact Data | Mobile phone number, email address | All users |
| Student Academic Data | Marks, grades, report cards, attendance, timetable, lesson plans, syllabus progress | Students (minors) |
| Financial Data | Fee structure, fee payment records, salary records (staff) | Students, Staff |
| Behavioural Data | Attendance check-in/check-out, early pickup records, leave requests | Students, Staff |
| Communication Data | Chat messages between parents and teachers, school announcements | Parents, Teachers |
| Device Data | FCM token (push notifications) | All users |
| Documents | Student documents uploaded by administration | Students |
11. Purpose of Processing
We process personal data solely for the following specified, explicit, and legitimate purposes:
- School Operations: Managing student records, attendance, classes, and timetables;
- Academic Management: Recording marks, lesson plans, syllabus coverage, and report generation;
- Parent Communication: Real-time attendance notifications, announcements, and parent-teacher chat;
- Fee Management: Tracking fee structures, payment records, and generating receipts;
- Staff Management: Managing teacher records, leave requests, early pickup approvals, and salary information;
- Safety & Security: Student entry/exit tracking, visitor logs, and late arrival records;
- Push Notifications: Sending relevant notifications for attendance, announcements, and fees.
We do not use personal data for advertising, profiling, or any purpose beyond school management.
DPDPA 2023 — Section 4 (Purpose Limitation)
12. Legal Basis for Processing
We process personal data under two separate legal bases depending on the user type, as recognised under the DPDPA 2023:
👨👩👧 Parents & Guardians — Consent
Processing is based on free, specific, informed, and unconditional consent under DPDPA 2023 Section 6. By accepting the school's invitation and completing registration on the Platform, parents and guardians provide explicit consent to this Policy and to the processing of their data and their child's data.
👨🏫 Teachers, Staff & Admin — Legitimate Use
Processing of staff data is based on legitimate use for employment purposes under DPDPA 2023 Section 7(c). By being employed at the School and using this Platform as part of their official duties, teachers and staff acknowledge and accept the processing of their personal data. No separate consent is required under this provision.
Notice Obligation
In all cases, as required under DPDPA 2023 Section 5, users are informed of: (a) what data is collected; (b) the purpose of processing; and (c) their rights — through this published Privacy Policy.
Withdrawal of Consent / Objection to Processing
Parents: May withdraw consent at any time by submitting a written request to the school administration. The school will then formally communicate the request to Holalkere Technologies (OPC) Private Limited for action. Withdrawal will result in termination of Platform access and will not affect the lawfulness of processing before withdrawal.
Teachers & Staff: Since processing is based on legitimate employment use (not consent), formal withdrawal of consent is not applicable under DPDPA 2023 Section 7. However, staff may request erasure of their data upon cessation of employment by submitting a request through the school administration, which will officially communicate it to Holalkere Technologies (OPC) Private Limited.
DPDPA 2023 — Section 5 (Notice) | Section 6 (Consent) | Section 7(c) (Legitimate Use — Employment)
13. Children's Data (Students)
Our Obligations
- Verifiable Parental Consent: Student data is processed only on the basis of verifiable consent from the student's registered parent or guardian.
- No Behavioural Tracking: We do not track, profile, or monitor student behaviour for any commercial purpose.
- No Targeted Advertising: Student data is never used for advertising or marketing.
- No Detrimental Processing: We do not process student data in any manner detrimental to the child's wellbeing.
- Access Control: Student records are accessible only to the student's registered parent/guardian, assigned teachers, and authorised school administrators.
Parent's Rights over Student Data
Parents and guardians may request access to, correction of, or deletion of their child's data through the school administration or the Grievance Officer at any time.
DPDPA 2023 — Section 9 | SPDI Rules 2011 — Rule 5
14. Data Storage, Security & Localisation
Where Data Is Stored
All personal data is stored on Google Firebase (Firestore Database and Cloud Storage), which uses servers in multiple regions. Firebase is operated by Google LLC and complies with international security standards (ISO 27001, SOC 2 Type II).
Security Measures (SPDI Rules 2011 — Rule 8)
- OTP-based authentication — no passwords stored in the system;
- Role-based access control (RBAC) — users can only access data authorised for their role;
- All data transmitted over HTTPS / TLS encryption;
- Firebase Security Rules restricting database access by role and school;
- Session guard preventing concurrent unauthorised logins;
- Error monitoring and security logging.
SPDI Rules 2011 — Rule 8 | DPDPA 2023 — Section 8(5)
15. Data Retention
| Data Category | Retention Period |
|---|---|
| Active user account data | Duration of school subscription + 1 year |
| Student academic records | Duration of enrolment + 3 years |
| Fee and financial records | 7 years (as required under Indian tax law) |
| Chat messages | 1 year from date of message |
| Attendance records | Duration of enrolment + 3 years |
| Audit / activity logs | 2 years |
| Data after account deletion request | Permanently deleted within 30 days |
After the applicable retention period, data is permanently and securely deleted from all systems.
DPDPA 2023 — Section 8(7) (Storage Limitation) | Income Tax Act 1961 (7-year financial records)
16. Third-Party Service Providers
We currently use the following third-party services to operate the Platform:
| Service | Provider | Purpose | Data Shared |
|---|---|---|---|
| Firebase (Auth, Firestore, Storage, Messaging) | Google LLC | Database, authentication, file storage, push notifications | All user data |
| Sentry | Functional Software Inc. | Error monitoring and crash reporting | Device info, error logs (no personal data) |
| Resend | Resend Inc. | Transactional email notifications | Email address only |
Right to Change Third-Party Providers
Holalkere Technologies (OPC) Private Limited reserves the right, at its sole discretion, to substitute, add, or remove third-party service providers (including data processors, infrastructure providers, and communication services) at any time as necessary to operate, improve, or maintain the Platform. Such changes may be made without prior individual notification to the School or its users, provided that:
- The replacement provider maintains security standards equivalent to or higher than those of the replaced provider;
- The purpose and nature of data processing remain unchanged;
- This Privacy Policy is updated to reflect any material changes to the list of providers.
We do not sell, rent, or trade personal data to any third party for commercial purposes.
SPDI Rules 2011 — Rule 6 (Disclosure) | DPDPA 2023 — Section 8(2) (Data Processor)
17. Your Rights as a Data Principal
Under the DPDPA 2023, you have the following rights:
- Right to Access Information (Section 11): Request a summary of the personal data we hold about you and how it is being processed.
- Right to Correction and Erasure (Section 12): Request correction of inaccurate data or erasure of data no longer necessary for the stated purpose. Requests will be processed within 30 days.
- Right to Grievance Redressal (Section 13): File a complaint with our Grievance Officer. If unsatisfied, escalate to the Data Protection Board of India once it is established by the Government.
- Right to Nominate (Section 14): Nominate another individual to exercise your rights in the event of your death or incapacity.
For school staff and teachers: Requests for access, correction, or erasure of data must be submitted through the school administration, which will formally communicate the request to us.
DPDPA 2023 — Sections 11–14 | SPDI Rules 2011 — Rule 5(6)
18. Grievance Officer
As required under Rule 5(9) of the SPDI Rules, 2011 and Rule 3(1)(b) of the IT (Intermediary Guidelines) Rules, 2021, we have appointed the following Grievance Officer:
Grievance Officer
Name: Sumukha H R
Designation: Founder, Holalkere Technologies (OPC) Private Limited
Email: sumukha@holalkeretechnologies.com
Address: No. 61, JP Nagar, Omkar Layout, Mysore, Karnataka, India
Response Time: Within 30 days of receiving the complaint
Complaints may be submitted by email with the subject line: “Data Privacy Complaint — Shalalink”. Please include your full name, registered phone number, and a clear description of your concern.
SPDI Rules 2011 — Rule 5(9) | IT Intermediary Rules 2021 — Rule 3(1)(b) | DPDPA 2023 — Section 13
19. Data Breach Notification
In the event of a personal data breach, Holalkere Technologies (OPC) Private Limited will:
- Take immediate steps to contain and assess the breach;
- Notify the Data Protection Board of India (once operational) as required under the DPDPA 2023;
- Notify affected users within a reasonable time, describing the nature of the breach, data affected, and remedial steps taken;
- Maintain an internal record of all data breaches.
DPDPA 2023 — Section 8(6) & Schedule I
20. Amendments to This Policy
We reserve the right to amend this Policy at any time to reflect changes in law, our practices, or the Platform's features. When we make material changes, we will:
- Update the “Effective Date” at the top of this document;
- Notify active users via the app or email at least 15 days before changes take effect;
- Obtain fresh consent where required by applicable law.
Continued use of the Platform after the effective date of changes constitutes acceptance of the revised Policy.
21. Contact Us
Holalkere Technologies (OPC) Private Limited
Email: sumukha@holalkeretechnologies.com
Website: shalalink.com
Platform: Shalalink — School Management Platform
Address: No. 61, JP Nagar, Omkar Layout, Mysore, Karnataka, India