MyAMS ("we," "us," or "our") respects your privacy and is committed to protecting the personal data of our users. This Comprehensive Privacy Policy explains in detail how we collect, use, disclose, and safeguard personal data when you use the MyAMS mobile application and any associated web platforms or services (collectively, the "App").

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the App.

1. Scope of This Policy

This Privacy Policy applies solely to information collected by the MyAMS mobile application. It does not apply to any third-party websites, services, or applications linked within the App, which maintain their own independent privacy practices and policies. We encourage you to review the privacy policies of any third-party services you interact with.

2. Legal Role: Data Controller vs. Data Processor

Under global data protection regulations, including the European Union General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act (DPDP):

• The Institution is the Data Controller: The educational institution (school, college, university, or coaching center) that registers you on our platform is the Data Controller. They determine the purposes and means of processing your personal data and are responsible for obtaining necessary parental consent for minors (children's data).
• MyAMS is the Data Processor: We act strictly as a Data Processor. We process personal data solely on behalf of, and according to the explicit instructions of, your educational institution in order to deliver our ERP services.

3. Legal Basis for Processing

We process personal data based on the following legally established grounds to ensure compliance with applicable data protection laws:

• Contractual Necessity: Processing is necessary to perform the services requested by your educational institution (e.g., managing student attendance, calculating fee dues, processing grades, and scheduling classes).
• Consent: For optional features like location tracking (for staff attendance), camera access (for document/QR scans), and push notifications, permissions are requested at runtime. This consent can be withdrawn at any time via your device settings.
• Legitimate Interests: Processing is necessary for our legitimate interests in maintaining App security, preventing fraudulent activities, ensuring network and information security, and improving system performance and features.
• Legal Obligations: Processing is necessary to comply with educational record-keeping laws, financial regulations (regarding fee processing), and other applicable government regulations.

4. Information We Collect

We collect information that identifies, relates to, describes, or is reasonably capable of being associated with you. This includes:

• Personal Identification Information: Name, email address, phone number, date of birth, gender, and residential address.
• Academic and Institutional Data: Enrollment details, student ID, class/section assignments, attendance records, exam scores, grades, and disciplinary records.
• Financial Data: Payment history, fee receipts, and transaction records (Note: Actual payment processing is handled securely by our payment gateway partners; we do not store full credit card numbers).
• Device and Usage Data: IP address, device type, operating system, app usage metrics, crash logs, and diagnostic data to help us improve the App's stability.

5. App Permissions and Device Access

To provide specific features, the App may request access to the following device components. You can manage or revoke these permissions via your device settings at any time, though some App features may stop functioning correctly:

• Location (Fine/Coarse): Used strictly to allow teachers and staff to mark and start their daily attendance via geofencing and location-based check-ins. We do not track student locations.
• Camera and Microphone: Used for scanning QR codes (e.g., for quick access or event check-ins) and capturing photos for document/assignment uploads. We do not collect or store continuous camera or microphone recordings.
• Storage (Read/Write External Storage / Photos): Used to allow you to select and upload documents, photos, or assignments directly to the platform.
• Notifications: Used to deliver critical alerts, timetable schedules, grade updates, fee reminders, and institutional announcements.

6. Third-Party Service Providers

We partner with trusted, industry-leading service providers to operate our infrastructure. We ensure that these providers adhere to strict data protection standards. Our key processors include:

• Cloud Infrastructure (e.g., Google Cloud Platform & Firebase / AWS): For secure database storage, analytics, crash reporting, and reliable push notification delivery.
• Payment Gateways (Razorpay): For secure, PCI-DSS compliant processing of school and college fee payments. We do not store your full payment card details.

7. No Selling of Data & Sharing Limits

We maintain a strict policy against the monetization of your personal data:

• We do not sell, rent, or trade your personal data to any advertisers, data brokers, or third parties for marketing purposes.
• Personal data is shared strictly with your registered educational institution to facilitate ERP services, and with the third-party sub-processors listed above, solely to maintain App functionality.
• We may disclose information if legally required to do so by a valid subpoena, court order, or governmental request.

8. Cross-Border Data Transfers

Your data is hosted on secure cloud infrastructure. Depending on the region of your educational institution, data may be transferred to and processed on secure servers located outside of your home country (including outside of India or the EEA). When such transfers occur, we ensure that standard contractual clauses (SCCs) and industry-standard security safeguards are strictly enforced to protect your data internationally.

9. Data Security

The security of your personal data is paramount. We implement robust, industry-standard technical and organizational security measures, including:

• Encryption: Encrypted data transmission using HTTPS/SSL protocols and encryption of sensitive data at rest.
• Infrastructure Security: Utilizing secure cloud environments with firewalls and intrusion detection systems.
• Access Controls: Strict Role-Based Access Controls (RBAC) ensuring that only authorized personnel and institution staff can access specific data sets based on their roles.

10. Data Retention and Deletion

• Retention: Personal data is retained only for as long as required by your educational institution to fulfill the purposes outlined in this policy or as required by law.
• Deletion: As a Data Processor, we do not unilaterally delete institutional records. To request the deletion of your account or personal data, please contact your educational institution's administrator. Upon receiving a verified, written request from the institution (the Data Controller), we will process and securely delete or anonymize the data within 30 days. Note that some data may temporarily reside in encrypted backups for a limited disaster-recovery period before being fully overwritten.

11. Your Data Rights

Depending on your jurisdiction, you may have the right to access, rectify, or request the erasure of your personal data. Because your educational institution is the Data Controller, you must route these requests directly through your institution's administration office.

12. Grievance Redressal (DPDP & GDPR Compliance)

If you have any questions, concerns, or complaints regarding how your data is handled, or if you suspect a privacy violation, please contact our Grievance Officer:

• Contact Designation: Grievance Officer / Data Protection Officer, MyAMS
• Email: info.hr@techlathe.com
• Response Timeline: We will acknowledge your grievance within 48 hours and provide a detailed response within 15 business days.