This notice explains how AskCampus is built to support educational institutions in complying with India's Digital Personal Data Protection Act, 2023 (DPDP Act), and describes our own data-protection posture. It is a trust and transparency document and works alongside our Privacy Policy and Terms of Service. It is not a certification or a guarantee of compliance; each institution remains responsible for its own obligations as a Data Fiduciary.
The DPDP Act distinguishes between the entity that decides the purpose and means of processing and the entity that processes on its behalf.
The school or college determines why and how student, parent, and operations data is processed, issues notices, and obtains consents.
We process that data only on the institution's documented instructions, to operate the platform, under a contract consistent with the DPDP Act.
AskCampus is a Data Fiduciary only in respect of its own account, billing, and website data. Where any institution is designated a Significant Data Fiduciary under the Act, we will support the additional obligations that apply.
The DPDP Act allows processing on the basis of the data principal's consent or a recognised legitimate use. AskCampus provides features designed to help institutions manage this, including:
Because schools and colleges process the data of students under 18, the DPDP Act's protections for children (Section 9) are central. The Act requires verifiable parental or guardian consent before processing a child's personal data and prohibits processing likely to cause harm, as well as tracking, behavioural monitoring, and targeted advertising directed at children.
AskCampus is built to support these protections:
Data principals (including students and their parents/guardians) have rights under the DPDP Act to access a summary of their data, seek correction or completion, request erasure where retention is not required, raise grievances, and nominate another person to exercise their rights.
Because AskCampus generally acts as Processor, data principals should ordinarily exercise these rights through their institution (the Data Fiduciary). AskCampus provides the institution with the tools to locate, correct, export, and erase records so that it can respond within the timelines the Act requires. For data where AskCampus is the Data Fiduciary, requests can be sent to our DPO below.
Our Data Protection / Grievance Officer can be reached at our Data Protection & Grievance Officer (hello@askcampus.in). Platform-related grievances may also be sent to our Grievance Officer (hello@askcampus.in). If a data principal is not satisfied after raising a grievance with the relevant Data Fiduciary, they may approach the Data Protection Board of India as provided under the Act.
AskCampus maintains processes to detect, contain, and investigate personal-data breaches. As a Processor, on becoming aware of a breach affecting Customer Data we will notify the affected institution(s) without undue delay so that the institution can fulfil its obligation to report to the Data Protection Board of India and to affected data principals as required under the DPDP Act. Where AskCampus is the Data Fiduciary, we will make the required reports directly.
[[COUNSEL REVIEW: confirm the breach-notification timelines and content requirements under the DPDP Act and notified rules, and set the contractual notification window between AskCampus (Processor) and institutions (Fiduciaries).]]Personal data is retained only as long as needed to provide the Service and to meet legal and audit obligations, after which it is deleted or anonymised. On termination, Customer Data is exported and then deleted as described in our Terms of Service and Privacy Policy.
[[COUNSEL REVIEW: retention periods — set concrete retention and erasure periods per data category and the post-termination deletion timeline; ensure consistency with the Privacy Policy and Terms of Service.]]AskCampus is built to protect personal data with reasonable security safeguards designed to include encryption in transit and at rest, role-based access controls, multi-tenant isolation, audit logging, monitoring, and regular backups. Further detail is on our Security page. No safeguard can be guaranteed perfectly effective, and we work continuously to strengthen our controls.
We engage a limited set of sub-processors to operate the Service (for example, cloud hosting, payments, messaging, and email). Sub-processors are bound by contractual obligations consistent with the DPDP Act, and a current list is available on request from our our Data Protection & Grievance Officer (hello@askcampus.in). See the Privacy Policy for the categories of sub-processors.
Customer Data is hosted within India (AWS Mumbai, ap-south-1). The platform is designed so that Customer Data is stored and processed in India and is not transferred outside India in the ordinary course of providing the Service. Any change will be handled in line with the DPDP Act and applicable government notifications.
For questions about this notice or AskCampus's data-protection posture, contact our Data Protection / Grievance Officer at our Data Protection & Grievance Officer (hello@askcampus.in), or write to Bangalore, Karnataka, India. For a full description of our data practices, see the Privacy Policy.