Privacy Policy

§1 Introduction

SSZone ("we," "us," or "our") is a proprietary school management software-as-a-service (SaaS) platform operated as a sole proprietorship under Indian law. Our platform serves schools, iCard operators, vendors, and sales partners across India.

This Privacy Policy governs the collection, use, storage, and disclosure of personal information when you access or use the SSZone platform (sszone.live and associated subdomains). By using SSZone, you consent to the practices described in this policy.

§2 Who We Are

SSZone is a sole proprietorship registered in India. For the purposes of data protection law, SSZone is the Data Fiduciary for platform account data, and a Data Processor for student and institutional data uploaded by schools.

• Business Name: SSZone
• Business Type: Sole Proprietorship
• Country of Operation: India
• Contact Email: sszonelive@gmail.com
• Website: sszone.live

§3 Information We Collect

3.1 Account & Registration Data

When you create an account or register on SSZone, we collect:

• Full name and contact details (email address, phone number)
• Organisation name, type, and address (for schools, vendors, operators)
• Login credentials (password stored in hashed form — never in plain text)
• Role designation (School Admin, Teacher, Operator, Vendor, Sales Partner)

3.2 Student & Institutional Data

Schools using SSZone upload and manage data about their students and staff, including:

• Student names, photographs, date of birth, class, section, roll number
• Parent and guardian contact information
• Fee records, attendance logs, examination marks
• ID card data and design preferences

3.3 Payment & Transaction Data

Platform subscription payments are processed through third-party payment gateways (such as Razorpay, PayU, or similar RBI-authorised payment aggregators). We do not store your card number, CVV, or full banking credentials on our servers. We retain:

• Transaction IDs and payment status records
• Invoice and billing details for GST compliance
• Subscription plan and renewal dates

3.4 Usage & Technical Data

We automatically collect certain technical data when you use our platform:

• IP address and approximate geographic location
• Browser type, operating system, and device information
• Pages visited, features used, and session duration
• Error logs and performance data

3.5 Communications Data

If you contact us via our contact form, email, or WhatsApp, we retain records of those communications to resolve your query and for quality assurance.

§4 How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: To operate, maintain, and provide all features of the SSZone platform
• Account Management: To manage user accounts, authentication, and role-based access
• Billing & Payments: To process subscription fees, issue invoices, and comply with GST regulations
• Communications: To send service updates, security alerts, billing reminders, and support responses
• Security: To detect, prevent, and investigate fraud, abuse, or unauthorised access
• Legal Compliance: To comply with applicable Indian laws, regulations, and court orders
• Platform Improvement: To analyse usage patterns and improve our services (using aggregated, non-identifiable data)

§5 How We Share Information

SSZone does not sell, rent, or trade personal data. We share information only in these circumstances:

• Payment Processors: Payment gateway partners (RBI-authorised) receive billing information necessary to process transactions
• Cloud & Infrastructure: Hosting and database service providers who store data on servers located in India
• Legal Requirements: When required by Indian law, court order, or government authority
• Business Transfer: In the event of merger, acquisition, or sale of the business, with prior notice to users
• With Your Consent: In any other case, only with your explicit written consent

All third-party service providers with whom we share data are contractually bound to handle your information with confidentiality and security standards equivalent to this policy.

§6 Student Data & Minor Protection

SSZone handles a significant volume of data relating to minors (students). We take additional precautions in line with the DPDP Act 2023's provisions for minors:

• Student data is accessible only to authorised school staff and the system administrator
• Student photographs are used solely for ID card generation and institutional records
• We do not use student data for any commercial, marketing, or analytical purposes outside the school's direct instructions
• Upon termination of a school's account, all associated student data is deleted from active systems within 30 days

Schools are required to obtain verifiable parental or guardian consent before uploading any student data onto the SSZone platform. By uploading student data, the school confirms such consent has been obtained.

§7 Payment Gateway & School Payment Integration

SSZone uses RBI-authorised payment aggregators for platform subscription billing. Schools may also integrate their own RBI-authorised payment gateways to collect student fees and other institutional charges directly through the SSZone interface.

• Platform-level payments (subscriptions, plans): processed by SSZone's payment gateway
• School fee collections via SSZone: processed by the school's own payment gateway; SSZone acts only as an interface provider and is not party to those transactions
• All payment data is encrypted in transit using TLS 1.2+ and handled per PCI DSS guidelines by the payment processor

§8 Data Retention

We retain personal data only as long as necessary for the purposes stated in this policy or as required by law:

• Active account data: Retained for the duration of the account and for 3 years after account closure
• Payment and billing records: Retained for 7 years (as required under Indian taxation and accounting laws)
• Student data: Deleted within 30 days of school account termination upon written request
• Communication logs: Retained for 2 years for dispute resolution
• Security logs: Retained for 1 year

§9 Data Security

We implement reasonable security practices as mandated by the IT (RSPP & SPDI) Rules, 2011:

• All data is encrypted in transit using SSL/TLS encryption
• Passwords are stored using one-way cryptographic hashing (bcrypt or equivalent)
• Role-based access controls ensure users can only access data relevant to their function
• Server-side session management with configurable expiry
• Regular security reviews and vulnerability assessments
• Database access restricted to application layer; no direct public exposure

§10 Your Rights

Under the Digital Personal Data Protection Act, 2023 and other applicable Indian laws, you have the following rights:

• Right to Access: Request a copy of personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer
• Right to Withdraw Consent: Withdraw consent for processing at any time (this may affect service availability)
• Right to Nominate: Nominate a person to exercise your rights in the event of your death or incapacity

To exercise any of these rights, email us at sszonelive@gmail.com with subject line "Data Rights Request." We will respond within 30 days.

§11 Cookies & Tracking

SSZone uses minimal cookies necessary for platform operation:

• Session cookies: To maintain your logged-in state (deleted when you close your browser or log out)
• Security cookies: To prevent CSRF attacks and ensure form submission integrity
• Preference cookies: To remember your interface preferences

We do not use third-party advertising cookies, cross-site tracking, or browser fingerprinting. You may disable cookies in your browser settings, though this may impair platform functionality.

§12 Third-Party Links

The SSZone platform may contain links to third-party websites (e.g., vendor store external pages, social media). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party site you visit.

§13 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Post the updated policy on this page with a revised "Last Updated" date
• Send an email notification to registered account holders for significant changes
• Display a notice on the platform dashboard

Continued use of the platform after changes constitutes acceptance of the revised policy. If you disagree with changes, you may close your account by contacting us.

§14 Grievance Officer

Any complaint or concern regarding the processing of personal data may be directed to our Grievance Officer:

• Name: Grievance Officer, SSZone
• Email: sszonelive@gmail.com
• Subject Line: "Privacy Grievance"
• Response Time: Within 30 days of receipt of complaint

If your grievance is not resolved to your satisfaction within 30 days, you may approach the Data Protection Board of India as established under the DPDP Act 2023.