Privacy Policy
Unity Administration Portal
This policy governs how we handle administrator personal data and outlines your obligations when accessing student data through the Unity Admin Portal. It constitutes the statutory notice required under the Digital Personal Data Protection Act, 2023.
1. Introduction & Scope
Codexa Technologies Private Limited ("Unity", "we", "us", "our") operates the Unity Administration Portal — a management dashboard for educational institution administrators, super admins, and teaching staff. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Unity Admin Portal. It also describes your responsibilities regarding student data that you access and manage through the platform. This policy constitutes the statutory notice required under Section 5 of the Digital Personal Data Protection (DPDP) Act, 2023. Under the DPDP Act, your educational institution is the "Data Fiduciary" for student data, and you operate as an authorized representative of that Data Fiduciary.
2. Data We Collect About You (Admin Users)
We collect the following personal data about you as an administrator:
Identity & Authentication Data
- Full name, email address, phone number
- Administrative role (Super Admin, Admin, Teacher, Staff)
- Profile photograph (optional)
- Authentication credentials (hashed and salted, never stored in plaintext)
- Multi-factor authentication settings
Organizational Data
- Institution name, type (school / college / university / coaching center)
- Department affiliations, assigned academic terms
- Organization license and subscription details
Activity & Access Logs
- Login timestamps, IP addresses, device information
- Administrative actions performed (student management, grade entry, attendance marking)
- Audit trail of all data access and modifications
Billing & Financial Data (Super Admins only)
- Subscription plan selections, payment method references
- Invoice history, billable service configurations
- Transaction identifiers (actual payment processing is handled by third-party gateways)
3. Student Data You Access
As an authorized administrator, you may access student personal data to perform your institutional duties. This includes student profiles, enrollment records, contact information, academic records (grades, attendance, exam results), communication records, and moderation records.
- Purpose Limitation — Access student data only for legitimate institutional purposes directly related to your administrative or teaching role.
- Data Minimization — Do not download, copy, or export student data beyond what is necessary for your duties.
- Confidentiality — Do not share student personal data with unauthorized third parties, including other institutions, commercial entities, or personal contacts.
- Security — Do not access admin accounts on shared or unsecured devices. Always log out after sessions.
Violations may result in immediate account suspension and may be reported to your institution and relevant regulatory authorities.
4. Why We Process Your Data (Lawful Basis)
Under the DPDP Act, we process administrator personal data for:
- Consent (Section 6) — Acceptance of admin-specific Terms and Privacy Policy, optional features. Each consent is recorded separately and can be withdrawn.
- Contractual Necessity — To provide the admin platform services your institution has subscribed to.
- Legitimate Interest — Security monitoring, fraud prevention, platform integrity, and compliance with obligations to student Data Principals.
- Legal Obligation — Audit logging as required by the DPDP Act, maintaining records of data access for regulatory inspections.
5. Data Sharing & Third Parties
We share administrator data only in the following circumstances:
- With Your Institution — Your activity logs and access patterns may be reviewed by your institution's Super Admin for governance.
- Supabase — Database and authentication infrastructure (under strict DPA).
- Firebase Cloud Messaging — Push notification delivery only.
- Payment Gateway — Subscription billing (Super Admin billing data only).
- Legal Requirements — Court orders, Data Protection Board requests, or law enforcement with valid authorization.
We never sell, rent, or share admin personal data for advertising, marketing, or profiling purposes.
6. Data Security
We implement comprehensive security measures including Row Level Security (RLS) policies, role-based access control (Super Admin → Admin → Teacher hierarchy), tamper-evident append-only audit trails, TLS 1.3 encryption, industry-standard password hashing, automatic session timeouts, and IP-based anomaly detection. Super Admin actions on sensitive operations require additional confirmation. Bulk data exports are logged and rate-limited. Organization data is logically isolated in our multi-tenant architecture.
7. Data Retention
- Active admin accounts — Data retained while account is active and organization subscription is valid.
- Post-account removal — Admin personal data deleted within 30 days; audit logs retained for 3 years.
- Student data access logs — Retained for 5 years for regulatory compliance.
- Billing records — Retained for 7 years per Indian financial record-keeping requirements.
- Post-subscription — All associated admin accounts deactivated. Personal data retained for a 90-day reactivation window, then permanently deleted.
8. Your Rights Under DPDP Act
- Right to Access (Section 11) — Request a summary of your personal data and admin activity logs.
- Right to Correction (Section 12) — Update incorrect personal information via your admin profile.
- Right to Erasure (Section 13) — Request deletion of your admin account (subject to institutional approval and audit retention).
- Right to Withdraw Consent (Section 6(5)) — Withdraw optional consents without affecting core admin functionality.
- Right to Grievance Redressal (Section 14) — Contact our Grievance Officer.
Certain data (audit logs, administrative action records) cannot be deleted during the regulatory retention period as required for accountability and compliance.
9. Data Breach Notification
In the event of a breach affecting administrator or student data, we will notify the Data Protection Board of India within 72 hours, inform affected admins and institutions promptly, provide clear details of the breach scope and remediation steps, and assist institutions in fulfilling their notification obligations to student Data Principals.
10. Grievance Officer
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in law or platform capabilities. Material changes will be notified via in-app notification and email, require re-consent through the admin consent flow, be recorded with SHA-256 hash in our consent ledger, and take effect 15 days after notification.