Digital Personal Data Protection Act, 2023
Privacy Policy
How Zenkul handles personal data — including the data of children — in connection with the Zenkul school management platform.
Zenkul
Trading name of the sole proprietorship concern of Mr. Gulshan Kumar
- GSTIN
- 09EQQPK0683D1ZJ
- PAN
- EQQPK0683D
- Udyam Reg. No.
- UDYAM-UP-62-0061171
- Principal place of business
- Building No. 19, Samspur Road, Chak Neknampur, Salon, District Raebareli, Uttar Pradesh – 229127, India
- Email
- support@zenkul.com
- Web
- www.zenkul.com
1. About this policy
This policy explains how Zenkul handles personal data in connection with the Zenkul school management platform (the "Platform").
It is published under the Information Technology Act, 2000 and the rules made under it, and under the Digital Personal Data Protection Act, 2023 (the "DPDP Act").
2. The most important point: who is responsible for what
Zenkul plays two different roles, and your rights depend on which one applies.
(a) For school data — Zenkul is a Data Processor
When a school, college or organisation ("School") uses the Platform, the School decides what personal data is collected about its students, parents and staff, why, and for how long. The School is the Data Fiduciary. Zenkul only processes that data on the School's instructions.
If you are a student, parent, teacher or staff member
Your School decides what is collected about you and why. Send access and correction requests to your School — Zenkul cannot change your records on its own initiative.
Deletion works differently, and you do not need to go through your School. You can ask us to delete your account and personal data directly, either from inside the Platform (Profile → Request account deletion) or, if you can no longer sign in, from our public page at www.zenkul.com/delete-account — we verify it is you with a one-time code sent to the email address on your account.
Either way your request is given a reference, your School is notified, and we complete it within 30 days. We email you the reference when we receive the request, and again when the erasure is done. If a request is still open after 30 days it is escalated automatically inside Zenkul. Some records survive erasure because the law requires it — see section 10.
(b) For our own business data — Zenkul is a Data Fiduciary
For the contact and billing details of the people who register and manage a School's subscription, for enquiries from our website, and for our own records, Zenkul decides the purposes itself and is directly responsible.
3. Data we process on behalf of Schools
We process whatever the School chooses to put into the Platform. Depending on which modules the School uses, that typically includes:
| Category | Examples |
|---|
| Student identity | Name, admission number, roll number, date of birth, gender, photograph, blood group, nationality, religion, category, previous school |
| Student contact and address | Address, city, state, PIN code, phone, email |
| Guardian data | Parent or guardian name, relationship, phone, email, occupation, emergency contact and pick-up authority |
| Academic | Class, section, stream, subjects, electives, timetable, syllabus and chapter progress, homework, materials, submissions, exam marks, grades, report cards, ratings and topic-mastery indicators |
| Attendance | Daily and period attendance for students and staff |
| Financial | Fee structures, invoices, instalments, discounts, penalties, late fees, receipts, payment status, offline payment records |
| Transport | Assigned route and stop, boarding and alighting point, transport fee slab, vehicle allocation |
| Staff | Employee profile, designation, role and permissions, attendance, salary structure, salary payments, employment documents |
| Sensitive identifiers | Aadhaar number and bank account number, where the School chooses to collect them — always encrypted at rest |
| Communications | Announcements and read or acknowledgement receipts, notifications, chat messages and attachments, live class participation |
| AI Tutor | The text or speech a user submits as a prompt |
| Technical and security | IP address, browser and device information, login times, session records, audit logs of administrative actions, email delivery logs |
Zenkul does not decide to collect any of this. If you believe your School is collecting something it should not, raise it with the School.
4. Why it is processed
Only to run the Platform for the School: to provide the modules the School has enabled; to authenticate users and enforce permissions; to generate invoices, reports and documents; to deliver notifications and communications; to keep the service secure and investigate misuse; to provide support; to make backups; and to comply with law.
We do not use school data for advertising, for building profiles for commercial purposes, or to train any artificial intelligence model. We do not sell, rent or trade personal data.
5. Children
5.1 Most people whose data is on the Platform are children. The DPDP Act gives children extra protection.
Parental consent
5.2 Obtaining verifiable parental consent is the School's legal obligation, not Zenkul's. Zenkul has no way to obtain or check parental consent and relies entirely on the School's confirmation that it has been obtained.
5.3 Zenkul does not undertake behavioural tracking of children, does not serve advertising of any kind, and does not profile children for commercial purposes.
5.4 Schools are contractually prohibited from using the Platform for targeted advertising to children or for monitoring children beyond legitimate educational and safety purposes.
5.5 AI features are disabled by default for users under 18. A School may enable them only after obtaining specific parental consent that names the third-party AI provider.
6. Data we hold as a Data Fiduciary
For the School's registered signatory, administrators and billing contacts, and for people who contact us: name, designation, email, phone, organisation details, GSTIN, subscription and invoice records, support correspondence, and website enquiry data.
We use it to provide and bill the service, to give support, to send service notices, and to comply with tax and legal obligations. Our lawful basis is performance of contract, legal obligation, or your consent where given.
7. Who we share data with
We share personal data only with:
(a) Service providers we rely on
| Provider | What it does | Where | Data protection arrangement |
|---|
| Amazon Web Services | Hosting (Amazon ECS), file storage, backups | India — Mumbai (ap-south-1) | AWS standard data processing terms |
| Payment provider selected by the School | Fee and subscription payment processing | India | Provider's standard terms; regulated by the RBI |
| Email delivery provider | Sending emails — credentials, invoices, announcements | As published on our sub-processor page | Provider's standard terms |
| Third-party AI provider (paid API) | AI Tutor responses | Outside India | Standard published API terms only. Zenkul does not hold a negotiated data processing agreement with this provider. |
Live classes stay in India. The real-time audio-video infrastructure used for live classes and calls is self-hosted by Zenkul on its own Indian infrastructure. No third party processes live-class audio, video or participant data.
The current list of sub-processors is supplied to Schools on request to support@zenkul.com.
(b) Others
— The School itself, and users the School has authorised.
— Law enforcement, courts or regulators, where legally required.
— A successor, if the business is transferred, converted or incorporated — with notice to Schools.
We do not share personal data with anyone else for their own purposes.
8. Where data is stored
Institutional data is stored on Amazon Web Services infrastructure in the Asia Pacific (Mumbai) ap-south-1 region, in India. Some providers listed above process limited data outside India, as indicated. Zenkul will not otherwise transfer data outside India.
9. Security
We use: TLS encryption in transit; encryption at rest for Aadhaar numbers, bank account numbers, transport records and chat content; optional additional payload encryption; role- and permission-based access control; tenant separation between organisations; audit logging; access restricted to those who need it; and regular backups.
Two honest limits
First, chat content is encrypted at rest with keys we hold — it is not end-to-end encrypted, and Zenkul is technically able to read it. We do so only for support, security investigation, or where required by law.
Second, no system is completely secure, and we cannot guarantee the Platform will never be compromised.
If a data breach affects a School's data, we will inform that School without undue delay and within 72 hours of becoming aware, and help it notify the Data Protection Board of India and affected individuals. The duty to make that notification sits with the School as Data Fiduciary.
10. How long we keep data
While a School's subscription is active, its data is kept until the School deletes it or instructs us to.
| Data | Retention |
|---|
| Unconverted 7-day trial | Deleted 30 days after the trial expires |
| After a subscription ends | 30-day export window, then deletion from active systems within 30 days and from backups within 90 days |
| Audit logs and email delivery logs | 12 months |
| Application and access logs | 90 days |
| Deleted individual records | Marked deleted immediately; permanently purged within 30 days |
| Accounts you ask us to delete | Erased within 30 days of your request. Your name, email, phone, date of birth, gender and photograph are overwritten; your profile image, email delivery logs and the identifying details in our audit trail are removed with it |
| AI Tutor prompts | Not retained by Zenkul beyond the session |
| Our own tax invoices, GST records and financial records | 72 months from the due date of the annual return for the relevant financial year (Section 36, CGST Act), or as long as required under the Income-tax Act, 1961 — whichever is longer |
Longer retention applies only where the law requires it or where needed to defend a legal claim.
11. Your rights
Under the DPDP Act you may ask for access to your data, correction of inaccurate data, erasure, information about who it has been shared with, nomination of a person to exercise your rights, and grievance redressal.
Erasure. Ask us directly — in the Platform under Profile → Request account deletion, or without signing in at www.zenkul.com/delete-account. Completed within 30 days. See section 2(a).
Access, correction and everything else. If the data is held by a School — which is the case for students, parents and staff — contact your School. If the data is one we hold as Data Fiduciary (a subscription contact, or someone who enquired with us), contact our Grievance Officer below. We will acknowledge grievances within 24 hours and endeavour to resolve them within 15 days, subject to the nature and complexity of the matter and any applicable legal requirements.
You may withdraw consent at any time where processing was based on consent. This does not affect processing already carried out, and may mean we or your School can no longer provide the service.
12. Cookies and similar technologies
The Platform uses strictly necessary cookies and local browser storage for authentication, session management, keeping you signed in, and remembering your selected school or workspace.
We do not use advertising, tracking or third-party marketing cookies. Blocking essential cookies will prevent you from signing in.
13. Grievance Officer
Mr. Gulshan Kumar
Proprietor and Grievance Officer, Zenkul
Email: support@zenkul.com | Privacy: support@zenkul.com
Address: Building No. 19, Samspur Road, Chak Neknampur, Salon, District Raebareli, Uttar Pradesh – 229127, India
Hours: Monday to Saturday, 10:00–18:00 IST, excluding public holidays
GSTIN 09EQQPK0683D1ZJ · Udyam UDYAM-UP-62-0061171
Acknowledgement within 24 hours; resolution targeted within 15 days. You may also complain to the Data Protection Board of India.
14. Changes
We may update this policy and will supply the revised version to each School by email, with a new effective date. Material changes affecting Schools will be notified at least 30 days in advance.
End of Privacy Policy
Zenkul · Gulshan Kumar, sole proprietor · GSTIN 09EQQPK0683D1ZJ · Udyam UDYAM-UP-62-0061171
Building No. 19, Samspur Road, Chak Neknampur, Salon, District Raebareli, Uttar Pradesh – 229127, India
support@zenkul.com · www.zenkul.com · Version 1.2, effective 14 September 2026