Privacy Policy

Satyam International School (SiS) is the Data Fiduciary for personal data processed through this portal. The School decides the purposes and means of processing and is responsible for handling requests and grievances.

Postal address: Lodipur Zamania Ghazipur (U.P.)232329.
General contact: 9336950476
Email: sischoolzam@gmail.com.

The certificate portal securely processes student information to facilitate certificate verification and retrieval. Students can access their academic documents by providing the required identification details, including their full name, parents’ names, and passing session. Relevant certificate information, such as document type, certificate number, and date of issuance, is used solely to locate, verify, and provide the corresponding academic records.

For security and administration, the system may also record consent version and timestamp, hashed network identifiers, request outcomes, administrator audit events and technical security data. Do not submit information that the form does not request.

For administrator account security, the School stores a hash of the administrator's network IP address and the country code supplied by the hosting provider. These are used to rate-limit sign-in attempts, enforce the School's admin location policy and audit access. The raw IP address is not stored in these location-policy records, and browser GPS is not used.

If you submit a wrong-record report, the School receives the name, passing session, issue description, contact detail and consent you provide. The portal assigns a reference ID and records ticket status, staff handling notes and a hashed network identifier for abuse prevention and audit purposes.

The certificate portal provides an optional “Was this helpful?” feedback feature to help the School evaluate and improve the accessibility, clarity, and usefulness of its online services. When feedback is submitted, the portal collects and stores only the selected response (helpful or not helpful), an optional comment limited to 200 characters, the date and time of submission, and the page address or path associated with the feedback. Users are advised not to include names, contact information, student identification details, certificate numbers, or other personal or confidential information in their comments. To prevent spam, automated submissions, and misuse of the feedback feature, the portal maintains a separate, temporary rate-limiting mechanism that uses a hashed network identifier. This identifier is used exclusively for abuse prevention, is retained for a limited period, and is not included in or directly associated with the stored feedback record. Feedback information is used for service evaluation and improvement and is accessible only to authorised School personnel responsible for reviewing and managing portal feedback.

Student and certificate information is used to verify a certificate lookup, retrieve the matching school-issued document, maintain the accuracy and integrity of school certificate records, prevent abuse and meet applicable legal obligations. The portal is not used for advertising, behavioural profiling, unrelated marketing or student ranking.

Where consent is required, the portal displays a plain-language notice and an unticked checkbox. The user must actively agree before a lookup is submitted. Consent is recorded with the policy version, purpose and timestamp and may be withdrawn by contacting the School. Withdrawal does not invalidate processing already lawfully completed; it may prevent further portal retrieval using that consent.

The School processes personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), and other applicable legal requirements. Where permitted by law, certain information may be processed without obtaining separate consent when the processing falls within a recognised “certain legitimate use” under the Act, including applicable educational, school-related, or statutory purposes covered by Section 7. Personal data may also be processed where necessary to fulfil legal obligations, comply with applicable regulations, or respond to lawful requests from competent authorities. The School will determine and document the appropriate legal basis for each specific processing activity. These provisions will not be interpreted as a general commercial legitimate-interest exemption or used to avoid obtaining consent where consent is legally required. All processing will remain subject to applicable data protection principles, safeguards, and individual rights.

Guardian notice: Many records belong to students under 18. If the student is a minor, a parent or guardian should use this portal or be present. The School processes this data only to provide certificates. See our Privacy Policy.

As student records may contain information relating to minors, the School takes additional measures to protect their privacy and personal data. Parents or legally authorised guardians are required to participate in the process and provide or approve requests on behalf of students whenever applicable. The School verifies parental or guardian authority through its established verification procedures and official school records. Providing consent through a checkbox or online declaration alone does not constitute sufficient proof of identity or legal authority.

The portal does not engage in behavioural monitoring, targeted advertising, or profiling activities involving children. Appropriate security measures, restricted access controls, and data protection practices are implemented to safeguard student information against unauthorised access, misuse, or disclosure.

The School uses trusted technology infrastructure to operate and maintain the certificate portal securely. Firebase and Google Cloud Firestore are used to manage application data, while Cloudflare R2 provides private storage for digital certificate documents. These services operate on behalf of the School in accordance with their applicable service terms and the security configurations implemented by the School. All certificate files are maintained in a private, access-controlled Cloudflare R2 storage environment. Access to these documents is restricted to authorised application processes and permitted users. Cloudflare Turnstile is integrated to protect the portal against automated submissions, spam, and other forms of misuse. As part of this protection, it may process certain technical information associated with incoming requests. The portal provides language selection through locally hosted translation files. Changing the display language does not transmit page content or personal information to any external translation service.

The original uploaded certificate is retained unchanged in private storage. When a certificate is previewed, printed, downloaded or included in a ZIP, the portal creates a separate copy with a light diagonal school watermark and a download-time footer. The watermark is not written back to the stored original. Successful file and ZIP downloads update anonymous aggregate counters on the certificate and by academic session; the download metrics do not record who downloaded a certificate, an IP address or a user-agent.

Configured hosting and storage region: India. The School should confirm the actual region, processor terms, data-location settings and any cross-border transfer requirements before launch. Access to processors is limited to the services needed to operate the portal.

The School maintains procedures to ensure that student information and certificate records remain accurate and up to date. Authorised School administrators may review and make necessary corrections to student details and certificate metadata when inaccuracies are identified or reported. Requests concerning incorrect student records are handled through the School’s designated support and record-correction process. Such reports and related correspondence are retained in accordance with the School’s officially approved recordkeeping and support-ticket retention policy, which will be established and published before the portal becomes operational. Student records are retained for a period of seven (7) years following the end of the relevant passing session. Upon expiry of this period, records are reviewed for secure deletion or anonymisation, subject to applicable legal and administrative requirements. Deletion requests are assessed by the School on a case-by-case basis. Information may be retained where continued storage is necessary to comply with legal or statutory obligations, satisfy legitimate academic recordkeeping requirements, address an ongoing dispute, or comply with a legal hold. Where no such requirement applies, the School will proceed with deletion in accordance with its data retention and disposal procedures.

The School must validate this schedule against applicable education, archival, limitation and other recordkeeping requirements. Deletion from active systems may be followed by expiry from encrypted backups under the documented backup rotation schedule. The configured backup rotation period is 30 days. The School must confirm this period and align the operational R2 lifecycle policy before production launch; copies expire when the rotation period ends.

Subject to the DPDP Act and other applicable law, a Data Principal or a person legally entitled to act for them may request access to information about processing, correction or completion of personal data, erasure where retention is not legally required, withdrawal of consent and grievance redressal. Requests may require identity and authority verification before the School acts.

Use the request form below or contact the School. The form creates a tracking acknowledgment ID; it does not itself verify identity or guarantee that a request will be granted. The School aims to acknowledge requests promptly and respond within 30 calendar days as an internal service target, or within any shorter/other period required by applicable law.

Grievance Officer / Data Protection contact:
Email:
Phone: Contact the School office
Postal address: Lodipur Zamania Ghazipur (U.P.),232329

When contacting the School regarding a privacy concern, data protection request, or complaint, please provide your acknowledgment or reference number, if one has been issued. To protect your personal information, include only the details necessary to explain your concern and avoid sharing confidential documents, identity proofs, or other sensitive information through ordinary email unless specifically requested through an authorised and secure channel. The School will review and address complaints in accordance with its established grievance-redressal procedures and applicable data protection requirements. If you are dissatisfied with the resolution provided by the School, you may exercise your right to seek further remedies through the appropriate legal and regulatory channels, including the Data Protection Board of India, subject to its legal constitution, jurisdiction, and the commencement of the relevant provisions of applicable law.

The School uses reasonable technical and organisational safeguards, including administrator multi-factor authentication, role-based access controls, server-side authorization, encrypted connections, restricted private certificate storage, audit records, rate limits, bot protection and access reviews. Firestore client access is denied and service credentials are kept server-side.

No system can be guaranteed completely secure. Users should protect their devices, avoid sharing access links and report suspected unauthorized access promptly.

If a personal data breach is suspected, the School will activate its incident-response process: contain the incident, preserve evidence, assess affected data and Data Principals, document decisions, remediate vulnerabilities and make notifications required by applicable law. Where the relevant DPDP provisions and Rules apply, the School will notify affected Data Principals without delay and notify the Data Protection Board in the form and timeline prescribed by the Rules, including the detailed intimation within 72 hours of awareness or any extended period allowed by the Board.

The School maintains a restricted breach register and will not publish details that could increase risk to affected individuals.

The School maintains an incident register to record suspected or confirmed data security incidents, the actions taken to investigate and address them, and decisions regarding any required notifications to affected individuals or relevant authorities. This register supports internal accountability, incident management, and ongoing improvements to the School’s data protection practices. Maintaining this register does not guarantee a specific legal or regulatory outcome, nor does it replace the need for professional legal guidance. Decisions concerning incident handling, reporting obligations, and regulatory compliance are made in accordance with applicable laws and, where necessary, in consultation with the School’s legal and data privacy advisers.

The portal uses essential cookies and technical storage required for security, administrator authentication and session integrity. It does not use marketing or advertising cookies, and does not sell personal data or run child-profiling analytics. Cloudflare Turnstile may use technical mechanisms necessary to distinguish legitimate requests from automated abuse. If you choose a language other than English, the portal stores your language choice in browser local storage so it can be restored on your next visit. The choice is not sent in a cookie.

Contact Satyam International School at or Lodipur, Zamania, Ghazipur, Uttar Pradesh 232329. This policy may be updated to reflect changes in the portal, law or School practices. The version and last-updated date at the top identify the currently published text.