Privacy Policy

1. Who we are and our role

OVIA ERP is operated by AYCreation IT Services, based in Ranchi, Jharkhand, India.

When the school is the Data Fiduciary

When a school uses OVIA ERP to manage its students, parents, and staff, the school decides what data is collected and why. In DPDP terms the school is the Data Fiduciary and we act as a Data Processor, handling that data only on the school's instructions to provide the Service. Questions about a specific child's data should be directed to the child's school.

When we are the Data Fiduciary

For our own website visitors, enquiries, and account administrators, we determine the purpose of processing and act as the Data Fiduciary for that limited data.

2. Information we collect

We collect the following categories of data:

• Account and school data — school name, address, administrator names, contact details, and login credentials.
• Data entered into the Service by the school — student and parent identity and contact details, admission records, attendance, academic records and grades, fee and payment records, transport and hostel details, and communication logs.
• Website and usage data — pages visited, device and browser information, and cookies/analytics identifiers when you use our website.
• Enquiry data — the name, phone number, email, and message you provide when you contact us or request a demo.

We do not collect biometric, proctoring, or surveillance data as part of the standard Service. If a school separately enables any such feature, it does so as the Data Fiduciary and must obtain the necessary consents.

3. How we use personal data

We use personal data only for clear, limited purposes:

• To provide, operate, and maintain the Service for the school.
• To provide onboarding, training, and customer support.
• To process billing and manage the subscription.
• To send service-related communication (e.g. important notices, security alerts).
• To comply with legal and statutory obligations.
• To improve reliability and features using aggregated, de-identified information.

We distinguish essential processing (such as attendance, grading, and fee records, which are necessary to deliver the Service) from any secondary use. We do not use students' personal data for advertising, and we do not sell personal data to anyone.

4. Children's data and consent

Much of the data in the Service relates to children. Under the DPDP Act, processing a child's data requires verifiable consent from a parent or lawful guardian. That consent is obtained and managed by the school as the Data Fiduciary; we process children's data only to provide the Service to the school.

• Access to a child's education is never conditioned on collecting more data than is necessary.
• We do not carry out tracking, behavioural monitoring, targeted advertising, or harmful profiling of children.
• Consent can be withdrawn; on withdrawal, the relevant processing stops, subject to the school's instructions and any legal retention requirements.

5. Where your data is stored and how we protect it

All personal data in OVIA ERP is hosted in data centres located in India. We apply industry-standard safeguards designed to protect it, including:

• Encryption of data in transit and at rest.
• Role-based access controls, so users see only what their role permits.
• Regular automated backups.
• Access restricted to authorised personnel on a need-to-know basis.

No method of transmission or storage is completely secure, but we work to protect personal data using reasonable technical and organisational measures and to improve them over time.

6. Sharing and sub-processors

We share personal data only where necessary to run the Service, and always under appropriate confidentiality and data-protection obligations:

• Infrastructure and hosting providers operating data centres in India.
• Communication providers used to deliver SMS, WhatsApp, or email notifications you enable.
• Payment providers used to process fees, where applicable.
• Authorities or courts, where disclosure is required by law.

We do not sell, rent, or trade personal data.

7. Data retention and deletion

We retain personal data for as long as the school's subscription is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

If a school stops using OVIA ERP, we make its data available for export in standard formats within seven days of a written request, after which the data is deleted from active systems in line with our retention schedule and backup cycle.

8. Your rights under the DPDP Act

Subject to the DPDP Act, data principals (including parents on behalf of their children, through the school) have the right to:

• Access the personal data we hold about them.
• Request correction of inaccurate or incomplete data.
• Request erasure of personal data, subject to legal retention needs.
• Withdraw consent where processing is based on consent.
• Raise a grievance and seek redressal.

For data held on behalf of a school, please raise requests with the school, which will coordinate with us. For data for which we are the Data Fiduciary, contact us at support@oviaerp.com.

9. Cookies and website analytics

Our website uses a small number of cookies. Strictly necessary cookies (including the one that remembers your cookie choice) are always active. We also offer optional analytics cookies, which are off by default and set only if you accept them via our cookie banner.

If you accept analytics cookies, we use:

• Google Analytics 4 (Google) — measures aggregate traffic and two conversion actions (clicking a WhatsApp link and requesting a demo) so we can understand which pages are useful. It collects usage and device/browser information and a pseudonymous identifier; it is not used to identify you personally.
• Microsoft Clarity (Microsoft) — provides aggregated heatmaps and session replays that help us spot usability problems. Form inputs such as phone numbers and email addresses are masked and are not recorded.

Neither tool loads until you accept analytics cookies, and neither is used for advertising. You can change or withdraw your consent at any time using the "Cookie Preferences" link in the website footer; withdrawing consent stops these scripts from loading on future page views. You can also control cookies through your browser settings.

10. Cross-border transfers

Personal data in the Service is stored and processed in India. We do not transfer it outside India except to jurisdictions permitted under the DPDP Act and applicable government notifications, and only with appropriate safeguards.

11. Data breach notification

In the event of a personal data breach, we will follow the notification requirements of the DPDP Act, including informing the Data Protection Board of India and affected data principals (via the relevant school where applicable) as required.

12. Grievance officer

If you have any concern about how your data is handled, you can contact our Grievance Officer:

• Company: AYCreation IT Services
• Email: support@oviaerp.com
• Phone: +91 77177 07317
• Address: Ranchi, Jharkhand, India

We aim to acknowledge grievances promptly and resolve them within the timelines prescribed under the DPDP Act.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify schools through the Service.