These terms form part of the agreement between a school and [legal entity name] (“WRAB”) under our terms of service. Under the Digital Personal Data Protection Act, 2023, the school is the data fiduciary for the personal data it keeps in WRAB SCHOOL, and WRAB is its data processor. The person registering the school accepts these terms on the school’s behalf.
1. What WRAB processes
Personal data of the school’s students, parents and guardians, applicants, staff and visitors that the school or its users put into the Service, for the duration of the agreement. The kinds of data are listed in the privacy policy. Processing consists of storing, organising, displaying, transmitting and backing up that data so the Service works.
2. Only on the school's instructions
- WRAB processes school data only to provide the Service and as the school instructs through its settings, its users’ actions or in writing. We do not use it for our own purposes, for advertising, or to train AI models, and we never sell it.
- If we believe an instruction breaks the law, we tell the school.
3. Our people
Only WRAB personnel who need to, to run or support the Service, can reach school data, and they are bound by confidentiality. Ordinary provider accounts have no access to school records through the Service.
4. Security measures
- Data stored in India on WRAB-operated servers; encrypted backups with a copy at a separate site; tested restores.
- Every school’s data separated from every other school’s at every layer, with automated tests that try to cross that line.
- Uploaded files encrypted with a key per file; sensitive fields (identity numbers, bank accounts, authenticator secrets) encrypted; passwords stored only as hashes; encrypted connections.
- Access by role and scope; two-step verification for sensitive actions; audit records of important actions that the school can review.
5. Sub-processors
WRAB uses the following to deliver parts of the Service. Each is bound to protect the data and use it only for that purpose. We tell schools at least 30 days before adding or replacing one that handles school data, so a school can object.
| Purpose | Who | Data involved |
|---|---|---|
| Hosting, storage and backups | WRAB's own servers in India | All data. No third party hosts school data. |
| Email delivery | WRAB's mail service (wrabtech.com) | Email address, message content |
| SMS and WhatsApp delivery | A provider registered in India (to be listed before it is used) | Phone number, message content |
| Push notifications to phones | Google Firebase Cloud Messaging, when enabled | Device token, notification title and short text |
| Online fee payment | Razorpay, when the school turns on online payment | Payer name, contact, amount; card and UPI details go directly to the gateway |
| AI helpers | Only if the school turns them on: the model it chooses (WRAB-hosted, or an external provider) | The text being translated or drafted, with names left out where possible |
| Map tiles | OpenFreeMap | The map area being viewed and the device's IP address; no school data |
6. Personal data breaches
If WRAB becomes aware of a breach affecting a school’s data, we tell the school without undue delay and in any case within 24 hours, with what we know: what happened, the data and people affected, the likely consequences and what we are doing. We help the school notify the Data Protection Board of India and the people affected, as the DPDP Act and Rules require, and keep a record of the breach.
7. Helping with people's rights
WRAB SCHOOL lets the school view, correct and export the records it keeps, and lets each person download their own account data. If someone asks WRAB directly about a school’s records, we pass the request to the school and help it respond.
8. Where data is processed
School data is stored and processed in India. A sub-processor outside India is used only where listed above and only for that purpose, and never for hosting school records.
9. Return and deletion
- The school can download all of its data at any time, in open formats (CSV files and the original documents), from Settings → Data export.
- After the agreement ends, the owner keeps read-only access to download data for 90 days. The data is then kept only as long as the retention period requires (at least three years, for the school’s legal record-keeping), protected as described here, and then deleted, including from backups as they expire. The school can ask for earlier deletion where the law allows.
10. Information and audits
WRAB gives the school the information it reasonably needs to show compliance with the DPDP Act, including a description of these measures and answers to security questionnaires. Audits beyond that are arranged by agreement, with reasonable notice and confidentiality.
11. Contact
Data protection questions: [privacy email].
Questions about this document? Write to [privacy email] or hello@wrabschool.com.