Privacy Policy

1. Statutory Framework & Data Fiduciary

Bright – The School ("we", "our", or "the School"), located in Sun City, Bandlaguda Jagir, Hyderabad, Telangana 500086, functions as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and operates in compliance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 of the Republic of India.

This Privacy Policy outlines how we collect, process, store, and protect personal and sensitive information gathered through our official website (https://brightschooledu.com).

2. Protection of Children’s Personal Data (Section 9, DPDP Act 2023)

As an institution educating students from Preschool to Grade 5, the protection of minors is paramount:

• Verifiable Parental Consent: Under Section 9(1) of the DPDP Act 2023, any personal data of a minor child (including child’s name, age, date of birth, and grade) is collected strictly with the verifiable consent of the parent or lawful guardian who submits our admissions or visit enquiry form.
• Zero Behavioral Tracking & Profiling: In strict adherence to Section 9(3) of the DPDP Act 2023, Bright – The School does not engage in tracking, behavioral monitoring, or profiling of children, nor do we employ automated decision-making regarding minors.
• No Targeted Advertising: In compliance with Section 9(4) of the DPDP Act 2023, we never serve targeted advertisements directed at children or monetize student data in any manner.
• Well-Being Safeguards: We ensure that no processing of children’s data causes any detrimental effect on their physical or mental well-being.

3. Categories of Information Collected

We collect only the minimum data necessary for legitimate educational and admissions purposes:

• Parent / Guardian Details: Full name, WhatsApp/telephone contact number, email address, and communication preferences.
• Student Academic Information: Child's name, age, intended grade (Playgroup, Nursery, LKG, UKG, Primary Grades 1 to 5), and previous schooling details (if applicable).
• Tour & Inquiry Scheduling: Preferred campus visit dates, tour slots, and notes provided in enquiry forms.
• Technical Diagnostics: Standard non-identifying server logs (IP address, browser type, operating system) required for web security, DDoS prevention, and LiteSpeed cache delivery.

4. Lawful Purpose of Data Processing

Collected information is used exclusively for:

• Facilitating scheduled campus discovery visits and admissions counseling.
• Communicating admissions application status, fee transparency, and academic calendars.
• Responding directly via verified phone, WhatsApp, or email to parental enquiries.
• Complying with statutory reporting requirements established by the Department of School Education, Government of Telangana.

5. Student Photographs & Media Safeguarding

In accordance with child welfare principles and the Protection of Children from Sexual Offences (POCSO) framework:

• Photographs, artwork, and videos of students appearing on this website are captured exclusively during official school events, sports days, and educational workshops with prior written parental media authorization.
• We never publish student residential addresses, personal phone numbers, or roll numbers alongside photographs.
• Unauthorized downloading, scraping, reproduction, or redistribution of student photographs from this website is strictly prohibited and constitutes a punishable offense under the Information Technology Act, 2000 and the Indian Penal Code / Bharatiya Nyaya Sanhita.

6. Data Security & Storage Practices

In adherence to the Reasonable Security Practices mandated under Section 43A of the IT Act, 2000:

• All website traffic is encrypted using 256-bit Transport Layer Security (TLS / HTTPS).
• Admissions inquiry forms route data directly to our verified, access-controlled administrative desk.
• We do not sell, rent, lease, or trade personal data to commercial data brokers, advertising agencies, or marketing third parties.

7. Statutory Rights of Parents (Data Principals)

Under the DPDP Act 2023, parents and lawful guardians hold the following statutory rights:

• Right of Access: Request a summary of personal data held by the school and processing activities.
• Right to Correction & Erasure: Request the correction of inaccurate data or deletion of data no longer required for educational purposes.
• Right of Grievance Redressal: Avail of an expeditious, transparent grievance redressal mechanism regarding their data.
• Right to Withdraw Consent: Withdraw consent for admissions communications at any time.

8. Statutory Grievance Redressal Officer

In compliance with Rule 5(9) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 12 of the DPDP Act 2023, the designated Grievance Officer for Bright – The School is:

Any data grievance received will be acknowledged within 24 hours and addressed within a maximum of 15 to 30 days as prescribed by law.

9. Governing Law & Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India. Any disputes arising in connection with this policy shall be subject to the exclusive jurisdiction of the competent courts at Hyderabad, Telangana, India.