Privacy Policy
At Locus (operated by Locus Systems Inc.), we hold the trust of schools, educators, parents, and students as our highest priority. This Privacy Policy details how we collect, process, store, and safeguard personal and institutional data across the Locus School ERP platform, Web Portals, and Mobile Applications (including the Locus Staff App, Teacher Portal, and Parent App).
We never monetize, rent, or sell student or institutional data to advertisers or third-party brokers.
AES-256 encryption at rest and TLS 1.3 in transit safeguard all records, logs, and attachments.
Partner institutions retain absolute ownership over all academic records, student profiles, and fee ledgers.
Strict granular permission controls guarantee that users only see data pertinent to their institutional role.
Table of Contents
Have specific compliance inquiries or need data export assistance? Contact our Data Protection Team directly.
privacy@getlocus.school1Introduction & Applicability
Locus Systems Inc. ("Locus", "we", "our", or "us") develops and operates an institutional School Management System (SMS) and Enterprise Resource Planning (ERP) platform designed for K-12 schools, colleges, educational trusts, educators, parents, and students.
This Privacy Policy applies to:
- Our marketing and administrative web portal at https://getlocus.school
- The Locus Web Application and Cloud ERP dashboard used by school administrators, principals, accountants, and teachers.
- The Locus Staff Mobile App (Android & iOS) used by teachers, coordinators, transport drivers, and staff.
- The Locus Parent & Student Mobile App and web portals used for fee payment, attendance records, exam results, and communications.
2Roles: Data Controller vs. Data Processor
Under applicable data protection legislation (including India's Digital Personal Data Protection Act 2023 and GDPR principles):
The Educational Institution (Data Fiduciary / Controller)
The partner school or educational trust determines what student, parent, and staff data is collected, configured, and processed to fulfill educational and administrative obligations.
Locus Systems Inc. (Data Processor)
Locus processes institutional data strictly on behalf of and according to the instructions and software configuration provided by the partner school.
3Information We Collect
Depending on your interaction with the platform and your assigned role (Admin, Teacher, Staff, Parent, Student), we process the following categories of information:
A. Institutional & School Administrator Details
School name, affiliation board (CBSE, ICSE, State Boards), campus addresses, administrator names, official email addresses, contact numbers, and billing configurations.
B. Student Academic & Identity Records
Student full name, admission/roll number, grade/class, section, date of birth, gender, attendance records, exam marks, report cards, fee schedules, optional dietary/medical emergency notes, and parent linkages.
C. Parent & Guardian Information
Parent/guardian names, relationship to student, phone numbers (for SMS/WhatsApp alerts and OTP authentication), email addresses, residential address, fee payment receipts, and transaction reference IDs.
D. Teacher & Staff HR Records
Staff names, employee ID, assigned subjects/classes, work email, phone number, attendance logs, leave balances, and salary disbursement records.
E. Diagnostic, Log & Security Data
IP address, device model, operating system version, browser type, login timestamps, and error diagnostics collected automatically to maintain system security and uptime.
4Mobile App Permissions (Staff & Parent Apps)
Our mobile applications (such as the Locus Staff App) request specific device permissions strictly when needed to enable functional ERP workflows:
Used by teachers/staff to capture profile photos, scan student documents during admission, or upload homework assignments and fee challans.
Required to download fee receipts, report cards, syllabus PDFs, and timetable schedules to local device storage.
Sends critical announcements, circulars, emergency closures, attendance absence alerts, and fee due reminders.
Monitors internet connectivity to enable offline attendance mark-and-sync capabilities for teachers with limited connectivity.
5How We Use Collected Information
We process personal data solely for legitimate educational, administrative, and contractual purposes:
- Core Academic Delivery: Recording daily classroom attendance, generating CBSE/ICSE gradebooks, scheduling examinations, and managing class rosters.
- Financial Operations: Calculating school fee structures, generating fee demands, verifying UPI/Netbanking payments, and providing digital receipts.
- Automated Institutional Communications: Transmitting transactional SMS, WhatsApp updates, and email notifications to parents regarding absences or exam dates.
- Security & Fraud Prevention: Authenticating user credentials, logging administrative actions for auditing, and preventing unauthorized access.
- Customer Support & Maintenance: Assisting school administrators and resolving technical tickets raised by users.
6Student & Minor Privacy
Student data is collected strictly under the authorization and supervision of the student's school and legal guardians. In compliance with student privacy principles and the Digital Personal Data Protection Act:
- We do not serve third-party ads or engage in behavioral tracking of students.
- Student academic records are accessible only to authorized staff and the student's verified parents/guardians.
- We do not create commercial profiles or sell student browsing data.
7Data Sharing & Third-Party Processors
We never sell personal information. Data is shared exclusively with vetted infrastructure and operational service providers under strict data protection agreements:
8Data Security & Encryption
Locus enforces rigorous technical and organizational measures to safeguard institutional records:
AES-256 Encryption
Data at rest is secured with military-grade encryption.
TLS 1.3 in Transit
All web and API traffic is encrypted end-to-end via HTTPS.
Daily Backups
Automated geo-redundant snapshots guarantee business continuity.
9Data Retention & Account Deletion Requests
We retain institutional data for the duration of the school's active service contract and as required by educational record-keeping regulations.
Account & Data Deletion Procedure:
- Parents & Students: Since student records are managed by the school, deletion requests should first be directed to the school administration. You may also contact our grievance officer to facilitate coordination.
- Staff & Teachers: Staff profile removal or credential revocation can be executed by the school admin or by emailing privacy@getlocus.school.
- School Termination: Upon termination of institutional contracts, all school databases and media backups are securely purged following a 30-day export grace period.
10Your Rights as a Data Principal
Under the DPDP Act 2023, individuals whose data is processed have the right to:
11Cookies & Telemetry
Our web application uses essential first-party session cookies to manage user logins, maintain active sessions securely, and remember user interface preferences. We do not employ third-party tracking cookies across our authenticated school portals.
12Grievance Officer & Contact Details
In compliance with the Information Technology Act 2000 and Digital Personal Data Protection Act 2023, the details of our Grievance Redressal / Data Protection Officer are:
Grievance & Data Protection Officer
Locus Systems Inc. Legal & Compliance Cell
Email Address
privacy@getlocus.schoolGeneral Inquiries
info@getlocus.schoolPhone Support
+91 81002 40904Hours
Monday to Friday, 9:30 AM – 6:30 PM IST