NextOrg is a school-management SaaS platform (including RFID-based attendance hardware) operated by Susovan Pal, sole proprietor trading as Inloom Innovative Creations ("NextOrg," "we," "us," or "our"), registered under GSTIN 19GJYPP7000J1ZF, with its principal place of business at Sri Surura, near Katwa Govt. ITI, Srisurah, Katwa, Purba Bardhaman, West Bengal – 713130, India.
This Privacy Policy explains what personal data NextOrg collects and processes, why, and what rights individuals have in relation to it. Please read it alongside our Terms of Service and, where applicable, our Data Processing Agreement.
1. Two roles NextOrg plays
NextOrg's platform is used by schools ("Customers") to manage their students, staff, attendance, fees, and communications. It's important to understand the two different roles we play with respect to personal data:
- As a Data Processor. When a school uses NextOrg to store and manage information about its students, parents/guardians, and staff, the school is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") — it decides what data to collect and why, and it is the primary point of contact for students, parents, and staff regarding their personal data. NextOrg acts as a Data Processor, processing that data only on the school's documented instructions, under the terms of our Data Processing Agreement with the school. If you are a student, parent/guardian, or staff member of a school using NextOrg, your school's own privacy notice governs your relationship with the school, and this Policy describes how NextOrg, as the school's processor, handles that data on the school's behalf.
- As a Data Fiduciary in our own right. For information NextOrg collects directly — such as from a prospective customer filling out a contact form on our website, a school administrator's own account/billing details, or visitors to our marketing pages — NextOrg is the Data Fiduciary, and this Policy describes our own obligations to you directly.
2. Information we collect
2.1 Information schools input or generate through the platform (processed on the school's behalf)
| Category | Examples |
|---|---|
| Student identity & academic data | Name, date of birth, gender, nationality, admission/roll number, class/section, academic and exam records, report cards |
| Government identifiers | Aadhaar number (masked in the interface; see Section 8), PAN (staff only) |
| Sensitive/special-category data | Religion, caste/category, blood group, medical conditions, allergies |
| Photographs | Student and staff profile photographs |
| Contact information | Student, staff, and parent/guardian name, phone number, email address, home address |
| Attendance & location data | RFID card identifier, classroom and campus gate scan events, timestamps, and derived attendance records |
| Financial data | Fee structure, payment records, transaction identifiers (processed via our payment-gateway sub-processor) |
| Staff employment & payroll data | Employee code, designation, qualifications, bank account and IFSC details, emergency contact |
| Communications | Announcements, event details, and any file attachments a school uploads or sends through the platform |
| Device & technical data | Device identifiers (for RFID hardware and push-notification tokens), IP address, login timestamps |
2.2 Information NextOrg collects directly (as Data Fiduciary)
- Account and billing contact details for the school's authorized administrators (name, email, phone, billing address).
- Support communications (emails, calls, messages to our support channels).
- Website usage information (see Section 9, Cookies).
- Marketing contact details, if you sign up for updates or request a demo.
3. How we use information
We (and, where we act as processor, the school through us) use personal data to:
- Provide the core service: student/staff records, attendance tracking (including RFID-based attendance), fee management, exam/report-card management, and school-to-parent communications.
- Authenticate users and secure accounts.
- Send transactional notifications (email, and where enabled, SMS/WhatsApp/push) related to attendance, fees, exams, and announcements.
- Process payments through our payment-gateway sub-processor.
- Provide customer support and respond to inquiries.
- Maintain audit logs for security and accountability purposes.
- Comply with legal obligations and enforce our agreements.
We do not use student or staff personal data for advertising, and we do not sell personal data to third parties.
4. Legal basis for processing
Where NextOrg processes personal data as a Data Processor on behalf of a school, the school is responsible for establishing a valid legal basis (typically consent, given at admission or employment, or a legitimate educational/administrative purpose) under the DPDP Act. Where NextOrg processes personal data directly as a Data Fiduciary (Section 2.2), our legal basis is your consent (e.g., submitting a contact form) or our legitimate interest in operating and improving our services and responding to your inquiries.
5. Children's personal data
Many individuals whose data is processed through NextOrg are children (as defined under the DPDP Act). Consistent with Section 9 of the DPDP Act:
- Verifiable parental/guardian consent is obtained by the school at the time of a student's admission, before the student's personal data is entered into the platform. NextOrg provides schools with a Parental Consent Form template for this purpose (see
parental-consent-form.md) and a record in the platform of when and how that consent was obtained. - NextOrg does not undertake any tracking, behavioral monitoring, or targeted advertising directed at children. RFID-based attendance tracking is used strictly for attendance and campus-safety purposes on the school's instructions, and never for profiling or advertising.
- Parents/guardians may exercise rights on behalf of their child by contacting their school, which will coordinate with NextOrg as needed.
6. How we share information
We share personal data only as follows:
- With the school itself — the school's authorized administrators and staff can access data relevant to their role, as configured by the school.
- With sub-processors who help us deliver the service (cloud storage, email delivery, payment processing, and similar functions). Our current list of sub-processors, including their purpose and location, is maintained in
sub-processors.mdand is available to schools on request. - For legal reasons — if required by law, regulation, court order, or to protect the rights, safety, or property of NextOrg, a school, or any individual.
- In a business transfer — if NextOrg is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy's protections continuing to apply.
We do not share personal data with third parties for their own marketing purposes.
7. International data transfers
NextOrg primarily hosts and processes personal data using infrastructure located in India. Where any component of our infrastructure is located outside India, we take steps to ensure a level of protection consistent with the DPDP Act's requirements for cross-border transfer of personal data. Our current infrastructure locations are listed in sub-processors.md.
8. Aadhaar and other government identifiers
Where a school collects a student's or staff member's Aadhaar number as part of its admission or employment records, NextOrg:
- Displays only the last 4 digits of the Aadhaar number within the platform interface;
- Stores the Aadhaar number encrypted at rest; and
- Never uses the Aadhaar number as an authentication factor or for Aadhaar-based e-KYC/authentication.
9. Cookies and local storage
NextOrg's web application uses:
- An authentication token, kept in browser memory only during your session (not persisted).
- A refresh token, stored in your browser's local storage, used to keep you signed in.
- A small, non-personal interface-preference cookie (e.g., whether a sidebar is expanded or collapsed).
We do not currently use analytics or advertising cookies. If this changes, we will update this Policy and, where required, request your consent before enabling any new tracking technology.
10. Data retention
Personal data is retained in accordance with our published Data Retention & Deletion Schedule, which sets out how long each category of data is kept and when it is deleted or anonymized.
11. Security
We implement technical and organizational measures designed to protect personal data, including encryption of sensitive fields at rest, encrypted transmission (TLS) between the platform and its users and devices, role-based access controls scoped to each school and branch, and audit logging of changes to sensitive records. No system can be guaranteed 100% secure, and we continuously work to improve our safeguards.
12. Your rights
Subject to the DPDP Act and other applicable law, individuals have the right to:
- Access a summary of the personal data processed about them.
- Request correction of inaccurate or incomplete personal data.
- Request erasure of personal data that is no longer necessary for the purpose it was collected (subject to any legal retention requirements described in our Retention Schedule).
- Withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
- Nominate another individual to exercise these rights on their behalf, in the event of death or incapacity.
- Register a grievance regarding the processing of their personal data.
If you are a student, parent/guardian, or staff member, please direct these requests to your school in the first instance; NextOrg will assist the school in fulfilling them as required by our Data Processing Agreement. If you are contacting us directly as a prospective customer or website visitor, contact us using the details in Section 14.
13. Grievance Officer
In accordance with the DPDP Act, we have designated a Grievance Officer to address concerns regarding the processing of personal data:
Name: Mrinal Biswas
Email: info@nextorg.in
We aim to acknowledge grievances promptly and resolve them within the timelines prescribed under applicable law.
14. Contact us
- Support: support@nextorg.in
- Billing: info@nextorg.in
- Phone: +91 70631 39083 (general), +91 62918 25006 (technical)
- Support hours: Monday–Friday 9:00 AM–6:00 PM IST, Saturday 10:00 AM–2:00 PM IST
15. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be notified to schools through the platform or by email, with the "Last updated" date revised accordingly.
16. Governing law
This Policy is governed by the laws of India. Any disputes arising out of or relating to this Policy are subject to the exclusive jurisdiction of the courts at Kolkata, West Bengal.