Skip to content
Mobiskul

Privacy Policy

Last updated:

1. Introduction

Mobiskul ("we," "us," "our," or the "Platform") is a school management ERP platform operated by Mobiskul, accessible at mobiskul.com. This Privacy Policy describes how we collect, use, store, share, and protect personal information when you use our website, applications, and related services (collectively, the "Services").

This policy applies to all users, including school administrators, teachers, parents and guardians, students, and platform administrators. By accessing or using the Services, you acknowledge that you have read and understand this Privacy Policy.

We comply with the General Data Protection Regulation (GDPR), the UK GDPR, the ePrivacy Directive, and the Digital Personal Data Protection Act, 2023 (India DPDP Act).

2. Data Controller Identification

The data controller responsible for your personal data is Mobiskul. For the purposes of the GDPR, our registered office is in India. Schools that use the Platform act as independent controllers (or processors) for the student and staff data they upload, and are responsible for obtaining the necessary consents from data subjects.

You may contact our Data Protection Officer at dpo@mobiskul.com.

3. Data We Collect

We collect information you provide directly, data generated through your use of the Services, and data from integrated third parties.

  • Account and profile information — name, email, phone number, password (hashed), profile photo, role, and school affiliation.
  • Academic data — enrollments, attendance, grades, timetables, homework, and examination records.
  • Financial data — fee structures, payment records, invoices, and billing details.
  • Usage and technical data — IP address, device and browser information, session logs, and feature interactions.
  • Communications — messages sent through the Platform and support requests.

4. Purpose of Processing

We process personal data to:

  • Provide, operate, and secure the Services.
  • Manage accounts, authentication, and access control.
  • Enable academic, attendance, fee, and communication workflows.
  • Send transactional and operational notifications.
  • Analyze usage, diagnose issues, and improve the product.
  • Comply with legal and regulatory obligations.

5. Legal Basis for Processing

We rely on the following legal bases under Article 6 GDPR:

  • Contract (Art. 6(1)(b)) — to provide the Services you request.
  • Legitimate interests (Art. 6(1)(f)) — for security, analytics, and product improvement.
  • Consent (Art. 6(1)(a)) — for non-essential cookies and marketing communications.
  • Legal obligation (Art. 6(1)(c)) — to comply with applicable laws.

Where we process special category data (e.g., health or biometric data), we rely on Article 9 conditions such as explicit consent or substantial public interest as applicable.

6. Data Sharing and Subprocessors

We do not sell your personal data. We share data only with:

  • Schools and authorized users — within the scope of their roles.
  • Subprocessors — cloud hosting (e.g., Cloudflare), email and SMS providers, and payment processors (e.g., Stripe), under data processing agreements.
  • Authorities — where required by law or to protect rights and safety.

All subprocessors are contractually bound to process data only as needed and in compliance with applicable law.

7. International Data Transfers

Where personal data is transferred outside your jurisdiction, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or adequacy mechanisms under the DPDP Act, ensuring a comparable level of protection.

8. Data Retention

We retain personal data only as long as necessary for the purposes described, to comply with legal obligations, and to resolve disputes. Account data is retained for the duration of the relationship; logs and analytics are retained on a rolling basis (typically 12–24 months). Upon school offboarding, data is deleted or returned in accordance with the agreement.

9. Your Rights

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten").
  • Restrict or object to certain processing.
  • Data portability.
  • Withdraw consent at any time.
  • Lodge a complaint with a supervisory authority.

To exercise these rights, contact privacy@mobiskul.com. We respond within statutory timeframes (generally one month under GDPR).

10. Children's Privacy

The Services are intended for use by schools and authorized users. Student data is collected and processed on behalf of schools, which are responsible for obtaining parental consent where required (including under COPPA for users under 13 in the US). We do not knowingly collect data directly from children without school authorization.

11. Security Measures

We protect personal data with encryption in transit (TLS) and at rest, role-based access controls, tenant isolation, multi-factor authentication, audit logging, and continuous monitoring. See our Security Policy for details.

12. Cookies

We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are set only with your consent.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Services or by email, and we will update the "Last updated" date above.

14. Contact

Back to Home