Legal
Privacy
What REO360 collects, why, and on whose instruction.
Last updated 13 September 2026
Draft for the rebuild. Every section marked below is placeholder structure and has not yet been reviewed by counsel.
1. Who is responsible for your data
For pupil, guardian and staff records, the school is the Data Fiduciary and REO360 is a Data Processor acting on the school's documented instruction. Ask your school for their own privacy notice — it governs what they collect and why.
For the accounts of people who contact us through this site, REO360 is the Data Fiduciary.
2. What we collect
Identity: a verified mobile number, and the name, email and role the school records for you.
School records: enrolment, attendance, homework, marks, fees, transport and any module the school switches on.
Technical: device and browser information, IP address and audit logs of actions taken in the platform.
We do not collect biometric data, and we do not use pupil data to train models.
3. Legal basis and consent
[to be reviewed by counsel]Processing rests on the school's contract with REO360 and on consent where the DPDP Act requires it, including verifiable parental consent for pupils under 18.
The consent artefacts, notice wording and withdrawal mechanics in this section are placeholder structure.
4. Retention and deletion
[to be reviewed by counsel]Records are kept for as long as the school's contract runs and for the statutory period after it ends, then deleted or returned.
Exact retention periods per record class are placeholder structure.
5. Your rights
[to be reviewed by counsel]Under the DPDP Act you may ask for access to your data, correction of it, and — where the law allows — its erasure. Requests about school records go to your school, which we then act on.
Grievance-officer details and response timelines are placeholder structure.
6. Sub-processors
[to be reviewed by counsel]We use Indian cloud hosting, an Indian payment gateway and Indian SMS and WhatsApp providers. A current list is available to schools on request.
The published sub-processor list and change-notification period are placeholder structure.