Privacy notice

Draft 2, 11 November 2026. Also in Telugu.

This notice is for the parents, students and staff of colleges that use Nat IMS, and for anyone who contacts us. It says what personal data is handled, why, where it is kept, and what you can do about it. You can read it in English or in Telugu (Digital Personal Data Protection Act, 2023, section 5(3)). If the two ever differ, [NEED: which version prevails, for the lawyer to decide].

1. Who is responsible

Your college. The college decides which records it keeps about its students, parents and staff, and why. Under the Digital Personal Data Protection Act, 2023 (the “Act”) that makes the college the Data Fiduciary for those records (section 2(i)).

Nat IMS. Nat IMS, run by devsforfun Studio (OPC) Private Limited, Main Street, Konkadivaran, Parvathipuram, Andhra Pradesh 535501, provides the software the college uses. We handle the college’s records only on the college’s behalf and under a written contract with it, so for those records we are the college’s Data Processor (sections 2(k) and 8(2)).

For the details of people who contact Nat IMS directly, and for this website, Nat IMS is the Data Fiduciary.

2. What the college keeps in Nat IMS, and why

Students

Name, admission number, gender, date of birth, year, group, section, coaching batches, hostel or day scholar, BIE hall ticket numbers, APAAR ID and PEN if given, Aadhaar number if the parent chooses to give it (see below), photo if added, and whether still enrolled. Attendance. Fees due and paid, concessions and receipts. Test marks and report cards.

Why: to keep the college’s registers, fee records and exam records, and to send parents the messages they agreed to.

Parents and guardians

Name, relation to the student, mobile number, whether it has WhatsApp, preferred language (Telugu or English), when and how they agreed to messages, and whether each message was sent, delivered or read.

Why: to send the messages they agreed to, and to show that they agreed.

College staff

Name, phone number, designation, subjects, role, a scrambled (hashed) copy of the password, staff attendance and check-in times.

Why: to let staff log in, and to keep staff attendance.

Everyone above

A record of which staff member changed which record, when, and what it was before and after.

Why: security, and to settle disagreements about who did what.

Aadhaar numbers

Giving a student’s Aadhaar number is optional (voluntary). The college asks for it only to match the student’s records with government records. Not giving it changes nothing: no student may be refused admission or any service because of it. When it is given:

• the full number is stored encrypted, and the key is kept apart from the database;
• screens show only the last four digits, as XXXX XXXX 1234;
• only the college’s owner login can see the full number, after typing a reason, and each time it is seen Nat IMS records who saw it, when and why;
• it never appears on receipts, report cards, WhatsApp messages or data exports (exports carry only the last four digits);
• the college can remove it at any time, and does so when the parent (or the student, once 18) asks.

[NEED: lawyer to confirm how the Aadhaar Act, 2016 and its regulations apply to a college keeping Aadhaar numbers this way]

Nat IMS does not hold bank or card details: a fee payment is recorded by mode (cash, UPI or cheque) and a reference only.

3. WhatsApp messages to parents

A parent gets messages only after the college has recorded their agreement (opt-in). The messages are absence alerts (and a correction if the student came late), fee receipts with the receipt as a PDF, fee due reminders, and weekly test marks. Each is in Telugu or English, as the parent chose.

Each message carries only what it needs: the student’s name and class, the date and the college’s name, plus the amount, receipt or marks when the message is about those. Messages come from the Nat IMS WhatsApp number and name the college. Nat IMS sends no advertising.

To reach a parent, a message passes through Meta’s WhatsApp Business Platform (the WhatsApp Cloud API). Meta handles it for Nat IMS as a processor under Meta’s terms. Meta processes messages in its own data centres, which may be outside India, and keeps message content for up to 30 days to run the service, for example to retry a message that didn’t go through. WhatsApp’s own terms and privacy policy also apply to everyone who uses WhatsApp.

4. Where records are kept, and for how long

Everything except the WhatsApp messages is kept in India, on Amazon Web Services in Mumbai (the ap-south-1 region): the database, the receipt PDFs and other files, and the logs. Backups of the database are kept for 30 days.

• Records stay while the college uses Nat IMS and needs them. When a college stops using Nat IMS, we give it a full copy of its records and then delete them.
• When a parent withdraws agreement, messages to them stop at once. The college decides what happens to its other records, as the law allows (section 8(7)).
• Logs of who did what are kept for one year and then deleted (DPDP Rules, 2025, rules 6(1)(e) and 8(3)).

5. Who can see the records

• The college’s own staff, each according to their role. Another college that uses Nat IMS can’t see your records. The database keeps each college’s records apart.
• The Nat IMS team, only to set up the college, give support and fix problems. When a team member opens a college’s screens, Nat IMS records it.
• Our service providers: Amazon Web Services, which hosts Nat IMS in Mumbai, and Meta, which delivers WhatsApp messages.
• Authorities, when the law requires it.

We don’t sell personal data. We don’t use it for advertising or to build profiles of anyone.

6. Students under 18

Under the Act, anyone under 18 is a child (section 2(f)), so most junior college students are children. Before processing a child’s data, the college must get verifiable consent from a parent or lawful guardian (section 9(1)). The DPDP Rules, 2025 say how the college checks that the person giving consent is an identifiable adult (rule 10). The Rules exempt educational institutions from section 9(1) and 9(3) only for tracking and behavioural monitoring for their educational activities or for the safety of their enrolled children (rule 12 and the Fourth Schedule, Part A, item 3). The college decides which applies to it; our consent form is there to help.

No one may process a child’s data in a way likely to harm the child’s well-being (section 9(2)). Nat IMS never targets advertising at children (section 9(3)).

When a student turns 18, the rights in this notice belong to the student, not the parent. The college then asks the student whether messages should still go to their parent.

7. How the records are protected

• Records are encrypted when stored and when they travel over the internet.
• The database keeps each college’s records apart, and each staff login sees only what its role allows.
• Passwords are stored scrambled (hashed), never as typed.
• Aadhaar numbers are encrypted again, separately, and only the owner login can see one in full; every view is logged.
• Every change is recorded with who made it and when.
• Backups and logs are kept as described above.

These follow the reasonable security safeguards in rule 6 of the DPDP Rules, 2025.

8. If something goes wrong

If a personal data breach affects you, you are told without delay what happened, what it may mean for you, what is being done, what you can do to protect yourself, and who to contact (section 8(6) and rule 7). For college records the college tells you, and Nat IMS helps it. Nat IMS tells the college within 24 hours of finding out, and reports the incident to CERT-In as the CERT-In Directions of 28 April 2022 require.

9. Your rights

Under sections 11 to 14 of the Act you can:

• get a summary of the personal data held about you and how it is used, and the names of others it was shared with;
• have it corrected, completed or updated, and have it erased when it is no longer needed and no law requires it to be kept;
• withdraw your consent at any time, as easily as you gave it (section 6(4)). What was done before you withdrew stays lawful;
• have a complaint answered. Complaints are answered within 90 days at most (rule 14(3));
• name someone to use these rights for you if you die or can’t act yourself.

How to use them. For college records, ask your college office first: the college holds the records and decides about them. You can also write to the Nat IMS contact below. We pass college matters to the college and help it answer.

If your complaint isn’t settled, you can complain to the Data Protection Board of India once you have used the grievance process of the college or of Nat IMS (section 13(3)). [NEED: the Board’s complaint link once it is published]

The Act also asks you not to give false information or file false or frivolous complaints (section 15).

10. This website

This site sets no cookies and runs no analytics or tracking scripts. [NEED: confirm whether the site’s hosting keeps access logs, and for how long]

If you phone or write to us, we keep your name, contact details and what you asked, to reply and follow up. [NEED: how long these are kept]

11. Contact

The person who answers questions about personal data for Nat IMS (Act, section 8(9); Rules, rule 9):

Grievance Officer, devsforfun Studio (OPC) Private Limited
Email: hello@devsforfun.com, with “Grievance / DPDP” in the subject
Phone: +91 78426 49226 (Monday to Friday, 10:00 to 18:00 IST)
Post: Main Street, Konkadivaran, Parvathipuram, Andhra Pradesh 535501

12. When these rules apply

The DPDP Rules, 2025 were published on 13 November 2025. Most of the duties in this notice, including notice, consent, security, breach reporting and your rights, start on 13 May 2027, eighteen months later. Until then, section 43A of the Information Technology Act, 2000 and the rules made under it still apply. Nat IMS follows the DPDP duties already. [NEED: check egazette.gov.in for any change to the start date]

13. Changes to this notice

When this notice changes, we update it here with a new date and tell the colleges that use Nat IMS.