Privacy Policy

1. Who is responsible

• The institution decides what information about its students, guardians and staff is kept and why, and is responsible for it (the controller). Sikkha Cloud stores and processes that information on the institution's behalf and on its instructions (the processor).
• For the people who register an institution, contact us or use the marketing site, Sikkha Cloud is responsible for their information.
• Questions about a child's records go to the institution first; we help the institution answer them.

2. What information is held

• Students: name (Bangla/English), student ID, class, section, roll, date of birth, gender, blood group, religion, photo and signature, birth registration and board registration numbers, address, attendance, marks and results, homework, fees and payments, documents the institution uploads, and notes the institution records (achievements, discipline, leave).
• Guardians: name, relationship, mobile number, email, national ID number if the institution records it, messages and payment records.
• Teachers and staff: name, contact details, designation, qualifications, attendance and leave, salary and payroll records, documents.
• Admission applicants: what the application form asks for — the child's details, the guardian's contact, documents, the form-fee transaction ID.
• Website visitors: what is sent through a school website's enquiry form or the sikkha.site contact form (name, mobile, message).
• Technical: sign-in records, the address (IP) a request came from, device and browser type, error logs. Failed sign-ins are counted to stop password guessing; on public forms a visitor's IP is kept only as a one-way hash, to count limits.
• We do not collect information for advertising and we never sell anyone's information.

3. Why it is used

• To provide the service to the institution: records, results, fees, notices, messages, reports and documents.
• To send the notifications the institution or user switches on — in the app and as push messages, by SMS through the institution's SMS service, and by email from the institution's own mailbox.
• To keep the service safe: sign-in, preventing abuse, backups and fixing problems.
• To bill the institution for its subscription and to support it.
• Children's information is never used for advertising or profiling.

4. Who can see it

• Inside the institution: the people it gives access to, by role — for example a guardian sees only their own children, and a teacher the classes and subjects assigned to them.
• The public: only what the institution chooses to publish on its website — notices, teachers' names and designations, the gallery, admission results, and published exam results, which need the roll plus the student ID or date of birth to open.
• Sikkha Cloud staff: only as far as needed to run the service, keep it safe, or help when the institution asks. Support access is time-limited and recorded.
• Those who help run the service: hosting — Contabo GmbH (servers in Germany); Cloudflare (network delivery and security); the SMS gateway the institution chooses; the institution's own email provider; the payment providers the institution connects (bKash, Nagad, SSLCommerz) — fee payments go straight to the institution's merchant account. Each receives only what its job needs.
• Authorities: when Bangladeshi law or a valid legal order requires it. We tell the institution unless we are not allowed to.

5. Where it is stored

Information is stored on servers in Germany (European Union) — that is, outside Bangladesh — and delivered through Cloudflare's network. Servers and backups are reached over encrypted connections.

6. How long it is kept

• While the account is active, records stay as long as the institution keeps them; the institution can correct or delete them.
• When an institution leaves: it can first download its information (CSV) from the reports page. Within 90 days of the account being closed its information and files are deleted from the live system, and they leave the backups as those roll over (daily backups are kept for 14 days).
• The counters behind public-form limits are kept for two days; sales enquiries for at most two years.

7. Security

• Every connection uses HTTPS; passwords are stored hashed and nobody can read them.
• Each institution's information is kept separate; access follows roles; private documents sit in non-public storage and open only for the right people.
• Sign-in limits, an audit log of important actions, daily encrypted backups and regular updates.
• No system is perfectly secure. If an incident affects personal information we will tell the affected institutions without undue delay, so they can inform families.

8. Children

Children do not sign up themselves; the institution creates their accounts. A student's account shows only their own records. Guardians can ask the institution to see or correct their child's information. Getting guardians' consent before publishing a student's photo or result on the website is the institution's responsibility.

9. Your choices

• Students, guardians and staff: ask the institution to show, correct or delete your information; the institution can do so.
• Institutions: can export, correct or delete information, or close the account, at any time.
• Bangladesh's personal data protection law is still in draft. When a law takes effect we will follow it and update this policy.

10. Cookies

• Only cookies the service needs: keeping you signed in (shikkha_session), your language (shikkha_lang), which child a guardian is viewing (shikkha_child), and a 15-minute cookie that shows an admission form again after an error.
• The theme and unsent drafts stay in your browser. Cloudflare may set its own security cookies to protect the site. There are no advertising or tracking cookies.

11. Changes

The version and date are shown above. Before a significant change takes effect we will tell institutions in the app.

Contact

Questions about this document or your information:

• Phone: 01860988859
• WhatsApp: 01860988859
• Contact form