Who This Policy Covers
This policy explains how Campus Flow Technologies Private Limited (Campus Flow, we, us) collects and uses personal data when you visit campusflow.io, book a demo, or use the Campus Flow education CRM, the student and parent portal and the mobile apps.
When an institution uses Campus Flow to manage its enquiries, applicants, students and parents, the institution is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 and Campus Flow acts as its Data Processor. For visitors to our website and for the staff accounts we administer, Campus Flow is the Data Fiduciary.
Information We Collect
We collect only what the service needs to work.
- Account data for institution staff, such as name, work email, phone number, role and campus.
- Data entered by institutions about enquiries, applicants, students, parents and alumni, including contact details, programme preferences, entrance scores, documents, fee records and counselling notes.
- Usage data such as pages opened, features used, device type and approximate location derived from IP address.
- Communications you send us, including support tickets, call recordings where notified, and demo requests.
How We Use It
We use personal data to provide and secure the service, to send operational messages such as fee receipts and counselling reminders on behalf of institutions, to answer support requests, to improve the product using aggregated usage patterns, and to meet legal obligations.
We do not sell personal data. We do not use student or parent data to build advertising profiles or train models for third parties.
Student and Parent Data
Institutions decide what data to collect from students and parents and must obtain verifiable parental consent for children under 18 as required by the DPDP Act. Campus Flow provides consent capture, consent records and withdrawal tools inside the product so that institutions can meet this obligation.
Students and parents who wish to access, correct or delete their data should contact their institution first. We will help the institution respond within the statutory timeline.
Retention and Deletion
Institution data is retained for the life of the subscription and for 90 days after it ends, during which the institution can export everything. After that period it is deleted from production systems and purged from backups within a further 35 days.
Website analytics data is kept for 14 months. Demo request details are kept for 24 months unless you ask us to remove them sooner.
Security
Data is hosted in Indian data centres, encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Access is role-based and logged. We run daily encrypted backups, annual third-party penetration tests and maintain ISO 27001 aligned controls.
If a breach affects personal data we will notify affected institutions and the Data Protection Board of India as required, without undue delay.
Your Rights Under DPDP
You have the right to access a summary of your personal data, to correct or erase it, to withdraw consent, to nominate another person to exercise these rights, and to raise a grievance. Requests are handled within 30 days.
To exercise these rights for an institution account, write to our Grievance Officer at the address below. For student or parent data, contact your institution, which can act in the product directly.
Contact
Grievance Officer, Campus Flow Technologies Private Limited, 4th Floor, Westgate Business Bay, SG Highway, Ahmedabad 380015, Gujarat, India. Email privacy@campusflow.io. Phone 84018 26262.
We may update this policy from time to time. Material changes will be announced in the product and by email to institution administrators at least 30 days before they take effect.