Privacy Policy for MNDL

1. Special Protection for Children & Minors

Given that MNDL serves minors (individuals under the age of 18):

2. Information We Collect

We only collect data strictly necessary to deliver MNDL's educational, leadership, and club experiences.

A. Student Information

• Identity & Profile (Helix): Student full name, date of birth, grade/class, school roll number, pedagogical stage, student photographs/avatars, and assigned home club (e.g., Vriksha, Jal, Agni, Vayu, Shoonya).
• National Academic Identifiers: APAAR ID (Automated Permanent Academic Account Registry) where integrated and authorized by the participating school.
• Extracurricular & Capstone Submissions: Code, music files, artwork, game builds, and project artifacts submitted under signature programs (such as the Anant capstone).
• Holistic Assessment Records (ViSE & PARAKH 360°): Non-academic competency milestones, leadership seat history (student executive council roles), badging, medal achievements, and sports/event participation records (e.g., Rankbhoomi).
• Well-being Data (CARE): Voluntary wellness milestones or physical activity engagement logs generated during the CARE program (stored under heightened access controls).

B. Parent, Guardian & Educator Information

• Name, relationship to student, email address, phone number, and digital consent records.
• Faculty mentor and Campus Ambassador role designations.

C. Device and Technical Information

• Log files, IP address, browser type, device identifiers, session timestamps, and operational telemetry required to maintain service security and prevent unauthorized access.

3. How We Collect Information

• Directly from Educational Institutions: Onboarding rosters provided by partner schools containing verified student enrollment details.
• Directly from Parents/Students: Submissions made when completing capstone projects, uploading badges, or participating in club voting.
• Automated System Operations: Platform telemetry gathered when navigating spaces (e.g., The Arcade Wing, The Pitch Lounge dashboards).

4. Purpose and Legal Basis for Processing

We process student and user data under the following legitimate grounds:

5. Sharing and Disclosure of Information

We do not sell, rent, or trade student data under any circumstances. Information is disclosed strictly under the following conditions:

• Your School / Educational Institution: Teachers, principals, and administrative liaisons have administrative access to the student progress dashboard, badge verification, and leadership metrics.
• Government & National Registries (APAAR / Ministry of Education): If integrated by the school, verified academic/extracurricular milestones may sync with national databases via secure government APIs.
• Vetted Cloud & Technology Service Providers: Secure hosting providers, database infrastructure, and notification services that operate under strict non-disclosure, confidentiality, and data protection agreements.
• Legal Compulsion: If compelled by applicable law, court order, or governmental authority under the laws of India.

6. Data Security and Storage

• Data Residency: Student personal data collected within India is stored on secure, encrypted servers situated within the territory of India in accordance with national regulations.
• Security Measures: All communications use Transport Layer Security (TLS 1.3). Sensitive profiles and records are encrypted at rest using AES-256.
• Role-Based Access Controls (RBAC): Access to student assessment records is strictly restricted to designated school mentors, parent ambassadors, and authorized iViRTH technical staff.

7. Data Retention and Account Lifecycle

• Active School Tenure: Data remains associated with the student's Helix profile throughout their transition across the four pedagogical stages (Kindergarten to Class 12).
• Graduation or Transfer: Upon departure from a participating school, the profile is either:
  • Handed over to the parent/student via export (transfer of portfolio/badges to APAAR), or
  • Archived/anonymized after a standard archival window (typically 90 days), unless retention is legally required by institutional audit norms.

8. User and Parental Rights

Under the Digital Personal Data Protection Act, 2023, and applicable privacy regulations, parents, legal guardians, and adult students enjoy the following rights:

1. Right to Access: Review a summary of all personal data held under the student's Helix profile.
2. Right to Correction & Updating: Request the rectification of inaccurate or outdated personal, academic, or club records.
3. Right to Erasure: Request the deletion of profile accounts and non-statutory records when withdrawing from the MNDL ecosystem.
4. Right to Withdraw Consent: Parents may revoke consent for non-essential programs (such as discretionary wellness logs or portfolio showcases) at any time.

Requests can be submitted directly through your school administration or by emailing privacy@ivirth.in.

9. Third-Party Links & Spaces

The MNDL platform may contain references or links to external club resources, coding environments (e.g., Python/Scratch tools for the AIM program), or student-developed projects. We are not responsible for the privacy practices or content of third-party websites. Parents and educators are encouraged to monitor external browsing.

10. Grievance Officer & Contact Information

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, the details of the Grievance Redressal Officer / Data Protection Officer (DPO) are: