Privacy Policy

1 Who we are

Baton is an academy operations and compliance platform operated by Arokiadas Management and Services Private Limited (incorporation in progress), of Bengaluru, Karnataka, India (“Baton”, “we”, “us”).

Under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), our role depends on whose data it is:

• For personal data of an academy's students, parents and staff that we process on behalf of that academy, the academy is the Data Fiduciary and Baton is a Data Processor. The academy decides why and how that data is used; we act on its documented instructions and under a data-processing agreement.
• For personal data of our own account holders — the people who sign up for and administer a Baton subscription — and for visitors to this website, Baton is the Data Fiduciary.

2 Scope of this policy

This policy covers two things:

• This website (batonstack.com) — what we collect when you browse it or contact us.
• The Baton platform — how personal data is handled when an academy uses Baton. Where Baton acts as a Processor, the academy's own privacy notice governs its relationship with its students and parents; this section describes our practices as its Processor and is reflected in the data-processing agreement we offer every customer.

3 Information we collect

From this website

• Contact information you send us — if you email contact@batonstack.com or a listed address, we receive your name, email address and whatever you choose to put in your message.
• Basic server logs — our hosting provider records the IP address, timestamp, page requested and user-agent of requests, for security and to keep the site running. This site sets no tracking or advertising cookies and runs no third-party analytics.

Through the Baton platform, as a Processor for an academy

• Student and guardian records — name, date of birth, contact details, photographs where the academy adds them, health and injury information, batch and attendance history, assessments, and fees linked to the child.
• Staff records — identity and contact details, role, batch assignments, attendance, and payroll inputs where the Payroll module is used.
• Financial records — fee receipts, payments, ledger entries, payroll runs and statutory filings.
• Communications — announcements and reminders sent through the platform, and the consent recorded for each channel.

As a Data Fiduciary, for our own account holders

• Account and profile — name, work email, phone number, the academy's name and role.
• Billing — the details needed to raise a GST invoice and take a subscription payment. Card and bank details are handled by our payment provider and are never stored by Baton.
• Support and product usage — the content of support requests and technical logs tagged to your account, used to diagnose issues.

4 How we use information

• To respond to enquiries and provide the pilot programme.
• To provide, secure and support the Baton platform for the academies that use it.
• To process subscription payments and issue tax invoices.
• To meet legal obligations — tax and company law, the DPDP Act, and the CERT-In directions on incident reporting and log retention.
• To detect and prevent fraud, abuse and security incidents.

We do not sell personal data, and we do not use it for advertising or profiling — and never for tracking, behavioural monitoring or advertising directed at children.

5 Legal basis and consent

For data we hold as a Data Fiduciary, we rely on your consent (which you may withdraw at any time) or on the “legitimate uses” permitted by the DPDP Act — for example, providing a service you have asked for, or meeting a legal obligation.

Where Baton processes data on an academy's behalf, the academy is responsible for obtaining the consent or other lawful basis required from its students and parents. Baton provides the mechanism to capture that consent, records it as an auditable artefact, and is built to block processing of a child's record until consent has been captured.

When India's Consent Manager framework comes into force, Baton will integrate with it, and consent notices will be offered in English and in scheduled Indian languages as they are added.

6 Children's data

A child is anyone under 18. The DPDP Act requires verifiable parental consent before processing any personal data of a child — not only “sensitive” categories.

• Baton makes parental consent a required, first-class step in enrolment, verified through DigiLocker, and stores the consent artefact (who consented, when, and to what).
• Baton prevents processing of a child's record until that consent is recorded.
• No tracking, behavioural monitoring or targeted advertising is directed at children, and nothing on the platform is designed to be detrimental to a child's wellbeing.

7 Sub-processors and data location

Baton uses a small number of service providers to deliver the platform. Each one that handles personal data is bound by a contract, is listed below, and appears on the sub-processor list we maintain for customers. All tenant data and its backups are stored in India.

We give customers at least 30 days' notice before adding or changing a sub-processor that handles their data.

8 How long we keep data

• Financial records — kept for about eight years, as required by Indian tax and company law, even after an account is closed.
• Other personal data — deleted after the purpose it was collected for has ended, plus a short grace period, unless a law requires us to keep it longer.
• Website enquiries — kept only as long as needed to deal with your enquiry and any follow-up.
• When an academy leaves Baton, it can export its data at any time; after a defined retention window, its data is deleted, subject to the statutory financial-record period above.

9 Your rights

Under the DPDP Act you have the right to:

• access a summary of the personal data we hold about you and how it is processed;
• have inaccurate or incomplete data corrected, and data updated;
• have your data erased where it is no longer needed and no law requires us to keep it;
• nominate another person to exercise these rights on your behalf in the event of death or incapacity;
• a readily available means of grievance redressal.

If Baton holds your data on behalf of an academy, please raise the request with that academy as the Data Fiduciary; we will assist it in responding. For data we hold as a Data Fiduciary, contact our Grievance Officer (section 13). We acknowledge requests within 24–72 hours, resolve rights requests within about seven working days, and resolve grievances within 30 days.

10 Security

• Encryption of data in transit and at rest.
• Role-based access control, and tenant isolation enforced at the database so one academy can never see another's data.
• Audit logging of access to personal and financial data, including any access by Baton staff for support.
• Point-in-time backups with a short recovery window.
• Incident response aligned to the CERT-In directions, including reporting within six hours of becoming aware of a reportable incident, and retaining logs for 180 days in India.

If a personal-data breach occurs, we will notify the Data Protection Board of India and affected persons in accordance with the DPDP Act and its rules.

11 International transfers

The Baton platform stores personal data and backups in India. We do not transfer platform data outside India except, where unavoidable, minimised metadata to a service provider listed in section 7; we will not transfer data to any territory restricted by the Government of India.

12 Changes to this policy

We will update this policy as the platform develops and as the DPDP rules take effect. Material changes will be posted here with a new version number and date; customers under contract will be notified directly.

13 Grievance Officer and contact

For any question about this policy, or to exercise a right or raise a grievance:

• Grievance Officer: Cassandra Adline Charles
• Email: privacy@batonstack.com
• Post: Arokiadas Management and Services Private Limited (incorporation in progress), Bengaluru, Karnataka, India

If you are not satisfied with our response, you may complain to the Data Protection Board of India.