Privacy Policy

1. Who We Are

Roots of Northeast (ROne), headquartered in Kokrajhar, Assam, India, provides school ERP software, AI facial attendance systems, RFID hardware, and digital services to educational institutions across Northeast India. This policy explains how we collect, use, and protect personal data in accordance with India's Digital Personal Data Protection (DPDP) Act 2023.

Contact: info@rootsofnortheast.com | +91 81358 28065 / +91 93656 96186

2. Data We Collect

• Contact form submissions: Name, email, phone number, and message content when you reach out via our website.
• Student & staff data (institutional clients): Names, attendance records, fee information, and, where our AI or biometric systems are deployed, facial recognition templates and biometric identifiers. This data is collected and processed on behalf of the institution as a data processor.
• Usage data: Standard server logs (IP address, browser type, pages visited) for security and diagnostic purposes.

3. How We Use Your Data

• To respond to enquiries submitted via our contact form.
• To provide, operate, and maintain our ERP, attendance, and RFID systems on behalf of contracted institutions.
• To send service notifications and support communications to institutional administrators.
• To comply with legal obligations under Indian law.

We do not sell, rent, or share personal data with third parties for marketing purposes.

4. Biometric & Sensitive Data

Where our AI facial recognition or biometric attendance systems are deployed, biometric data is processed exclusively for attendance verification. All biometric templates are stored using 256-bit AES encryption on institution-controlled infrastructure. Raw biometric data is never transmitted to or stored on ROne's central servers without explicit institutional consent. Institutions are the data fiduciaries for student biometric records under the DPDP Act 2023.

5. Data Retention

Contact form data is retained for up to 12 months. Institutional data is retained for the duration of the service agreement and deleted within 30 days of contract termination, unless longer retention is required by applicable law or regulatory obligation.

6. Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act 2023, you have the right to:

• Access personal data we hold about you.
• Correct inaccurate personal data.
• Request erasure of personal data (subject to legal retention requirements).
• Withdraw consent for data processing.
• Nominate a representative to exercise rights on your behalf.

To exercise any of these rights, email us at info@rootsofnortheast.com. We will respond within 30 days.

7. Security

We implement technical and organisational measures including 256-bit AES encryption, multi-factor authentication, and access controls to protect personal data against unauthorised access, loss, or disclosure. Our systems maintain 99.9% uptime with offline-first design so data integrity is preserved even during connectivity outages.

8. Cookies

Our website does not use tracking or advertising cookies. We may use essential session cookies required for the contact form to function. No third-party analytics or advertising cookies are set.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to institutional clients via email. The updated policy will always be available at rootsofnortheast.com/privacy.

10. Contact

For any privacy-related queries or data requests, contact our team: