Last updated 7 October 2026
Under the Digital Personal Data Protection Act 2023, the organisation that decides why and how personal data is processed is the Data Fiduciary.
| Data | Fiduciary | Our role |
|---|---|---|
| Student and guardian records inside your ESA HUB instance | Your school | Data Processor — we process on your instructions and do not decide the purposes |
| Enquiries from this website, and our contract with you | ESA HUB | Data Fiduciary |
Practically: we do not decide who at your school may see a child's file, how long you keep a record, or what you say to a parent. You do. What we provide is the machinery to make those decisions enforceable and reviewable.
Typically student names, admission details, guardian contact details, fee and payment history, attendance, assessment results, and communication records.
Almost every student record is a minor's data, which the Act treats as the strictest category. Two things follow, and both are built into the product rather than left to policy:
Every read of a student record is logged with who, when, and from where — including attempts that were refused. The log is append-only: nothing in the application can edit or delete an entry. A guardian may ask your school what has been done with their child's data, and the school can answer from this record in one step.
Your instance's database is hosted in a region you agree with us at the point of contract; Indian schools are hosted in India by default. Data is encrypted in transit using TLS.
What we do not claim. ESA HUB is not end-to-end encrypted. A server that cannot read your data cannot compute a fee schedule, generate a report card, or answer a question about a balance. Any vendor describing a working school ERP as end-to-end encrypted is describing something else. Field-level encryption at rest for sensitive identifiers is on our roadmap, and we will say when it ships and not before.
If you submit the enquiry form on this site, we store your name, role, school, email, phone number, the size band you selected, your message, and the IP address and browser the submission came from.
This website sets no advertising or analytics cookies. There is no tracking pixel on this page.
Under the Act you may ask us to confirm what we hold about you, correct it, or erase it, and you may nominate someone to exercise these rights on your behalf. Write to ameershathali@esahub.in and we will respond within thirty days.
If your request concerns a student record held by a school, the school is the Fiduciary and the request goes to them. Tell us anyway if you are having trouble — we can help the school locate the record, and we will not action it without their instruction.
If we become aware of a personal data breach affecting your instance, we will notify you without undue delay, with what we know at the time rather than waiting for a complete picture. Notifying the Data Protection Board and affected individuals is the Fiduciary's obligation — your school's for student data, ours for our own — and we will give you what you need to do it, including the relevant access trail.
We use third parties for hosting, payment processing, and message delivery (SMS, WhatsApp and email). Each is bound by contract to process only on our instructions. The current list is available on request and we will tell you before adding one that handles student data.
If we change this page in a way that materially affects how data is handled, we will tell customers by email before it takes effect, not by quietly updating the date at the top.
Ameer Shathali, Founder, ESA HUB
ameershathali@esahub.in
This page explains our practices in plain language. It is not legal advice, and it does not replace the data processing agreement in your contract — where the two differ, the contract governs.