This Data Retention Policy establishes comprehensive guidelines for the retention, storage, and disposal of all data within the myCloudMate platform, ensuring compliance with Indian data protection laws while meeting educational and business requirements.
Data Retention Policy
This document is fully compliant with Indian data protection laws and regulations
✓ DPDP Act 2023 Compliant✓ Consumer Protection Act 2019✓ Made in India
Data Retention Policy
Official Legal Document • Public Access
Last Updated: 28 Aug 2025
Data Retention Policy
myCloudMate - Institute Management Platform
Last Updated: 28 August 2025
DPDP Act 2023 & Educational Data Governance Compliance
1. Policy Overview
- •This policy governs the retention, storage, and disposal of all data within our educational management platform.
- •We ensure compliance with DPDP Act 2023, IT Act 2000, and Educational Data Governance Guidelines.
- •The policy balances legal requirements with practical educational and business needs.
2. Data Classification and Retention Periods
We classify data into different categories with specific retention periods based on legal requirements and business needs.
Student and Academic Data
- •Academic Transcripts: Permanent retention (legal requirement for educational credentials)
- •Active Student Records: Duration of enrollment + 3 years
- •Alumni Personal Data: 5 years post-graduation
- •Financial Records (Student Fees): 8 years (tax compliance)
- •Attendance Records: 7 years (academic verification)
- •Disciplinary Records: 5 years post-incident
Staff and Administrative Data
- •Employee Records: 7 years post-employment
- •Payroll Records: 8 years (tax and audit compliance)
- •Performance Evaluations: 5 years post-employment
System and Security Data
- •Audit Logs - Critical: Compliance retention 7 years, scheduled cleanup after 1 year
- •Audit Logs - High Priority: Compliance retention 3 years, scheduled cleanup after 6 months
- •Audit Logs - Medium Priority: Compliance retention 1 year, scheduled cleanup after 90 days
- •Audit Logs - Low Priority: Compliance retention 30 days, scheduled cleanup after 14 days
- •Audit Cleanup Reports: 90 days (compliance monitoring)
- •Access Logs: 2 years (security compliance)
- •System Backups: 1 year (disaster recovery)
3. Subscription Cancellation and College Data Deletion
When an educational institution cancels or fails to renew their subscription to myCloudMate, their data enters a retention period before permanent deletion to ensure compliance with legal requirements.
Data Retention Timeline
- •Grace Period: 3 days for subscription renewal
- •Retention Period: 30 days for data transition
- •Total Retention: 33 days from subscription end date
- •Permanent Deletion: After 33 days, data becomes eligible for permanent deletion
What Happens During Retention Period
- •Platform Access: System transitions to read-only mode after grace period
- •Data Preservation: All institutional data remains intact and viewable
- •Notifications: In-app notifications sent to institution administrators regarding subscription renewal
- •Renewal Option: Subscription can be renewed at any time during this period to restore full access
- •Administrative Support: Contact system administrators for assistance with subscription renewal or account reactivation
Data Deletion After Retention Period
- •Scope of Deletion: All active platform data including student records, staff information, courses, departments, attendance, marks, assignments, enrollments, timetables, exams, fee structures, events, and classrooms
- •Deletion Process: Permanent and irreversible removal from active systems
- •No Recovery: Deleted data cannot be recovered or restored
- •Deletion Timeline: Executed after manual administrative approval
Data Preservation for Compliance
- •Academic Records: Transcripts and degree certificates retained permanently (educational credential integrity)
- •Financial Records: Fee and payment records retained for 8 years (tax and audit compliance)
- •Audit Logs: Critical security and compliance logs retained for 7 years
- •Archive Storage: Preserved records stored in secure, encrypted, offline archives
- •Access Protocol: Archive access available only through formal legal or regulatory requests
Special Cases and Extensions
- •Legal Holds: Data preserved during ongoing legal proceedings or investigations
- •Regulatory Requests: Retention extended for government or educational authority inquiries
- •Dispute Resolution: Data maintained during complaint or dispute resolution processes
- •Retention Extension: May be granted for up to 365 additional days with proper justification
Data Subject Rights
- •Right to Access: Students and staff retain read access to their data during retention period
- •Right to Portability: Individual students and staff may request copies of their personal data by contacting administrators
- •Right to Correction: Limited corrections permitted for critical errors during retention
- •Right to Erasure: Subject to legal retention requirements and academic integrity obligations
- •Academic Credentials: Cannot be deleted as they form part of permanent educational records
- •Subscription Renewal: Colleges should renew their subscription during the retention period to restore full platform access
Notification and Communication
- •Initial Notice: Sent when subscription ends or is cancelled
- •Periodic Reminders: Alerts at 30, 14, 7, 3, and 1 day(s) before deletion eligibility
- •Final Warning: Critical notice when data becomes eligible for deletion
- •Deletion Confirmation: Notification sent after data deletion is completed
Security During Retention
- •Access Controls: Full authentication and authorization maintained throughout
- •Data Encryption: All data remains encrypted at rest and in transit
- •Audit Logging: All access attempts logged for security monitoring
- •Integrity Protection: Read-only mode prevents unauthorized modifications
4. Smart Audit Log Optimization
Our system automatically categorizes and retains audit logs based on security importance, achieving approximately 95% reduction in storage while maintaining full compliance. Scheduled cleanup runs every 15 days and removes records that have exceeded their retention period.
Critical Events (7 Years Retention)
- •Security violations and suspicious activities
- •Failed login attempts and account lockouts
- •Financial transactions and payment processing
- •Administrative role changes and privilege escalations
- •Data protection violations and privacy incidents
High Priority Events (3 Years Retention)
- •Successful authentication and password changes
- •User account creation, modification, and deletion
- •Bulk data operations and exports
- •System configuration changes
- •College approval and rejection decisions
Medium Priority Events (1 Year Retention)
- •Academic data creation and updates
- •Course and department management
- •Attendance and marks entry
- •Timetable and scheduling changes
- •Assignment and exam management
Low Priority Events (30 Days Retention)
- •Routine data access operations
- •User preference changes
- •Dashboard and report viewing
- •Theme and display settings
- •Non-sensitive system interactions
5. Automated Retention Management
Our system performs automated cleanup operations every 15 days to maintain compliance and optimize storage, with additional manual cleanup capabilities for administrators.
Automated Scheduled Cleanup Process
- •Runs every 15 days to scan audit logs for data exceeding retention periods
- •Applies severity-based retention policies automatically
- •Performs secure deletion with detailed audit trails
- •Measures database table sizes before and after cleanup
- •Generates comprehensive cleanup reports with compliance status
- •Self-manages cleanup reports (auto-deletes reports older than 90 days)
Manual Cleanup Capabilities
- •Administrator-initiated cleanup via Admin Dashboard
- •Configurable severity levels and age thresholds
- •Real-time monitoring of cleanup progress and results
- •Immediate generation of detailed cleanup reports
- •Performance impact tracking and optimization recommendations
Cleanup Report Management
- •Detailed tracking of records deleted by severity level
- •Storage space freed and performance impact measurement
- •Compliance status monitoring (COMPLIANT/WARNING/ERROR)
- •Retention period: 90 days for audit and compliance review
- •Automatic cleanup of old reports to prevent infinite growth
- •Export capabilities for compliance documentation
Volume Optimization
- •Through intelligent sampling and retention policies
- •Achieves 95% reduction in audit log volume
- •Maintains full compliance for security-critical events
- •Automated sampling: 100% critical, 10% medium, 1% low priority
6. Data Disposal Procedures
We implement secure deletion methods to ensure data cannot be recovered after disposal.
Secure Deletion Methods
- •Database Records: Secure deletion with verification
- •File Systems: Industry-standard secure deletion
- •Encrypted Data: Key destruction and verification
- •Cloud Storage: Provider-managed secure deletion
Verification and Documentation
- •Automated verification of deletion completion
- •Generation of disposal certificates
- •Audit trail maintenance for compliance
- •Regular disposal process reviews
7. Legal and Regulatory Compliance
This policy ensures compliance with all applicable Indian data protection and educational regulations.
Applicable Regulations
- •DPDP Act 2023: Data protection and privacy compliance
- •IT Act 2000 & SPDI Rules 2011: Sensitive personal data protection
- •Right to Education Act: Educational data governance
- •Consumer Protection Act 2019: Service quality and transparency
Compliance Monitoring
- •Monthly retention policy compliance audits
- •Quarterly legal requirement reviews
- •Annual third-party compliance assessments
- •Continuous monitoring and alerting systems
8. Data Subject Rights
Students, staff, and other users have specific rights regarding their data retention and disposal.
Right to Erasure
- •Data subjects can request early deletion of personal data
- •Legal retention requirements may override requests
- •Academic credential integrity must be preserved
- •Ongoing legal proceedings may prevent deletion
Data Portability and Access
- •Individual Data Access: Students and staff can request copies of their personal data by contacting system administrators
- •Personal Data Requests: Individual data requests processed within 30 days through administrative channels
- •Subscription Renewal: Colleges should renew their subscription during the retention period to regain full platform access and prevent data loss
- •Verification of Deletion: Confirmation provided after retention periods expire
- •Administrative Support: System administrators can assist with questions regarding subscription renewal or data retention
- •During Retention Period: Colleges have read-only access and should renew subscription to restore full functionality
9. Training and Responsibilities
All staff members have specific responsibilities in implementing and maintaining this retention policy.
Staff Responsibilities
- •Data Protection Officer: Policy oversight and compliance monitoring
- •System Administrators: Technical implementation and monitoring
- •Legal Team: Regulatory compliance and policy updates
- •Department Heads: Departmental data governance
Training Requirements
- •Initial data retention training for all staff
- •Annual refresher training on policy updates
- •Role-specific training on retention procedures
- •Incident response training for disposal violations
10. Policy Updates and Reviews
This policy is regularly reviewed and updated to ensure continued compliance and effectiveness.
Review Schedule
- •Annual Review: Comprehensive policy assessment
- •Regulatory Updates: Immediate review upon law changes
- •Incident-Driven: Review following data retention incidents
- •Technology Changes: Review for system upgrades
Version Control
- •All policy changes documented and dated
- •Historical versions maintained for reference
- •Stakeholder notification for significant changes
- •Implementation timeline for policy updates
11. Contact Information
For questions about data retention or disposal requests, please contact us through the appropriate channels:
Support Contacts
Data Protection Officer: support@mycloudmate.com Grievance Officer: admin@mycloudmate.com Technical Support: support@mycloudmate.com Response Time: Within 2 business days
Document Information
Document Version: 1.0 Next Review Date: August 8, 2026
Legal Document
Legally binding terms
Made in India
Compliant with Indian laws
Public Access
Freely accessible to all
Need Help or Have Questions?
Our legal and support teams are available to assist you with any questions about this document or our policies.
Grievance Officer
For complaints and grievance resolution
admin@mycloudmate.com
Response within 2 business days
Legal Team
For legal queries and clarifications
admin@mycloudmate.com
Legal compliance queries
General Support
For general inquiries and support
support@mycloudmate.com
General help and assistance