Privacy Policy

1 Overview

This Privacy Policy describes how BS Learning ("we," "us," or "our"), operator of School Desk ERP, collects, uses, stores, and protects information when you use our platform at bslearning.com/schooldesk/ and related services.

School Desk ERP is a multi-tenant SaaS platform serving educational institutions across Pakistan. This policy applies to all subscribers (institutions), their designated users (administrators, teachers, parents, accountants), and visitors to our public-facing pages.

2 Data We Collect

We collect data in two categories: information you provide directly, and information generated automatically through your use of the platform.

2.1 — Information You Provide

2.2 — Automatically Collected Information

• Server logs — IP address, browser type, pages visited, and timestamps for security and error diagnostics. These are retained for a limited period and are not linked to institution data.
• Session data — PHP session identifiers used to maintain your authenticated state during a browser session. Sessions are invalidated on logout.
• Contact form metadata — IP address and timestamp recorded alongside contact form submissions for spam prevention.

We do not use tracking pixels, behavioural advertising cookies, or third-party analytics scripts (e.g., Google Analytics) on the core platform pages.

3 How We Use Data

We use the information we collect for the following specific purposes only:

• Service Delivery — to provision and maintain your institution's account, enforce subscription plan limits, and operate all platform modules (attendance, timetable, exams, course files, portals)
• Authentication & Security — to verify login credentials, generate unique institution tokens, enforce session timeouts, and protect against unauthorized access
• Transactional Emails — to send account activation, renewal confirmation, credential, and update notifications to the registered email address
• Support & Communication — to respond to contact form enquiries and provide customer support
• Platform Improvement — to diagnose errors and improve system stability using aggregated, anonymized server logs
• Legal Compliance — to comply with applicable Pakistani law where required

We do not use your data for advertising, profiling, or any commercial purpose unrelated to the delivery of School Desk ERP.

4 Data Storage & Security

All Institution Data is stored on servers hosted under the bslearning.com domain. We implement the following technical and organizational measures to protect your data:

• Encryption at Rest: All institution data files are encrypted using AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode), providing both confidentiality and integrity verification. Encryption keys are stored separately from data files.
• Compression: Data is GZIP-compressed before encryption, reducing storage footprint and transmission overhead.
• File Isolation: Each institution's data is stored in a dedicated, uniquely named file within a protected directory (insData/). Directory listing is disabled and direct web access is blocked via .htaccess rules.
• Password Hashing: All account passwords are hashed using PHP's password_hash() function (bcrypt algorithm). Plaintext passwords are never stored.
• Rate Limiting: Administrative login is rate-limited with math CAPTCHA to protect against brute-force attacks.
• CSRF Protection: All forms use server-generated CSRF tokens to prevent cross-site request forgery.
• HTTPS: All data in transit is encrypted via HTTPS/TLS.

While we implement industry-standard security measures, no system is completely immune to all threats. We encourage you to use strong passwords and report any suspected security issues to us immediately.

5 Data Sharing & Disclosure

We do not sell, rent, trade, or otherwise share your Institution Data with any third parties for commercial purposes.

We may disclose information only in the following limited circumstances:

• Legal Requirement: If required to do so by applicable Pakistani law, court order, or lawful request by a government authority (e.g., under the Prevention of Electronic Crimes Act 2016)
• Protection of Rights: To protect the rights, property, or safety of BS Learning, our users, or the public where disclosure is reasonably necessary
• Business Transition: In the event of a merger, acquisition, or sale of BS Learning's assets, Institution Data would transfer to the successor entity subject to equivalent privacy protections. We would notify affected institutions prior to any such transfer.

Email notifications sent by the platform (account creation, renewal, etc.) are delivered via PHP mail() through our server's mail transfer agent. No third-party email marketing services (e.g., Mailchimp, SendGrid) are used.

6 Cookies & Sessions

School Desk ERP uses the following cookie and session mechanisms:

• PHP Session Cookie (PHPSESSID): A strictly necessary, first-party session cookie used to maintain your authenticated state on the platform. This cookie expires when you close your browser or log out. It contains only a random session identifier; no personal information is stored in the cookie itself.
• CSRF Token Session: A server-side session variable storing a CSRF token for form security. This does not set an additional cookie.
• Login Configurator (login.html): The login.html configurator page uses the browser's localStorage to save your institution's Unique Login URL for convenience on future visits. This data remains on your device and is not transmitted to our servers. You can clear it by clearing your browser's local storage.

We do not use advertising cookies, third-party tracking cookies, or persistent profiling cookies of any kind.

7 Student & Staff Data

School Desk ERP is operated as a data processor on behalf of your institution. When you enter student records, attendance data, staff information, or parent contact details into the platform, your institution acts as the data controller for that information.

As the data controller, your institution is responsible for:

• Obtaining any necessary consent from students, parents, and staff for entering their data into the platform
• Ensuring the accuracy and appropriateness of the personal data entered
• Complying with applicable data protection obligations under Pakistani law in relation to that data
• Defining internal access controls (which teachers, parents, and accountants can access which data)

We process student and staff data only as instructed by your institution's configuration of the platform, and only for the purpose of providing the School Desk ERP service. We do not access, analyse, or use student or staff data for any purpose other than service delivery.

8 Data Retention

We retain Institution Data for as long as your subscription is active. The following retention rules apply:

• Active Subscriptions: Data is retained and accessible for the duration of the active subscription period.
• Expired Subscriptions: After subscription expiry, your account may be retained in a read-only state at administrator discretion. You will not be able to record new data during this period.
• Deleted Accounts: When an account is deleted by the administrator (or upon your request), all associated institution data files are permanently and irreversibly deleted from our servers. No recovery is possible after deletion.
• Contact Form Data: Messages submitted via the contact form are retained in our email inbox for support purposes and are not linked to any institution account.
• Server Logs: Aggregated server access logs may be retained for up to 90 days for security and diagnostic purposes, after which they are deleted or anonymized.

9 Your Rights

As a subscriber and data controller for your Institution Data, you have the following rights with respect to the information we hold about your institution:

• Access: You may request a summary of the account-level data we hold about your institution (institution name, email, subscription status, plan, expiry).
• Correction: You may update your institution's contact information, email address, and credentials at any time through the platform's settings or by contacting us.
• Deletion: You may request permanent deletion of your institution's account and all associated data by contacting us at 388798nazirahmad@gmail.com. Deletion is permanent and irreversible.
• Portability: You can export your attendance data, timetables, and other academic records as PDF files directly from the platform at any time.
• Objection: You may object to any processing of your data that exceeds what is necessary for service delivery. Contact us to raise a concern.

To exercise any of these rights, please contact us using the details in Section 13. We will respond within 5 business days.

10 Third-Party Services

School Desk ERP integrates with or references the following limited third-party services:

• Google Fonts (Bricolage Grotesque, DM Sans): Font files are loaded from Google Fonts CDN on public-facing pages. Google may collect limited technical data (IP address, browser info) in accordance with Google's Privacy Policy. This applies only to the public website (contact, landing, legal pages) and not to the authenticated platform application.
• Font Awesome (CDN): Icon fonts are loaded from Cloudflare CDN on the login configurator page. Standard CDN access logs may apply.
• Tailwind CSS (CDN): Used on the login configurator page. No personal data is transmitted.
• SadaPay / NayaPay: Payment transactions occur directly on these third-party platforms. We receive only a transaction ID as proof of payment. We do not receive or store any financial card or wallet credentials.

No third-party advertising networks, analytics platforms, social media trackers, or CRM tools are integrated into School Desk ERP.

11 Children's Privacy

School Desk ERP is designed for use by educational institutions and is not directed at children as end users. The platform's direct users are adults — institutional administrators, teachers, parents, and accountants.

Student data (including names and attendance records) entered into the platform by institutional administrators is processed solely under the authority and responsibility of the subscribing institution, which is the data controller for that information.

Subscribing institutions that enter data relating to minor students are responsible for ensuring compliance with applicable child data protection requirements under Pakistani law and any internal policies of their institution.

We do not knowingly collect personal information directly from children through our registration or public-facing forms. If you believe such data has been submitted, contact us immediately for removal.

12 Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or platform features. When material changes are made, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to registered subscriber email addresses

We encourage you to review this policy periodically. Your continued use of School Desk ERP after a policy update constitutes your acceptance of the revised terms.

13 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

• Data Controller: BS Learning — School Desk ERP
• Email: 388798nazirahmad@gmail.com
• WhatsApp: +92 317 566 1709
• Contact Form: contact.php
• Response Time: Within 5 business days for data rights requests; within 24 hours for general enquiries