Privacy Policy

This Privacy Policy applies where you:

• visit, browse or interact with our website;
• request a demo, make an enquiry, communicate with us, or subscribe to marketing updates;
• download, register for, access or use an AARUM application;
• use the Platform as a childcare-centre owner, administrator, teacher, staff member, employee, authorised representative or contractor;
• use the Platform as a parent, guardian, emergency contact or other centre-authorised user; or
• otherwise interact with AARUM in connection with the Platform.

This Privacy Policy does not replace the separate privacy notices, consent processes, operational policies or legal obligations of a childcare centre. Each childcare centre remains responsible for its own collection and use of data in relation to its childcare, education, employment, safety, administrative and parent-engagement activities.

2.1 Childcare centres generally decide how Centre Data is used

When a childcare centre subscribes to the Platform, the centre generally decides why and how data in its AARUM account is collected and used. This may include data relating to children, parents, guardians, emergency contacts, staff and other centre-authorised individuals (“Centre Data”).

For Centre Data, the relevant childcare centre is generally the Data Fiduciary or controller-like party, and AARUM generally acts as its service provider / Data Processor, processing Centre Data on the centre's documented instructions and under the applicable customer agreement. AARUM may separately act as a Data Fiduciary in respect of data for which it independently determines the purpose and means of processing, such as website visitor data, demo and sales enquiries, direct account administration, billing, service security, legal compliance and its own business operations.

2.2 Children's personal data

The Platform may be used by childcare centres to process personal data about children. Children are not intended to independently create, administer or operate Platform accounts unless AARUM and the applicable childcare centre expressly enable an age-appropriate feature and all legal requirements are met.

Parents and lawful guardians should normally direct questions or requests concerning a child's enrolment, attendance, activities, media, care records, allergies, classroom information or other Centre Data to the relevant childcare centre. AARUM will reasonably assist the centre where required by applicable law, the customer agreement and our technical capabilities.

AARUM does not knowingly sell child personal data. AARUM does not knowingly use child personal data for targeted advertising or behavioural tracking of children.

2.3 Parent and guardian authority

A parent, guardian or other person using a Platform account in relation to a child represents that they have the authority to provide information, receive information and give instructions concerning that child, subject to the childcare centre's procedures and applicable law.

The childcare centre is responsible for obtaining required parental or guardian permissions before it collects, uploads, shares or otherwise enables the processing of a child's personal data through the Platform, including verifiable parental consent where required by applicable law.

The personal data we collect depends on your relationship with AARUM, the features enabled by the relevant childcare centre, the device permissions you grant and the information provided by you, a childcare centre or another authorised source.

3.1 Data provided directly

We may collect:

• Contact and account data: name, email address, mobile number, address, organisation or centre name, role, account identifiers, login credentials and profile details.
• Commercial and enquiry data: demo requests, communications, messages, centre needs, subscription information, invoices, payment status and transaction-related records. Payment-card or bank information, if used, may be processed directly by an authorised payment provider rather than stored by AARUM.
• Child and family data entered by a centre or authorised user: child name, date of birth, gender, photograph or other media, class/group, enrolment information, attendance, parent/guardian information, emergency contacts and authorised pick-up details.
• Care, wellbeing and safety data: activity updates, meal and nap records, diaper or toileting records, mood updates, allergies, dietary preferences, medication-related notes, emergency information and other centre-specific care records.
• Centre personnel data: staff contact information, roles, work-related records uploaded by the centre, activity records, attendance and system-access details.
• Communications and content: announcements, messages, meeting-booking information, support tickets, attachments, feedback, photos, videos and other content submitted through the Platform.
• Consent and preference data: consent records, media permissions, communication preferences, permission withdrawals and related requests.

3.2 Data collected automatically

When you visit or use the Platform, we may collect:

• browser, device, operating system, app version, language and network information;
• approximate location derived from an IP address;
• log, diagnostic, crash, performance and security data;
• account activity, feature usage, timestamps, system-access and audit-log information;
• cookies, local storage, SDKs and similar technologies, subject to applicable law and your settings; and
• QR-scan, OTP-validation, check-in/check-out and pick-up/drop event information where the relevant childcare centre enables these functions.

Unless separately disclosed through an appropriate notice and device permission, AARUM does not claim to collect precise GPS location, biometric data, device contacts, microphone data, payment-card information, government-identification data or CCTV recordings. If we introduce such processing, we will provide an appropriate notice and obtain consent or rely on another valid legal basis where required.

3.3 Data from third parties

We may receive personal data from childcare centres, authorised users, service providers, app-store providers, business partners, referral sources and security/fraud-prevention providers. For example, a childcare centre may invite a parent to use the Platform and provide the parent's contact details and the child's profile information.

We may use personal data to:

• provide, administer, maintain, secure and improve the Platform;
• create and administer accounts, authenticate users and manage role-based access;
• enable childcare-centre authorised functions, including attendance, check-in/check-out, pick-up/drop, activity tracking, parent communications, media galleries, PTM scheduling, reports and support tickets;
• send operational communications, including service notifications, security alerts, reminders, booking confirmations and centre-authorised announcements;
• respond to enquiries, demo requests, customer-support requests, feedback, complaints and grievances;
• process subscriptions, invoices, payments and related business administration;
• maintain audit logs, investigate misuse, prevent fraud, enforce agreements and protect the safety, rights, security and property of AARUM, users, children and others;
• comply with applicable law, legal process, regulatory obligations, court orders and lawful governmental requests;
• analyse Platform performance and use, develop and improve features, and create aggregated or de-identified insights that do not reasonably identify an individual; and
• with appropriate consent or where otherwise permitted by law, provide information about AARUM's products, services, offers, events or updates. You may opt out of marketing communications at any time.

AARUM will not use Centre Data, including child data, for its own unrelated marketing or for targeted advertising to children.

Where the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 and other applicable privacy laws apply, AARUM processes personal data with valid consent or for another lawful purpose or permitted legitimate use under applicable law.

When consent is required, AARUM seeks consent that is free, specific, informed, unconditional, unambiguous and given through a clear affirmative action. You may withdraw consent that you gave directly to AARUM by using available settings, an unsubscribe link, the relevant in-app process or by emailing info@aarum.in. Withdrawal does not affect processing that was lawful before withdrawal and may affect AARUM's ability to provide certain functions. Where a childcare centre controls the relevant Centre Data, requests relating to that data should normally be sent to the childcare centre.

Each childcare centre is responsible for providing required notices, identifying the applicable legal basis and obtaining valid consents or other authorisations for Centre Data it collects, uploads, uses or shares through the Platform.

We may share personal data only as necessary and appropriate for the purposes set out in this Privacy Policy, including with:

• the relevant childcare centre and its authorised personnel, including owners, administrators, teachers and staff, according to the centre's account configuration and role-based permissions;
• parents, guardians and other centre-authorised recipients, where the centre enables access to a child's attendance, activities, communications, media or related information;
• service providers and Data Processors supporting cloud hosting, infrastructure, communications, analytics, security, support, software development, payment processing, professional services and other operational functions, subject to suitable contractual and security safeguards;
• professional advisers, auditors, insurers, lenders, prospective investors and acquirers, subject to confidentiality obligations and only where lawful and necessary;
• government authorities, regulators, courts, law-enforcement authorities or other third parties where required by law, legal process or where necessary to protect rights, safety, security or investigate suspected wrongdoing; and
• a successor organisation in connection with a merger, acquisition, financing, restructuring, sale of assets, insolvency or similar transaction, subject to applicable law.

AARUM does not sell personal data for monetary consideration. We do not permit third parties to use Centre Data for their independent marketing purposes unless the childcare centre separately obtains the necessary authority and the sharing is otherwise lawful.

The Platform may enable authorised centre personnel to upload photographs, videos and other media concerning children and centre activities and share them with authorised parents or guardians through private, role-based galleries. The relevant childcare centre controls whether these features are enabled, who may upload content, who may access it and the permissions required.

If a centre provides a CCTV link, feed or access through or alongside the Platform, the centre remains responsible for its CCTV operations and for ensuring that it has an appropriate legal basis, required notices and permissions, and proper access, retention and blackout controls. AARUM does not guarantee continuous availability, completeness or evidentiary suitability of any CCTV feed and is not responsible for a centre's CCTV placement, recording, retention or use practices.

Users must not download, copy, screenshot, record, forward, publish, post, commercially exploit or otherwise share child-related media or CCTV-related content except where expressly authorised by the relevant centre and permitted by applicable law.

The website and application may use cookies, local storage, software development kits and similar technologies to operate the Platform, authenticate users, remember preferences, maintain sessions, improve security, understand use and, where permitted, measure communications.

Where required, we will present a consent mechanism for non-essential cookies or similar technologies. You may manage certain cookies through browser or device settings; however, blocking essential technologies may affect Platform functionality.

AARUM should maintain and publish a separate Cookie Notice identifying its actual cookie and SDK categories, providers and preference controls before deploying non-essential analytics, advertising or tracking tools.

We retain personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected, provide the Platform, comply with legal obligations, resolve disputes, enforce agreements, maintain necessary security and audit records, or as otherwise permitted by law.

For Centre Data, retention is generally determined by the childcare centre's subscription, configuration, documented instructions, legal obligations and applicable agreement with AARUM. When a centre's subscription ends, AARUM will make Centre Data available for export and/or delete or return it in accordance with the applicable customer agreement, subject to technical limitations, agreed transition periods, legal retention obligations, reasonable backup cycles and legitimate security/audit needs.

When data is no longer required, we will delete, anonymise or securely isolate it in line with applicable law and our retention procedures. Backup copies may remain for a limited period before they are overwritten.

We use reasonable technical, organisational and administrative safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction. Depending on the system and risk involved, these measures may include role-based access controls, authentication controls, logging and monitoring, encryption or equivalent protections where appropriate, backups, vulnerability and incident-management processes, personnel confidentiality obligations and contractual safeguards with service providers.

No transmission, device, network or storage system is completely secure. You should protect your login credentials, use secure devices and networks, avoid sharing access, log out on shared devices and report suspected unauthorised access promptly.

If a personal-data breach occurs, AARUM will take steps required by applicable law, including notifying the relevant childcare centre, affected persons and/or authorities where required. AARUM and the relevant centre will cooperate in allocating notification responsibilities for Centre Data in accordance with applicable law and their contractual arrangement.

AARUM may use service providers or technical infrastructure located in India and, where lawful, in other jurisdictions. If personal data is transferred outside India, we will do so in accordance with applicable law, Government restrictions or requirements and appropriate contractual, organisational and technical safeguards.

Subject to applicable law, you may have the right to:

• seek a summary of personal data being processed and information about processing and sharing;
• seek correction, completion, updating or erasure of personal data;
• withdraw consent where consent is the basis of processing;
• manage available privacy and communication preferences;
• raise a grievance regarding our processing of personal data; and
• nominate another person to exercise rights in the event of death or incapacity where applicable law provides.

To make a request relating to personal data controlled directly by AARUM, email info@aarum.in with the subject line “Privacy Rights Request.” Please provide sufficient details for us to understand your request and verify your identity. We may request reasonable verification information and may limit, refuse or delay a request where permitted or required by law, including where doing so would affect another person's rights, compromise safety, disclose another person's information or conflict with a legal obligation.

For Centre Data, please contact the relevant childcare centre first. AARUM will assist the centre in responding where required by applicable law and contract.

Grievances

You may raise a privacy grievance by emailing info@aarum.in. We will acknowledge and address grievances within the time required by applicable law. For questions, requests or grievances concerning this Privacy Policy, please contact:

• Privacy Team / Grievance Officer: Mrs. B. Shalini Mallya
• Email: info@aarum.in
• Phone: +91 7090811822
• Registered office: 176/4/57 K No. 146A, 12th Cross Road, Venkatapura Extension, Koramangala I Block, Bangalore, Karnataka, India – 560034

The Platform may link to or integrate with third-party websites, app stores, payment services, social-media pages, cloud services, CCTV services or other third-party offerings. Their privacy practices and terms are governed by their own policies. AARUM is not responsible for third-party content, availability, security or privacy practices. Please review applicable third-party notices before submitting personal data to them.

We may update this Privacy Policy to reflect changes in our Platform, technology, practices, legal obligations or business operations. We will post the updated version on the Platform and revise the “Last updated” date. Where required by law or where a change is material, we will provide additional notice and obtain fresh consent where necessary.

This Privacy Policy is governed by applicable laws of India. Nothing in this Privacy Policy excludes or limits rights that cannot lawfully be excluded or limited.