Privacy Policy

The SVKMHM Educational Hostel Management System ("SVKMHM", "we", "our", or "the Portal") is the official enterprise residential management platform for resident scholars, hostel administration staff, block rectors, campus security personnel, and attendance officers across SVKM educational campuses.

We are dedicated to safeguarding the privacy, confidentiality, and integrity of personal and academic information entrusted to us by students, parents, guardians, and administrative personnel. This Privacy Policy outlines our institutional standards for collecting, processing, encrypting, storing, and retaining residential data in accordance with applicable data privacy principles and educational data governance guidelines.

To provide secure hostel lodging, allocate rooms, verify campus movements, and ensure student welfare, SVKMHM collects and processes specific categories of data:

• Resident Identity & Demographics: Full name, student enrollment number / ID, college roll number, date of birth, gender, blood group, social category / caste (where required for statutory reporting), student classification, and passport photograph.
• Academic Information: Enrolled institution/college name, department/branch, degree program, academic year, semester, and section/division.
• Resident & Family Contact Details: Student mobile number, student email address, father's name and mobile number, mother's name, local guardian name, guardian emergency contact number, permanent address, city/village, state, and postal PIN code.
• Hostel Room & Bed Allocation: Assigned hostel block (e.g. Block A, Block B), room number, bed allocation ID, room change and transfer history, and electrical meter readings/light bills.
• Campus Gate Movement & Digital Passes: Digital gate pass requests (reason for leave, destination, departure and expected return times), security officer verification timestamps, and visitor logs.
• Night Roll-Call & Attendance Records: Daily residential attendance statuses (Present, Absent, Gate Pass Out, Unsanctioned Out) recorded via dynamic QR scanning.
• Financial & Fee Receipt Records: Official hostel rent and mess fee receipt numbers, fee amounts, payment modes (UPI, Net Banking, Demand Draft), transaction reference numbers, payment dates, and caution deposit refund records.

All processed information is used for legitimate educational and hostel administration functions, including:

• Residential Administration: Processing admissions, room allotments, bed capacity management, maintenance complaint resolution, and meal schedule planning.
• Resident Safety & Accountability: Verifying night curfew roll-call, monitoring gate IN/OUT movements, and preventing unauthorized dormitory entry.
• Emergency Notification: Reaching parents, guardians, or medical personnel in the event of illness, medical emergencies, or unapproved absence.
• Accounting & Audit Trail: Recording official fee receipts, maintaining transparent accounting logs, and providing verified clearance statements upon course completion.
• Regulatory Compliance: Adhering to institutional mandates, hostel disciplinary bylaws, and applicable educational regulations.

The application is designed with field-level cryptography (AES-256-GCM) to protect sensitive Personally Identifiable Information (PII) at rest within the database.

Account security is maintained through credential protection mechanisms:

• Password Protection: Passwords are cryptographically transformed using salted Bcrypt or Argon2ID hashes. Plaintext passwords are never logged or stored.
• Multi-Factor Authentication (MFA): Administrative and staff accounts support Time-Based One-Time Password (TOTP) secondary verification.
• Brute-Force Rate Limiting: Automated rate limiters throttle failed sign-in attempts per IP address and action to mitigate credential stuffing and dictionary attacks.
• Role-Based Access Control (RBAC): Authorization barriers isolate Student, Staff, Rector, Security Guard, and Attendance Officer workspaces. Block Rectors are restricted to their assigned hostel blocks.

To mitigate proxy attendance, screenshot sharing, and replay attempts during mandatory night roll-calls, SVKMHM utilizes a 4-Second Dynamic QR System:

• Rotating Cryptographic Tokens: The student portal generates dynamic attendance QR codes containing signed HMAC payloads that refresh every 4 seconds.
• Instant Supersession: When a new token is generated, previous attendance tokens for that student session are invalidated.
• Role Separation of QR Codes: Permanent Student ID Card QR codes are intended for Gate IN/OUT movements and are automatically rejected at attendance roll-call scanners.

SVKMHM uses essential, first-party HTTP session cookies exclusively to maintain user authentication state. We do not use third-party tracking or advertising cookies.

• Cookie Flags: Session cookies are configured with HttpOnly (preventing client-side JavaScript access), SameSite=Lax (defending against Cross-Site Request Forgery), and Secure (where HTTPS is enabled).
• Inactivity Timeout: Authenticated sessions automatically expire after 30 minutes of inactivity (gc_maxlifetime = 1800), requiring re-authentication to prevent unauthorized terminal access.
• CSRF Token Validation: State-modifying HTTP POST requests require verified per-session CSRF tokens before execution.

SVKMHM operates as a closed institutional portal. Personal data is never sold, leased, or transmitted to third-party marketing entities. Information is shared strictly under controlled institutional conditions:

• Parent / Guardian Communication: Where configured, emergency alerts, approved gate leave notifications, and fee payment receipts may be transmitted to registered parent contacts via institutional communication channels.
• Campus Medical & Law Enforcement Authorities: Direct disclosure in emergencies involving medical intervention, hospital admission, or formal official requests under applicable legal statutes.

In accordance with digital data privacy principles, resident scholars and authorized guardians possess specific rights regarding their stored information:

• Right to Review: Resident scholars may review their profile, allocated room details, registered vehicles, active devices, and attendance logs directly in the Student Portal.
• Right to Rectification: If personal, contact, or parent information contains inaccuracies, students can submit an update request to the Hostel Administration Office for verification.
• Right to Grievance Redressal: Residents may file administrative complaints or inquiries through the Complaints module.

We apply systematic lifecycle retention rules based on the institutional Data Retention Service:

• Master Data (Permanent / Academic Tenure): User accounts, student demographic profiles, room and bed allocations, registered vehicles, residential agreements, bonafide records, fee receipts, caution deposit refund records, and system settings are retained for the duration of the resident's academic enrollment and institutional regulatory requirements.
• Operational Log Data (60-Day Automated Retention): Daily roll-call attendance records, gate movement logs, completed gate passes, visitor logs, cryptographic QR scan logs, and security/audit logs are retained for 60 days, after which they are systematically purged during daily automated maintenance.
• Student Attendance History View: The Student Portal displays attendance history for the last 7 calendar days.
• Temporary & Staging Data: Temporary bulk student import staging files and expired password reset tokens are cleaned up within 24 hours to 7 days.
• Dynamic Attendance QR Nonces: 4-second dynamic attendance QR tokens are superseded immediately upon rotation and cleared from temporary token stores.

SVKMHM reserves the right to revise this Privacy Policy to reflect system enhancements, administrative guideline updates, or statutory amendments. When changes are made, the revised policy will be posted on this page with an updated "Effective Date" header.

For inquiries regarding this Privacy Policy, personal data handling, or residential records, please contact the Hostel Administration through official institutional support channels or submit an administrative inquiry directly through the Contact & Administration Office page.