Privacy policy

This portal is run by Making The Difference NGO (“MTD”, “we”, “us”), a not-for-profit company registered under Section 8 of the Companies Act, 2013, with its office at 1st Floor, behind Dodhia Petrol Pump, Laxmi Baug, Kashigaon, Mira Road East, Thane, Maharashtra 401107.

MTD is the Data Fiduciary for the personal data handled through this portal under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). This policy also follows the Information Technology Act, 2000 and the rules made under it.

The portal supports the Road Safety Traffic Park Workshop, which MTD runs in schools with its CSR partners. Schools use it to register, add their classes, teachers and students, and see results.

Students take a short test before the workshop (pre-test) and another after it (post-test). Comparing the two shows what the students learned.

We collect only what the workshop needs.

About the school

• School name, UDISE code, school type, boards and teaching languages.
• Address, village or city, district, state and PIN code.
• Classes taught, approximate number of students, working computers and internet access.

About school staff

• Principal: name, mobile number and email.
• Portal coordinators and teachers: name, mobile number, email (optional), subject, role and the classes they teach.

About students

• Name, class, section, roll number and gender (gender is optional).
• A parent or guardian's mobile number, only when that parent or guardian has given consent through the school.
• Test answers, scores, and when each test was started and finished.

Technical data

• Sign-in records, so we can keep accounts secure.
• The IP address from which the school's registration consent was given, stored with that consent.
• Browser and device details, and test-integrity signals during a test, such as leaving the test window or trying to copy or paste.

What we never collect

We do not collect a student's date of birth, home address, photograph, Aadhaar number, email address or any other identity number.

We use personal data only to:

• review and approve the school's registration and manage its account;
• let the school's authorised staff set up classes, teachers and students;
• plan and run the workshop and the pre-test and post-test;
• work out scores and learning gains, and show results to the school;
• prepare certificates for students;
• send results and certificates to a parent or guardian by WhatsApp, SMS or email, only where that parent or guardian consented to share their number;
• keep the portal and the tests secure and fair, and meet our legal duties.

CSR partners and funders receive only combined figures, such as the average score of all students in a class or district. These figures never name or identify a student, teacher or parent.

We process personal data on the basis of consent given under the DPDP Act, and for legitimate uses the DPDP Act allows, such as meeting a legal obligation.

• The person who registers a school confirms that they are authorised to act for the school and accepts this policy for the school.
• Teachers and coordinators give their own consent when they create an account.
• For students, the school obtains verifiable consent from each parent or lawful guardian before adding the child's details, and records that consent. See section 6.

Most students are under 18, so the DPDP Act treats them as children. Their data needs the verifiable consent of a parent or lawful guardian.

• The school is responsible for getting that consent from parents or guardians before it adds a student, and confirms this when it registers.
• The school records, for each student, whether the parent or guardian agreed to share their mobile number. The portal stores the number only when the answer is yes; the database itself refuses a number without consent.
• We do not track children, monitor their behaviour, profile them or show them advertising of any kind.
• We never sell children's data or use it for any purpose other than the workshop, tests, results and certificates.
• Test-integrity signals are used only to keep a test fair, never to judge a child outside the test.

A parent or guardian can ask for their child's data to be corrected or removed through the school, or by writing to us directly (see section 10).

• The school's own authorised users. A school admin sees the whole school; a teacher sees only what their role allows.
• MTD staff who need it for their work, under role-based access. Phone numbers and emails are hidden from staff who do not need them, and every view of a student list is logged.
• Service providers who run the portal for us: cloud hosting, database, sign-in and messaging. They act only on our instructions, under confidentiality and security obligations, and may not use the data for themselves.
• CSR partners and funders, who receive only combined figures that identify no one.
• Government or law enforcement authorities, only when the law requires it.

We do not sell, rent or trade personal data.

• Data is stored on secured cloud infrastructure and sent only over encrypted (HTTPS) connections.
• Mobile numbers and emails are encrypted in the database.
• Passwords are never stored by us in readable form; our sign-in provider keeps only a secure hash.
• The portal never connects to the database directly. Every request goes through our server, which checks who is asking and limits them to their own school.
• Access by MTD staff is limited by role and recorded in an audit log.

• When a school removes a student, class or department, those student records are permanently deleted at once. We keep no copy.
• When a school stops taking part, we delete or anonymise its identifiable student records within 1 year of its last workshop, or sooner if the school asks.
• School and staff account details are kept while the school takes part, and deleted or anonymised within 1 year after it stops.
• Combined, anonymous results used in programme reports may be kept for up to 3 years after the workshop. They cannot identify anyone.
• Security and sign-in logs are kept only as long as needed to protect the portal, and for at least the period the law requires.

Under the DPDP Act, you have the right to:

• get a summary of your personal data we hold and how we use it;
• have wrong or incomplete data corrected, and out-of-date data updated;
• have your data erased when it is no longer needed for the purpose you consented to;
• withdraw your consent at any time, as easily as you gave it. Withdrawing does not affect what was done before, but we may no longer be able to include you or your child in the workshop;
• nominate another person to exercise these rights if you die or become unable to;
• have a grievance heard and resolved.

Teachers and coordinators can correct most of their details in the portal. Parents and guardians can act for their child through the school, or write to us at help@mtdngo.org. We may ask for reasonable proof that you are the person, or the parent or guardian, concerned.

Write to our Grievance Officer with any question or complaint about your data:

We acknowledge every complaint promptly and resolve it within the time limits under the DPDP Rules, and in any case within 90 days.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

If a personal data breach happens, we will act at once to contain it, and inform the affected schools and people and the Data Protection Board of India as the DPDP Act and DPDP Rules require, including what happened, what it means for them and what they can do.

The portal uses only what it needs to work: storage in your browser to keep you signed in. We do not use advertising or tracking cookies, and we do not use third-party analytics to follow you across websites.

We may update this policy when the portal or the law changes. We will show the new date at the top of this page and tell school admins in the portal before an important change takes effect. Where a change needs fresh consent, we will ask for it.