Privacy Policy governing the use of the camu k12 website and services.
This Privacy Policy governs your access to and use of the mobile applications and cloud-based platform provided by Octoze Technologies (the "App" and "Service").
By using our App, you consent to the terms and conditions described in this Privacy Policy. If you do not agree with this policy, please do not proceed further with app usage.
The usage of our mobile application requires access to the "Camu. Your Campus" cloud-based ERP solution for educational institutes. If you do not have access to the Camu platform, you will not be able to use this mobile app.
Our products and services are not intended for children under the age of 13. Octoze Technologies does not knowingly collect any personal information from children under 13. If we learn that we have collected or received personal data from a child under 13 without verification of parental consent, we will promptly delete that information.
If you believe we may have inadvertently collected information from a child under 13, please contact us immediately at: dpo@octoze.com
All data sent from the mobile application to the Camu server is stored encrypted. The content is under the ownership of the customer (the educational institute that you are part of). Octoze Technologies will never use this data for any purpose other than delivering the contracted service.
The data that you entered or viewed using the app is owned by the Institute. Octoze Technologies does not assume ownership of the data.
Octoze Technologies operates in two distinct capacities depending on the context of data processing:
This distinction determines the rights available to individuals and the obligations Octoze holds in each context, as further described in this Privacy Policy.
Octoze Technologies reserves the right to change, modify, add to, or remove portions of this Privacy Policy at any time, without notice to the user. The User is advised to periodically visit this page to review the current Privacy Policy to which he/she is bound.
If you have any questions about this Privacy Policy, please contact us at: support@octoze.com
Octoze is committed to protecting the privacy and personal information of individuals in accordance with applicable privacy laws and regulations. This Privacy Policy outlines how we collect, use, disclose, store, and manage personal information in connection with our services.
We may collect and hold the following types of personal information:
When accessing the service via the mobile application, we additionally collect:
We only collect personal information that is reasonably necessary for our services and operations. Personal data is collected strictly for operational, administrative, and compliance purposes.
We collect personal information directly from individuals through system usage, registration forms, institutional data uploads, and user interactions with the platform. Information may also be provided by authorised institutions or administrators.
Personal information is securely stored in cloud-hosted environments with appropriate technical and organisational safeguards, including access controls, encryption where applicable, and monitoring mechanisms to protect against unauthorised access, loss, or misuse.
We collect and use personal information for purposes including:
In relation to AI-enabled features, personal data is processed subject to the following restrictions:
Octoze uses analytics functionality within certain platform features to improve our products and services. Customers and users may consent to, or revoke consent for, the collection of analytics data by accessing the consent settings within the Camu platform. Consent can be turned on or off at any time through the product settings.
We only use personal information for purposes that are lawful and directly related to our services.
Personal information may be disclosed to:
All third parties are subject to contractual data protection and confidentiality obligations.
Octoze may send you communications about our products, services, and events where you have provided your details or have a legitimate business relationship with us. You may opt out of any future marketing contacts from us at any time by:
Opting out of marketing communications will not affect your ability to receive service-related or transactional communications necessary to deliver the contracted services.
Our website and platform may use cookies - small files placed on your device - to assist in collecting information about your visit. Cookies help us improve our platform and deliver a better experience. You have the ability to delete cookie files from your device at any time, or avoid cookies by configuring your browser to reject them or notify you when a cookie is being placed on your device.
We may use first-party and third-party cookies for purposes including:
For detailed information on the specific cookies we use, please contact us at dpo@octoze.com to request our Cookie Declaration.
Camu does not use student data, school data, or any personal information provided through the platform for advertising, marketing, or promotional purposes. Personal data collected through the service is used solely to provide, maintain, and improve the educational services offered to the institution. Camu does not sell, rent, or share student or institutional user data with third parties for advertising, marketing, or interest-based advertising purposes.
As Camu does not engage in interest-based advertising or use student or institutional user data for targeted marketing, users of the platform are not subject to advertising tracking or behavioural advertising within the service. Any communication Camu sends to institutional customers relates strictly to service notifications, product updates, or contractual communications and is not based on profiling of student data.
The platform may provide collaborative features such as discussion forums, message boards, or other interactive tools that allow users to share content with other authorised users within the platform environment.
By default, the platform does not share any personal information with other users or the public unless the user voluntarily shares it. Any personal information voluntarily shared by users in these areas may be visible to other authorised participants and may be collected or used by those participants according to their own responsibilities and applicable policies.
Users should exercise caution when sharing personal information in any shared or publicly visible areas of the platform. Institutions and users are encouraged to ensure that sensitive personal information is not disclosed through such features unless necessary for educational purposes.
The platform implements appropriate safeguards to protect user information; however, it cannot control how other authorised users may use information voluntarily shared within collaborative areas.
Content that you view within the app or website (for example, an assignment, a banner, or a hyperlink) may contain links to other apps or websites - such as camera access to capture a photo, a link to a video, or links to third-party websites and services.
Some links and advertisements on our site or platform may direct you to third-party websites. These third-party websites are not controlled by Octoze Technologies and are not subject to this Privacy Policy. We are not responsible for the privacy practices or content of those external sites. We recommend that you carefully read the privacy statements of any third-party apps or websites before visiting or providing your personal information.
We send periodic notifications about certain events that are triggered by your Institute - for example, a new Camu message or a new task assigned to you. You may use your device capabilities to control the behaviour of notifications.
The following Android permissions are requested by the app and the reason for each:
Camu maintains a contract with the institution which owns the data. The data is retained for the duration of the contract, or until the period the institution instructs Camu to delete the data in case of contract cancellation.
If the required personal information is not provided, certain features or services of the platform may not be accessible or may not function as intended. This may impact the ability to access academic services, communication tools, or administrative processes.
Where information is optional, individuals will be informed accordingly.
Individuals have the right to request access to the personal information held about them and to request correction of any inaccurate, incomplete, or outdated information.
Access and correction requests may be submitted through the relevant institution using the platform or by contacting the organisation via the contact details provided in this Privacy Policy.
The organisation will take reasonable steps to:
Where access cannot be provided, the individual will be informed of the reasons, subject to applicable legal restrictions.
Where consent applies:
You will no longer have access to the app when the Institute terminates you from a position, or you have relieved yourself from the position. The data that you entered or viewed using the app is owned by the Institute.
You may also request that we delete your information by emailing: support@octoze.com, or by submitting a helpdesk ticket through our service desk. We will respond to your request within 30 days.
If you are a student from an academic institution using Camu, we may be unable to delete the information, but we will respond to you with information to help you further on this matter.
Personal information may be disclosed to or accessed by recipients (Support Personnel) located outside the individual’s country of residence where necessary for the provision of services. This may include access by authorised personnel.
Such overseas disclosures are strictly controlled and occur only in accordance with contractual obligations, applicable privacy laws, and organisational security policies. Appropriate safeguards, including access controls, encryption, and confidentiality agreements, are implemented to ensure that personal information is protected to a standard consistent with applicable data protection requirements.
Where overseas disclosure occurs, the organisation ensures that:
Camu is a SaaS-based cloud solution deployed in multiple regions as independent instances to support data governing rules pertaining to where data should be stored. Current hosting regions are:
In-Country Hosting and Access: Camu can be hosted within the customer’s country and provide authorised in-country user access, in accordance with the contractual agreement established with the customer. For instance, customers in Australia can access services hosted within Australia
The organisation maintains formal agreements with all third-party services involved in native or partner-built integrations. These agreements are governed through contractual, legal, and data protection frameworks and explicitly cover:
All data-sharing agreements are periodically reviewed and updated to reflect any changes in scope, purpose, or regulatory requirements. Any modifications to integrations or data flows are subject to change management and approval processes, ensuring continued compliance.
Full details of sub-processors and country-level controls are set out in Section 5 of this document.
If an individual believes their privacy has been breached, they may lodge a complaint by contacting us using the details below.
Complaints will:
If the individual is not satisfied with our response, they may escalate the matter to the relevant regulatory authority.
Octoze Technologies conducts periodic reviews of its privacy practices and procedures to verify adherence to this Privacy Notice and applicable data protection laws. These reviews assess whether:
Any data subject with a complaint concerning Octoze's processing of their personal data may contact our Data Protection Officer at: dpo@octoze.com. We will investigate and attempt to resolve any complaints or disputes promptly.
For privacy concerns, access requests, corrections, complaints, or data deletion requests, please contact:
Privacy Officer - Octoze Technologies Pte. Ltd.
A Data Protection Addendum (DPA) is available for download and governs the contractual data protection obligations between Octoze Technologies and its customers. The DPA can be obtained by contacting dpo@octoze.com or via the Camu website.
Octoze processes personal data that its customers (educational institutions) have chosen to share with Octoze. Octoze has no direct contractual relationship with the individual data subjects - including students, faculty, staff, parents, or alumni - whose data is processed through use of the Camu platform.
The customer (educational institution) is the Data Controller in respect of personal data relating to its students, staff, and other data subjects. As a result, the customer is solely responsible for:
When processing Customer Personal Data, Octoze acts solely as a Data Processor and processes that data only in accordance with the customer's instructions. Octoze is not responsible for its customers' privacy policies or their compliance with applicable laws. Octoze does not review or monitor customers' privacy policies or their compliance with such policies.
Customers are responsible for ensuring that they provide Octoze with accurate, complete personal data and that the personal data collected is necessary to accomplish the stated purposes. Octoze will process personal data only in accordance with the customer's instructions and will return or destroy personal data in accordance with applicable law upon contract termination.
This section covers the governance, transparency, and ethical principles that govern the use of Artificial Intelligence (AI) within Octoze's platform. It should be read together with Section 2 of this Privacy Policy.
Octoze currently supports the following AI models/providers within its platform services:
AI features within the service are designed to operate without using personal data for training, behavioural analytics, or model development. Data protection principles of data minimisation, purpose limitation, and privacy-by-design are applied to all system components.
Our organisation maintains an easily accessible Privacy Policy and AI Transparency Notice that clearly informs individuals about how their personal data is handled in relation to AI-enabled features. This information is made available:
Any material changes to data processing practices are communicated in advance via updated notices.
The Camu Responsible AI Policy establishes the principles, governance structure, and controls governing the usage of 3rd party AI prescribed by the end user, its deployment, and use of AI systems within the organisation. The objective is to ensure AI technologies are used ethically, transparently, securely, and in compliance with applicable laws and organisational values.
Camu's AI approach embeds transparency and ethical governance throughout its AI-powered platform. The company emphasises using "trusted AI" that supports higher education institutions while maintaining clear, auditable, and transparent practices that uphold organisational values. Key commitments include:
The organisation adopts a risk-based approach to AI deployment:
A documented process exists to identify, investigate, and remediate AI-related incidents, including:
Significant incidents are escalated to management and addressed through corrective action.
Personnel involved in AI development, deployment, or use receive appropriate training on:
This section discloses all third-party sub-processors engaged to deliver the service, the countries in which personal information may be stored, processed, or accessed, and the controls in place to protect that information.
The following table lists all sub-processors currently engaged in delivering the service. All sub-processors are bound by Data Processing Agreements (DPAs) that flow down equivalent privacy and security obligations. An updated sub-processor list is available upon request at: dpo@octoze.com
| Sub-Processor | Service / Purpose | Data Categories Processed | Location | Transfer Mechanism | Security Attestations |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure & hosting | Account data; Student Personal Information; Academic Content; Usage logs, backups | Country-specific (India / Singapore / Ohio / Australia) | AU/IN/SG region only | ISO 27001, SOC 2 Type II |
| SendGrid / Local SMS Provider | SMS / email gateway notifications | Contact details (email/phone) | Country-specific (India / Singapore / Ohio / Australia) | SCCs + DPA | ISO 27001, SOC 2 Type II |
| Datadog, Inc. | Logging & monitoring | Usage logs, performance metrics (no student content) | Country-specific (India / Singapore / Ohio / Australia) | SCCs + DPA | SOC 2 Type II |
| 3rd Party FinTech Payment Gateways | Payment processing | Billing/payment details | Country-specific (India / Singapore / Ohio / Australia) | SCCs + DPA | PCI DSS, SOC 2 Type II |
| FreshDesk | Customer support / helpdesk | Account details, support ticket content | Country-specific (India / Singapore / Ohio / Australia) | SCCs + DPA | SOC 2 Type II |
Octoze takes reasonable and appropriate steps to ensure that sub-processors and third-party agents process personal data in accordance with our contractual agreements and this Privacy Policy. If Octoze learns that a sub-processor is using or disclosing personal data in a manner contrary to this Privacy Policy, Octoze will take steps to prevent or stop such use or disclosure.
Under certain circumstances, Octoze may remain liable for the acts of its third-party agents or service providers in their handling of personal data transferred to them on Octoze's behalf. Octoze will take responsibility for ensuring adequate contractual protections are in place and will act promptly to remediate any identified breach of those obligations.
Personal information processed as part of this service may be stored, accessed, or supported from the countries listed below. We have implemented contractual, technical, and organisational controls to ensure that all cross-border disclosures meet applicable privacy obligations, including the Australian Privacy Principles (APP 8), New Zealand Privacy Act (IPP 12), and GDPR.
| Country / Region | Purpose / Context | Controls & Safeguards | Security Attestations |
|---|---|---|---|
| India | Primary hosting for users within India (AWS) | Data residency in India; no cross-border transfer for primary data | ISO 27001; SOC 2 Type II |
| Singapore | Primary hosting for users from PH, SG, MY, TH, UAE, HK (AWS) | SCCs; contractual DPAs; encryption in transit and at rest (AES-256) | ISO 27001; SOC 2 Type II |
| Ohio, USA | Primary hosting for users from North America, South America, Africa (AWS) | SCCs; contractual DPAs; encryption in transit and at rest (AES-256) | SOC 2 Type II; ISO 27001 |
| Australia / Other regions | AWS backup replication, analytics, email gateway, helpdesk, CDN logs | SCCs; contractual DPAs; AES-256 encryption in transit and at rest | SOC 2 Type II; ISO 27001 |
This section applies to California residents who are "Consumers" as defined in the California Consumer Privacy Act ("CCPA").
Octoze does not knowingly collect personal information from California Consumers under the age of 16.
California Consumers have the right to request the following information:
California Consumers may also have the right to request that Octoze delete certain personal information.
Octoze will not discriminate against California Consumers who exercise their rights under the CCPA.
California Consumers may exercise these rights by contacting us at: dpo@octoze.com or support@octoze.com. Octoze will verify your request using information you provide, which may include your email address. Government identification may be required to validate your request. California Consumers may also designate an authorised agent to exercise these rights on their behalf.
Octoze does not sell personal information for money. However, certain sharing activities (such as providing data to event co-sponsors or partners) may be considered a "sale" or "sharing" under the CCPA. California Consumers who would like to opt out of this kind of sharing should contact us at: dpo@octoze.com
This section applies to individuals whose personal data is collected or processed by Octoze in connection with the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland.
Personal data collected from individuals in the EEA, UK, or Switzerland may include:
Octoze recognises that certain categories of personal data require heightened protection. When we directly collect sensitive personal data - including data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, or data concerning sex life - we will obtain explicit opt-in consent where required by applicable law, including if we disclose such data to third parties or use it for a different purpose than originally collected.
Octoze's platform is maintained and hosted in various regions including the United States and other countries. By using Octoze's platform or services, you acknowledge that your personal data may be transferred to, processed, and retained outside the EEA, UK, and Switzerland.
Octoze ensures that any such transfer is subject to appropriate safeguards, including:
Where required, Octoze will enter into standard contractual clauses for the transfer of personal data from the EEA, UK, or Switzerland to third countries.
Octoze maintains documented data retention schedules. Personal data is retained in accordance with those schedules and is securely deleted, destroyed, de-identified, or anonymised at the end of the applicable retention period. Octoze will retain personal data as necessary to fulfil the purposes described in this Privacy Policy or in applicable customer agreements.
You may have the right to access the personal data we hold about you and to request that we correct, amend, or delete it if it is inaccurate. These access rights may not apply in all cases - for example, where providing access is unreasonably burdensome or would violate the rights of another individual.
To request access, correction, amendment, or deletion, submit a written request to: dpo@octoze.com. We may request specific information from you to confirm your identity. In some circumstances a reasonable fee may be charged for access to information.
If you are located in the EEA, UK, or Switzerland and have concerns about how Octoze processes your personal data, you have the right to contact your local data protection authority (DPA) to lodge a complaint. You may also contact Octoze's Data Protection Officer directly at: dpo@octoze.com
Octoze Technologies is committed to implementing appropriate cross-border data transfer mechanisms to protect personal data transferred internationally. Where required under applicable EU/UK data protection law, Octoze applies Binding Corporate Rules (BCR) or equivalent internal policies to govern the transfer and handling of personal data across its group entities.
Where any provision of this Privacy Policy conflicts with the provisions of applicable BCRs, the applicable provision of the BCR shall supersede any conflicting provision in this Privacy Policy. Details of applicable BCR arrangements are available upon request at: dpo@octoze.com
The organisation may update this Privacy Policy periodically to reflect changes in legal, regulatory, or operational requirements, or to improve transparency in how personal information is handled.
Where material changes are made, users will be notified in advance, using appropriate communication channels such as in-platform notifications and/or email communications.
Users will be provided with at least 30 days' notice prior to such changes taking effect, unless a shorter timeframe is required to comply with legal or regulatory obligations.
Updated versions of the Privacy Policy will be made available on the organisation's website and within the platform for review.
Where required, users will be asked to review and provide explicit consent to the updated Privacy Policy before continuing to use the service.
Should you have any questions or concerns about this Privacy Notice, please contact our data protection officer by any of the following means:
Octoze Technologies Pvt. Ltd.
Attn: Data Protection Officer
Octoze Technologies (P) Ltd., No. 56/3A, Fayola Towers,
2nd Floor, 200 Feet Radial Road, Pallikaranai,
Chennai - 600 129, Tamil Nadu.
Octoze may revise this Privacy Notice from time to time in order to comply with new laws and regulations; to conform to industry best practices; to reflect changes in Octoze product and service offerings; and for other reasons. The revised Privacy Notice will become effective when it is posted on this website.