Rashtriya Raksha UniversitySign in

Privacy & Biometric Data Policy

This policy details how Rashtriya Raksha University (RRU) processes, protects, and retains student biometric data and attendance records.

What we collect

  • A 128-number face descriptor vector computed locally inside your web browser. Raw camera images or video frames are never stored or transmitted to university servers.
  • A cryptographic device fingerprint hash used strictly to prevent a single mobile device from submitting attendance for multiple students.
  • Session verification metadata: timestamp, approximate location (evaluated against the course geofence), IP address, and 5-gate pipeline verification outcomes.

Legal basis & consent

Biometric face descriptors are processed under India's Digital Personal Data Protection (DPDP) Act 2023 and GDPR Article 9 standards. Processing occurs exclusively with your explicit, revocable consent provided during initial enrollment.

Security & Encryption

  • Face descriptors are encrypted at rest using AES-GCM-256 with a secure server-only key.
  • Attendance check-ins are verified with a 60-second time-bound HMAC-SHA256 challenge.
  • Row-Level Security (RLS) ensures biometric data is completely isolated. Only authorized course instructors and institution administrators can access attendance decisions.
  • All attendance decisions (accepted, rejected, manual overrides) are logged in an append-only ledger.
Notice on Technical Liveness Verification (Known Residual Risk)

In accordance with university transparency guidelines: Active liveness signals (eye aspect ratio, head yaw/pitch) are currently computed on the student's browser device prior to submission. While protected by HMAC signing and geofencing, server-side raw video frame attestation is scheduled for future release. Students who require non-biometric validation may request teacher-assisted manual fallback.

Data Retention & Withdrawal

Face descriptor vectors are retained for up to 365 days from enrollment or your last active check-in. Students may withdraw consent at any time via the Enrollment Portal. Upon withdrawal, biometric vectors are deleted, while academic attendance ledgers are retained per university academic regulations.

Non-Biometric Fallback

Students who choose not to enroll biometrically or experience recurring technical issues can use teacher-assisted manual attendance fallback with documented justification.

← Back to home