Privacy Policy

1. Who we are and what this policy covers

1.1 Who we are

AwT Academy (“AwT Academy”, “we”, “us” or “our”) is an independent vertical of Animweb Technologies. The website, courses and payments are operated by Animweb Technologies through AwT Academy.

For the purposes of India's Digital Personal Data Protection Act, 2023, Animweb Technologies, acting through AwT Academy, is the Data Fiduciary for the personal data described in this policy — that is, the organization that decides why and how your personal data is processed. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing, the same organization is the controller.

Our Grievance Officer, Manish Mishra (Managing Director & Head, AwT Academy), is the person who answers questions about the processing of your personal data on our behalf. Contact details are in section 21.

1.2 What this policy covers

This policy explains how we handle personal data in connection with:

1. Our website — including the course pages, the registration page and any page that links to this policy;
2. Enquiries you make by phone, WhatsApp or email, before or after you enroll;
3. Registration and payment for any of our 7 programs, including the security checks that protect the process;
4. Live online classes and learning activities — attendance, assignments, projects, assessments and the Certificate of Completion;
5. Invoices, refunds, transfers, support and grievances; and
6. Communications about your batch and, only if you agree, about future batches and programs.

Our live online classes are open to learners worldwide, so this policy applies wherever you are. Offline (classroom) classes are planned for learners in Chandigarh, Mohali and Panchkula only. They are coming soon, no launch date has been announced and they cannot yet be booked. If you ask us to tell you when offline batches open, we use your name and contact number only for that purpose. Before classroom batches begin, we will update this policy to describe any additional processing they involve.

1.3 What this policy does not cover

• The independent processing carried out by third parties under their own privacy policies — for example, by Razorpay for its own regulatory obligations, by your bank or card network, by WhatsApp (Meta) or by Google (Google Meet) in respect of your own account with them (see section 11 and section 20).
• Websites and services that we link to but do not control.
• Personal data of our own staff and trainers, which is handled under separate internal policies.

1.4 How this policy fits with our other terms

This policy should be read together with our Terms & Conditions and our Refund & Cancellation Policy. On any question about personal data, this policy applies. Nothing in this policy limits any right you have under the law that applies to you.

1.5 This policy as our notice to you

This policy is the notice we give you under section 5 of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. When you register, we ask you to confirm through a separate, unticked checkbox that you consent to the processing described here. Simply browsing our website involves only the limited technical processing described in sections 6, 7 and 8.

2. Key terms used in this policy

Words in this policy have the meanings given below. Where a term is defined in the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we use it in the same sense.

Personal data

Any data about an individual who is identifiable by, or in relation to, that data — for example your name, email address, mobile number, date of birth or payment reference.

Processing

Any wholly or partly automated operation performed on personal data, such as collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

Data Principal, “you”

The individual to whom the personal data relates. For a child, this includes the child's parent or lawful guardian.

Data Fiduciary

The person who, alone or with others, determines the purpose and means of processing personal data. For this policy, that is Animweb Technologies acting through AwT Academy. Under the GDPR and UK GDPR the equivalent term is “controller”.

Data Processor

A person or company that processes personal data on behalf of a Data Fiduciary — for example our hosting and form-delivery providers. Under the GDPR the equivalent term is “processor”.

Child

An individual who has not completed eighteen years of age, as defined in the DPDP Act.

Guardian

A parent or lawful guardian of a child who gives consent on the child's behalf.

Learner

A person registered for an AwT Academy course.

Consent

Your free, specific, informed, unconditional and unambiguous agreement, given through a clear affirmative action (such as ticking a checkbox), to processing for a stated purpose.

Personal data breach

Any unauthorized processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.

Board

The Data Protection Board of India established under the DPDP Act.

Services

Our website, registration and payment process, live online classes, learning activities, certificates, support and related communications.

3. Laws we follow

AwT Academy is based in India and serves learners around the world. We have designed our practices to meet the following laws:

4. Personal data we collect

We follow the principle of data minimization: we ask only for what we need for clearly stated purposes. The table below lists everything we collect, where it comes from and why.

4.1 Data you give us when you register

Fields marked with an asterisk (*) on the registration form are required; we cannot register you without them. All other fields are optional, and leaving them blank does not affect your enrollment.

4.2 Data created while you register and pay

4.3 Data created while you study with us

4.4 Data you give us when you contact us

When you call, message us on WhatsApp or email us, we receive your phone number or email address, your WhatsApp profile name (if you use WhatsApp), the content of your messages, and any documents or screenshots you choose to send — for example a payment reference for a refund request. We keep short notes of calls where needed to resolve your query. We use this data to answer you, handle refunds and grievances, and improve our support.

4.5 Data we receive from others

• Razorpay tells us whether your payment succeeded and gives us the payment references listed above.
• Cloudflare provides the outcome of the Turnstile bot check and security information about requests to our website.
• A parent or guardian may provide a child's details when registering them.
• Your bank or payment provider may, through Razorpay, provide information needed to resolve a failed payment, refund or dispute.

4.6 Data we do not collect

• Card numbers, card expiry dates, CVV codes, UPI PINs, net-banking user IDs or passwords, wallet PINs or one-time passwords (OTPs) — these are entered only in the Razorpay window and never reach us.
• Aadhaar, PAN, passport or other government identity numbers — our website does not ask for them.
• Biometric, health, caste, religious, political or sexual-orientation information.
• Precise location, contacts, photos or other data from your device.
• Log-in passwords — our website does not currently offer learner accounts, so we hold no passwords for you.

Please do not send us any of this information, or any other sensitive information, by WhatsApp, email or in a live class chat. If you send it to us by mistake, we will delete it.

4.7 Keeping your data accurate

Please make sure the details you give us are accurate and complete — especially your name, which is printed on your certificate, and your email address and mobile number, which we use for class links and invoices. If anything changes, tell us and we will update our records (see section 16).

5. Payment data and Razorpay

5.1 How payments work

All course payments are processed by Razorpay Software Private Limited (“Razorpay”), an Indian payment gateway that is PCI-DSS compliant. When you pay, a secure Razorpay checkout window opens on our registration page. You can pay with UPI, debit or credit cards, net banking or wallets, and with international cards where your bank supports it. All payments are charged in Indian Rupees (INR). The same fee applies to every course and depends only on the country of residence you declare at registration:

• Learners resident in India: ₹24,000 plus GST at 18% (₹4,320), a total of ₹28,320.
• Learners resident outside India: ₹30,000 plus GST at 18% (₹5,400), a total of ₹35,400.

We use the country you select to apply the correct fee and to issue a GST-compliant tax invoice; we do not use it for any other pricing decision.

5.2 What we never see or store

Your payment details are entered directly into Razorpay's checkout. We never see, receive or store your card number, card expiry date, CVV, UPI PIN, net-banking user ID or password, wallet PIN or any one-time password (OTP). No payment-card data passes through or is stored on our servers.

5.3 What we receive from Razorpay

• The Razorpay order ID and payment ID;
• The payment method type (for example UPI, card, net banking or wallet);
• The amount, currency and status of the payment (for example authorized, captured, failed or refunded); and
• The date and time of the transaction.

Our authorized staff can also see, in our Razorpay merchant dashboard, the limited and partly masked details that Razorpay itself displays to merchants — such as the card network, the last four digits of a card, the issuing bank or the UPI ID used. We use these only to reconcile payments, process refunds and handle disputes or chargebacks.

5.4 What we share with Razorpay

To create your payment order and pre-fill the checkout window, our server sends Razorpay your name, email address, mobile number with country code, country, city, the course and class mode you selected, and your Registration ID. We also attach a one-way cryptographic fingerprint (a “hash”) of your registration details. The fingerprint does not reveal your details; it lets our server detect whether anything was altered between payment and registration.

5.5 How we verify payments

Your registration is submitted to our admissions team only after Razorpay confirms your payment. Our server checks directly with Razorpay that the payment was captured, for the exact course price, on the order created for your registration. Your seat is confirmed only after the payment has been captured and verified. Razorpay also emails you a payment confirmation, and you receive an on-screen receipt.

5.6 Razorpay's own responsibilities

Razorpay processes payment data as our payment service provider. For its own legal and regulatory obligations — such as fraud prevention, anti-money-laundering checks and record-keeping required of payment companies — Razorpay acts as an independent Data Fiduciary under its own privacy policy, which we recommend you read. Razorpay may contact you directly about a payment, for example to send a receipt.

5.7 Refunds, failed payments and international cards

• Refunds are initiated through Razorpay to the original payment method only, in line with our Refund & Cancellation Policy. We use your Registration ID, payment ID and contact details to process them.
• Failed payments where money was debited are reversed automatically by your bank or Razorpay, typically within 5–7 working days. Duplicate payments for the same registration are refunded in full.
• International cards: your bank and card network handle currency conversion and any related charges, and process your data under their own policies.

6. Technical data, hosting and Cloudflare

6.1 Hosting

Our website and the small server functions that power registration and payment verification are hosted on the global network of Cloudflare, Inc. (“Cloudflare”). Cloudflare delivers our pages from a data center close to you, encrypts traffic, and protects the website against attacks.

6.2 Data processed automatically

Like every website, ours cannot work without processing some technical data each time your browser requests a page. This includes:

• Your IP address and the approximate location derived from it (country or city level, never your precise location);
• Your browser and device information — browser type and version, operating system, device type and language settings;
• Request details — the page or file requested, the referring page, date and time, response status and connection security information; and
• Security signals used to detect malicious traffic, denial-of-service attacks and bots.

6.3 Why we process it

We use technical data only to deliver the website to you, keep it secure and available, enforce our security rules, diagnose errors and keep the security logs that the law requires. We do not use it to build a profile of you or to follow you across other websites.

6.4 Our server functions

When you register, our server functions validate your details, set the fixed course price, create the payment order with Razorpay, check the Turnstile result and verify your payment. They process your registration details only for as long as needed to do this, and they do not keep a separate database of learner records on the website. Limited operational logs — for example, an order reference recorded when a verification check fails — may be kept by our hosting provider for troubleshooting and security.

6.5 What we do not do

• No analytics tools, advertising or remarketing tags, tracking pixels or session-recording scripts.
• No social-media plugins or “like” buttons that report your visit to social networks.
• No third-party font or image services: fonts, logos and images are served from our own domain, so viewing our pages does not send information to other companies.
• The only third-party code that runs on our website is Razorpay Checkout and Cloudflare Turnstile, and only for payment and security.

Our website also includes content-protection features, such as limits on the right-click menu and on keyboard shortcuts for viewing source code. These run entirely in your browser and do not collect or send any data.

7. Bot protection with Cloudflare Turnstile

7.1 What Turnstile is

To protect our registration and payment process from bots, spam, fake registrations and card-testing fraud, we use Cloudflare Turnstile, a privacy-focused alternative to traditional CAPTCHA puzzles. In most cases it works in the background and you will not need to do anything; occasionally it may ask you to tick a box.

7.2 What data it processes

To decide whether a visitor is a person or an automated program, Turnstile processes your IP address, characteristics of your browser and device (such as browser version and rendering behavior), and how your browser interacts with the check. When you submit the form, our server sends the resulting Turnstile token and your IP address to Cloudflare's verification service. We receive only the result — whether the check passed — with basic details such as the time of the check. We do not receive the underlying signals.

7.3 Purpose and limits

We use Turnstile solely to keep the registration and payment process secure. We do not use Turnstile data for advertising, marketing or profiling. Cloudflare processes this data under its own privacy terms for Turnstile.

7.4 If the check does not work for you

If the security check fails repeatedly, try refreshing the page, updating your browser, or temporarily disabling browser extensions or VPNs that block scripts. If it still does not work, call us on +91 62830 97869 or +91 94652 65663, or WhatsApp +91 62830 97869, and a member of our team will help you register.

8. Cookies and browser storage

8.1 Our approach

We do not use advertising cookies, analytics cookies, tracking pixels or any similar technology to follow you. We use only storage that is strictly necessary for security, payment and a reliable registration. Because we use no non-essential cookies, we do not show a cookie banner. If we ever introduce non-essential cookies or analytics, we will ask for your consent first and update this policy.

8.2 What is stored, by whom and why

The two items set by AwT Academy are stored only in your browser. They are not sent to us as cookies and we cannot read them from our servers. Your details are sent to us only when you deliberately submit the registration, and only after payment is confirmed.

8.3 Managing storage

You can clear cookies and site data at any time in your browser settings. Please note:

• If you clear site data after paying but before your registration is confirmed on screen, the pending registration on your device is lost. Your payment is safe — contact us with your Razorpay payment ID and we will complete your registration.
• If you block the strictly necessary storage used by Turnstile or Razorpay, the security check or payment window may not work.
• On a shared or public computer, clear the browser's site data after registering.

8.4 “Do Not Track” and Global Privacy Control

Because we do not track visitors across websites or use advertising technology, we already behave the way these browser signals request, whether or not your browser sends them.

9. How we use your data and our legal bases

9.1 Our purposes

We use personal data only for the following purposes: registration; payment, verification and fraud prevention; delivering classes; certificates; invoices and tax compliance; support, refunds and grievances; course updates (only with your optional consent); and legal compliance.

9.2 Purposes and legal bases in detail

Under the DPDP Act, we process personal data either with your consent or for a legitimate use that the Act permits, such as complying with Indian law. Where the GDPR or UK GDPR applies, we also identify the corresponding legal basis.

9.3 Session recordings

We do not promise that every session is recorded. If we record a live session, we tell participants that recording is on. Your name, voice, video, screen-share or chat messages may appear in the recording if you choose to share them. Recordings are made available only to learners of that batch for personal study, and must not be downloaded, shared or redistributed. You can keep your camera off or use the chat if you prefer not to appear on video.

9.4 What we will never do

• Sell, rent or trade your personal data, or share it with anyone for their own marketing.
• Use your data for advertising, ad targeting or profiling.
• Publish your name, photo, video, project work or any statement about you without your separate, explicit permission.
• Use your data for a new, unrelated purpose without telling you and, where the law requires, obtaining your consent first.

10. Communications and marketing choices

10.1 Service messages

Once you register, we need to contact you about your course. These service messages are part of delivering the course you paid for and are sent whether or not you opt in to updates. They include:

• Confirmation of your registration (Razorpay also emails a payment confirmation);
• Your batch start date and final class timings in IST, which we share after registration and before the batch begins;
• Personal class links, schedule changes and rescheduled sessions;
• Assignments, project deadlines, attendance and certificate updates;
• Tax invoices, refund and transfer updates, and answers to your questions; and
• Important changes to our Terms, Refund Policy or this Privacy Policy.

We send these by WhatsApp, email or phone, using the contact details you gave us.

10.2 Optional updates

Only if you tick the optional box on the registration form (or otherwise ask us to) will we send you information about upcoming batches, new courses and academy announcements. The box is never pre-ticked, and saying no has no effect on your registration or your course. For learners under 18, optional updates are sent only where the parent or guardian agrees.

10.3 How to opt out

You can stop optional updates at any time, free of charge, by:

• Replying “STOP” to any WhatsApp update;
• Using the unsubscribe option in any update email; or
• Telling us by calling +91 62830 97869 or +91 94652 65663, or on WhatsApp at +91 62830 97869.

We act on opt-out requests promptly and keep a record of your choice so that we do not contact you again for updates. Service messages about a course you are enrolled in will continue.

10.4 Batch groups

If we create a WhatsApp group or community for your batch, other members may be able to see your phone number and profile name. Joining is your choice; tell us if you would prefer to receive batch announcements individually. Please do not share other learners' contact details outside the group.

10.5 No unsolicited marketing

We do not buy contact lists, we do not share your contact details with others for their marketing, and we follow the telecom commercial-communication rules that apply in India.

11. Who we share data with

11.1 No selling

We never sell, rent or trade your personal data. We share it only with the recipients below, only to the extent needed for the purpose stated, and only under appropriate safeguards.

11.2 Service providers and other recipients

11.3 Within AwT Academy

Inside the academy, your data is available only to people who need it for their role — for example our admissions team to confirm your registration, your trainer to teach and assess you, and our accounts team to issue invoices and refunds. Individuals who provide technical support for our website and systems (including our technology partner, AwT Labs) may access personal data only where this is necessary for maintenance or security, on our instructions and under confidentiality obligations. We do not share learner data with our media partner, AwT Media.

11.4 Safeguards for processors

We choose providers with strong security and privacy commitments, and we rely on their contractual and published terms that require them to process data only for the services they provide to us, keep it confidential and protect it. Under section 8(1) of the DPDP Act we remain responsible for processing carried out on our behalf.

11.5 Legal and safety disclosures

We may disclose personal data where we are required to do so by law, by a court order or by a lawful request from a government authority, or where it is necessary to prevent fraud, protect the safety of any person or protect our legal rights. We check that each request is lawful and disclose only what is necessary.

11.6 Disclosures at your request

We share your data with others only when you ask us to — for example, if you ask us to confirm your certificate to an employer or to discuss your course with a family member.

11.7 Business changes

If Animweb Technologies reorganizes, merges, or transfers the AwT Academy business to another organization, learner data may be transferred to the successor so that your course and records continue. The successor will be required to protect your data under this policy, and we will tell you before your data becomes subject to a different privacy policy.

12. International and cross-border transfers

12.1 Where your data is processed

We operate from India, and Razorpay processes payments in India. Some of our providers, including Cloudflare and Web3Forms, may process data outside India. Cloudflare serves our website from a global network of data centers, normally the one closest to you. Our communication tools and Google Meet may also process data outside India.

12.2 Transfers under Indian law

Section 16 of the DPDP Act permits personal data to be transferred outside India, except to countries or territories that the Central Government restricts by notification. We will not transfer personal data to any restricted country, and we will review our providers if the Government issues such a notification.

12.3 Learners outside India

Our live online classes are open to learners worldwide. If you register from outside India, you provide your personal data directly to us in India so that we can deliver the course you have asked for. Data-protection laws in India may differ from those in your country, but we apply the protections in this policy to your data wherever it is processed.

12.4 Learners in the EU, EEA and UK

India does not currently have an adequacy decision from the European Commission or the UK Government. When you register with us from the EU, EEA or UK, you provide your data directly to us in India to receive the course you request. Where our service providers move data onward, we rely on the safeguards they offer, such as standard contractual clauses or equivalent contractual commitments, where available.

12.5 How transfers are protected

• All data travels over encrypted HTTPS/TLS connections.
• We share only the minimum data each provider needs.
• Our providers are bound by contractual and published commitments on confidentiality and security.

13. How long we keep your data

13.1 Our principle

We keep personal data only for as long as it is needed for the purposes described in this policy, or for longer only where the law requires it. In line with section 8(7) of the DPDP Act, we erase personal data when you withdraw consent or when the purpose has been served, unless we must keep it to comply with law.

13.2 Retention periods

13.3 At the end of the retention period

We securely delete the data or irreversibly anonymize it so that it can no longer identify you. Copies in backups are removed in the normal backup cycle. We may keep anonymous statistics (for example, the number of learners in a course) because they are not personal data.

13.4 Legal holds

If data is needed for an ongoing dispute, investigation, legal claim or regulatory request, we keep only that data, only for as long as needed, and then delete it.

14. How we protect your data

Section 8(5) of the DPDP Act requires every Data Fiduciary to take reasonable security safeguards to prevent personal data breaches. We have built security into every layer of our Services.

14.1 Technical safeguards

• Encryption in transit: every page and request is served over HTTPS/TLS, and HTTP Strict Transport Security (HSTS) instructs browsers to always use a secure connection.
• Strict Content-Security-Policy: the website only allows scripts from our own domain, Razorpay and Cloudflare Turnstile, which helps block malicious code injection.
• Further security headers that prevent our pages from being framed by other sites, limit the information sent to other websites, and switch off browser features we do not need, such as camera, microphone and location access.
• Cloudflare network protection against denial-of-service attacks and malicious traffic.
• Turnstile bot protection on the registration and payment process.
• Prices fixed on the server: the course price is set by our server, so it cannot be changed in your browser.
• Server-side payment verification: every payment is verified directly with Razorpay before a registration is released, using secret keys stored only in encrypted server environment variables. Secret keys are never sent to your browser or stored in our website code.
• Tamper detection: a cryptographic fingerprint of your registration details is recorded when payment starts and re-checked after payment, so details cannot be altered after paying.
• Signed, tamper-proof verification links: every registration delivered to our team carries a digitally signed link that lets our team re-check the payment live with Razorpay before confirming a seat. A forged or altered registration fails this check.

14.2 Payment security

Your card, UPI and bank details are entered only in Razorpay's PCI-DSS compliant checkout and never touch our servers. Payments are authenticated by your bank or UPI app (for example with an OTP or UPI PIN), which only you should see.

14.3 Organizational safeguards

• Data minimization: we collect only what we need and share only what each provider needs.
• Least-privilege access: learner records are available only to authorized people who need them for their role, protected by strong authentication.
• Confidentiality: everyone who handles learner data on our behalf is bound to keep it confidential.
• Careful choice of providers and review of their security and privacy commitments.
• Incident response: a defined process to contain, investigate and report any personal data breach (see section 18).
• Logging and monitoring to detect and investigate unauthorized access.

14.4 What we ask of you

• Pay only through the Razorpay checkout on our registration page. Course fees are never collected through a personal UPI ID, personal bank account or payment link sent by an unknown number. If anyone asks you to pay an AwT Academy fee another way, do not pay and tell us immediately.
• Check that you are talking to us. Our official numbers are +91 62830 97869 (phone and WhatsApp) and +91 94652 65663 (phone). If in doubt, contact us on one of these numbers before acting on a message.
• Check the address bar and the padlock symbol before entering your details, and be wary of look-alike websites.
• Keep your class links private. They are personal to you and must not be shared.
• Keep your devices secure with up-to-date software, and clear site data after registering on a shared computer.
• Report anything suspicious — a fake message, call or website using our name — to us straight away.

14.5 Reporting a security vulnerability

If you believe you have found a security weakness in our website, please tell our Grievance Officer (see section 21) with enough detail for us to reproduce it. Please do not access, change or delete other people's data, disrupt our Services, or make the issue public before we have had a reasonable opportunity to fix it.

14.6 Limits of security

We work hard to protect your data, but no method of transmission over the internet or of electronic storage is completely secure. If a personal data breach affects you, we will tell you as described in section 18.

15. Children and learners under 18

15.1 Who is a child

Under the DPDP Act, a child is anyone who has not completed 18 years of age. We welcome younger learners, and we take extra care with their data.

15.2 Minimum age

The minimum age to enroll in an AwT Academy course is 10 years. We do not knowingly accept registrations for, or collect personal data from, children younger than 10.

15.3 Verifiable consent of a parent or guardian

Every learner under 18 needs the verifiable consent of a parent or lawful guardian, as section 9 of the DPDP Act and the DPDP Rules, 2025 require. When the date of birth entered on the registration form shows that the learner is under 18, the form asks the parent or guardian to provide:

• Their name and relationship to the learner;
• Their mobile number and, optionally, email address; and
• A consent declaration confirming that they are the learner's parent or legal guardian, that they consent to the registration and to the processing of the learner's personal data under this policy, and that they accept the Terms and Refund Policy on the learner's behalf.

To make sure the consent is genuine and that the person giving it is an identifiable adult, we may contact the parent or guardian on the details provided before the batch begins and ask them to confirm. If we cannot verify consent, we will not admit the learner and will refund the amount paid in line with our Refund & Cancellation Policy.

15.4 What we never do with children's data

• No tracking or behavioral monitoring of children.
• No targeted advertising directed at children.
• No processing that is likely to harm a child's well-being.
• No optional updates without the parent or guardian's agreement.

Recording attendance and assessing assignments and projects is part of teaching the course and issuing the certificate. It is not tracking or behavioral monitoring, and we use it for no other purpose. A parent or guardian may ask us about their child's attendance and progress.

15.5 Safety in live classes

We ask all learners not to share personal contact details in class chats, and our Terms & Conditions set a strict code of conduct with zero tolerance for harassment or abuse. Class links are personal and must not be shared.

15.6 Rights exercised by parents and guardians

A parent or guardian may exercise all the rights described in section 16 on behalf of a learner under 18, including withdrawing consent. Any refund for a learner under 18 is paid to the original payer.

15.7 If we learn of missing consent

If we discover that we have collected personal data of a child without verifiable parental consent, or of a child under 10, we will stop processing it and delete it promptly, except for any records we must keep by law. If you believe this has happened, please contact us.

15.8 When a learner turns 18

Once a learner turns 18, they may exercise their rights directly, and we will deal with them rather than their parent or guardian for future matters.

16. Your rights and how to exercise them

16.1 Your rights under the DPDP Act

1. Right to access information: to obtain a summary of the personal data we process about you and the processing activities we carry out, and the identities of other Data Fiduciaries and Data Processors with whom we have shared it, with a description of the data shared.
2. Right to correction, completion and updating: to have inaccurate or misleading data corrected, incomplete data completed and out-of-date data updated.
3. Right to erasure: to have personal data erased when it is no longer needed for the purpose for which it was collected, unless we must keep it to comply with law (for example, tax records).
4. Right to withdraw consent at any time (see section 17).
5. Right to grievance redressal: to have your complaint handled by our Grievance Officer, and then to approach the Data Protection Board of India (see section 21).
6. Right to nominate: to nominate another individual who may exercise your rights if you die or become unable to do so because of mental unsoundness or physical infirmity.

16.2 Additional rights for learners in the EU, EEA and UK

If the GDPR or UK GDPR applies to you, you also have the right to:

• Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organization where technically feasible;
• Restriction — ask us to limit how we use your data while a concern is being resolved;
• Objection — object to processing based on our legitimate interests and, at any time, to direct marketing;
• Obtain a copy of your personal data and information about how it is processed; and
• Complain to a supervisory authority — the data-protection authority in your country, or the Information Commissioner's Office in the UK.

16.3 How to make a request

1. Contact us

   Call our Grievance Officer on +91 62830 97869 or +91 94652 65663, or WhatsApp +91 62830 97869.

2. Tell us what you need

   Give your registered name, mobile and email, your Registration ID if you have one, and the right you want to exercise.

3. Verify your identity

   We confirm that the request comes from you, your parent or guardian, or your nominee before acting on it.

4. Receive our response

   We acknowledge within 48 hours and respond in full within 30 days, free of charge.

16.4 Identity verification

To protect your data from people pretending to be you, we may ask you to contact us from the mobile number, WhatsApp number or email address registered with us, and to confirm details such as your Registration ID or Razorpay payment ID. A parent or guardian may be asked to confirm their relationship to the learner; a nominee may be asked for proof of the nomination and of the circumstances in which they are acting. We ask only for what is needed to verify the request, and we never ask for OTPs, PINs or passwords.

16.5 Timelines and limits

• We acknowledge your request within 48 hours and respond within 30 days.
• Exercising your rights is free of charge. We may decline requests that are clearly unfounded, excessive or repetitive, and we will explain why.
• Some rights have legal limits — for example, we cannot erase records that tax law requires us to keep, or disclose data that would reveal another person's personal data. If we cannot fully meet your request, we will tell you the reasons and how to escalate.
• When we correct or erase data, we also ask the Data Processors that hold it on our behalf to do the same.

16.6 Your duties as a Data Principal

Section 15 of the DPDP Act also places duties on Data Principals. When you deal with us, please:

• Provide genuine, accurate information and do not impersonate another person;
• Not suppress any material information when providing your personal data;
• Not register a false or frivolous grievance or complaint; and
• Provide only verifiably authentic information when asking us to correct or erase data.

16.7 This notice in your language

As the DPDP Act allows, you may ask us for the contents of this notice in English or in any language specified in the Eighth Schedule to the Constitution of India.

17. Withdrawing your consent

17.1 How to withdraw

You may withdraw any consent you have given us at any time, and it is as easy to withdraw consent as it was to give it. Call us on +91 62830 97869 or +91 94652 65663, or WhatsApp +91 62830 97869. To stop optional updates only, use the simple opt-out options in section 10.

17.2 What happens next

• We stop processing your personal data for the purposes that relied on your consent within a reasonable time, and ask our Data Processors to do the same.
• Withdrawing consent does not affect processing that took place before you withdrew it.
• We will continue to keep data that the law requires us to keep, such as tax and financial records, for the periods in section 13.

17.3 Effect on your course

We need your contact and registration details to deliver live classes, assess your work and issue your certificate. Withdrawing consent to this processing may therefore mean that we can no longer continue your course. Withdrawing consent is handled like a cancellation under our Refund & Cancellation Policy, and any refund is decided under that policy's rules and time windows. Withdrawing consent for optional updates has no effect on your course.

17.4 Consent managers

The DPDP Act allows Data Principals to give, manage and withdraw consent through a registered Consent Manager. We do not currently use a Consent Manager; you can manage your consent directly with us. We will update this policy if this changes.

18. Personal data breaches

18.1 Our response

If we become aware of a personal data breach, we act immediately to contain it, investigate what happened, assess the risk to the people affected, take steps to limit any harm and prevent it happening again, and keep a record of the breach and our response.

18.2 Telling you

As the DPDP Rules, 2025 require, we will inform each affected person without delay, in clear and plain language, through WhatsApp, email or phone. We will explain:

• What happened, including the nature, extent, timing and location of the breach;
• The consequences it is likely to have for you;
• What we have done and are doing to reduce the risk;
• The safety measures you can take to protect yourself; and
• How to contact a person who can answer your questions.

18.3 Telling the authorities

• Data Protection Board of India: we will inform the Board without delay and provide a detailed report within 72 hours of becoming aware of the breach, or within any longer period the Board allows, as the DPDP Rules, 2025 require.
• CERT-In: we will report cyber-security incidents to CERT-In where its directions require.
• EU and UK learners: where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours where required, and tell you without undue delay if the breach is likely to result in a high risk to you.

18.4 Breaches at our providers

We rely on our service providers' commitments to tell us promptly about any breach affecting our data, so that we can inform you and the authorities.

18.5 If you suspect a breach

If you think your data or your class link has been misused, or you receive a suspicious message that appears to come from us, contact us straight away (see section 21).

19. Automated decisions and profiling

19.1 No significant automated decisions

We do not make decisions about you that produce legal or similarly significant effects — such as admission, assessment, certification, transfers or refunds — solely by automated means. People make these decisions.

19.2 Automated fraud and bot checks

The only automated checks in our Services are security and fraud-prevention checks:

• Cloudflare Turnstile automatically decides whether a form submission appears to come from a person or a bot.
• Razorpay and your bank run automated risk checks on payments and may decline a payment that looks fraudulent.

If one of these checks stops you from registering or paying, contact us on +91 62830 97869 or +91 94652 65663 and a member of our team will review the situation and help you.

19.3 Rule-based form checks

The registration form automatically checks that details such as your email address, mobile number and postal code are in a valid format, and uses your date of birth to apply the minimum age and to decide whether parent or guardian consent is required. If you believe one of these checks is wrong in your case, contact us and we will review it.

19.4 No profiling for marketing

We do not profile you to predict your behavior, interests or preferences for marketing or advertising.

20. Third-party websites and services

Our website contains links to, and features operated by, third parties — for example WhatsApp chat links, the Razorpay checkout window, the Cloudflare Turnstile check, and invitations to Google Meet, used for live classes.

• When you use these services, the third party processes your data under its own terms and privacy policy, and we are not responsible for its content or privacy practices.
• Links to other websites open in a new tab, and this policy no longer applies once you leave our website.
• Please read the privacy policies of the services you use, especially if you create an account with them.
• Check the address bar before entering any information, to make sure you are on the website you expect.

Logos and images shown on our website are served from our own domain, so viewing them does not send any information to the organizations they represent.

21. Grievance Officer and contact

21.1 Our Grievance Officer

For any question, request or complaint about this policy or your personal data, please contact our Grievance Officer:

21.2 What to include

To help us resolve your concern quickly, please include your name, registered mobile number and email, your Registration ID and Razorpay payment ID (if you have them), a clear description of your concern, and what you would like us to do.

21.3 Our timelines

• We acknowledge every grievance within 48 hours.
• We resolve grievances within 30 days of receiving them, as required by the Consumer Protection (E-Commerce) Rules, 2020, and respond to requests to exercise your data-protection rights within the same period.
• If we need more information, we will tell you promptly and explain what we need.

21.4 Escalation

• In India: if you are not satisfied with our response, after exhausting our grievance redressal process you may file a complaint with the Data Protection Board of India under the DPDP Act, using the means the Board provides.
• In the EU, EEA or UK: you may complain to your local data-protection supervisory authority or, in the UK, the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.

22. Changes to this policy

22.1 When we update it

We review this policy regularly and update it when our Services, providers or legal requirements change — for example, before offline classes open in Chandigarh, Mohali and Panchkula, or if we start using a new tool that processes personal data.

22.2 How we tell you

• The “Last updated” date at the top of this page always shows when the policy last changed.
• For significant changes, we will also notify enrolled learners by WhatsApp or email, where practicable before the change takes effect.
• If a change requires your fresh consent under the law, we will ask for it and will not apply the change to you until you give it.

22.3 Previous versions

The version of this policy published on our website applies from its effective date. Previous versions are available on request from our Grievance Officer.