Privacy Policy
What we collect, why we collect it, how long we keep it, and what you can make us do about it. Written to be read, not to be survived.
Last updated: Draft · not yet published
Who we are
[Registered entity name] (“CEFTA”, “we”, “us”) operates this website and the CEFTA programs described on it. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below.
Our registered address and grievance contact are at the end of this page.
What we collect
We collect only what we need to answer you and to run a cohort. Specifically:
- Enquiry data — name, email, phone or WhatsApp number, city, the stream and level you're interested in, and anything you choose to write in the message field.
- Enrolment data — the above, plus the learner's name and age or school grade, the institution where relevant, attendance, assessment outcomes and the work produced during a level.
- Guardian data — where the learner is under 18, the parent or guardian's name, contact details and consent record.
- Trainer applicant data — name, contact details, city, stream expertise, experience, portfolio or LinkedIn URL, and any CV you upload.
- Technical data — aggregate, non-identifying analytics about page visits (see Analytics and cookies below). We do not build advertising profiles.
What we do not collect
- We do not ask for identity documents, financial account details or biometric data through this website.
- We do not buy contact lists, and we do not enrich your record with data bought from anyone else.
- We do not track learners across other websites, and we run no third-party advertising pixels.
Why we collect it, and on what basis
We process personal data on the basis of your consent, given freely at the point you send us an enquiry, enrol, or apply to teach. Where a learner is under 18, that consent is given by a parent or guardian — see the Child Data & DPDP statement.
The purposes are limited to: replying to your enquiry; recommending and delivering a level; running and administering a cohort; issuing credentials for work completed; safety and supervision inside a lab; assessing a trainer application; and meeting our own legal and accounting obligations.
Data minimisation
We collect the smallest set of data that lets us do the thing you asked for. Optional fields are marked optional and staying silent on them costs you nothing. If a field stops being necessary, we stop collecting it and delete what we hold.
Who we share it with
We do not sell personal data. We do not rent it, trade it, or share it for anyone else's marketing. Ever.
- Service providers (Data Processors) — email delivery, hosting and analytics vendors, engaged under contract, permitted to process data only on our instructions. A current list is available on request.
- Partner institutions — where you enrolled through your school or college, we share attendance and completion for the learners they sponsored, and nothing more.
- Legal obligation — where we are required by law, court order or a lawful government request.
How long we keep it
Where a learner or guardian withdraws consent and we are not otherwise required to retain the record, we erase it and instruct our processors to do the same.
- Enquiries that don't convert — [12 months] from your last contact, then deleted.
- Learner records — for the duration of the relationship plus [3 years], so we can re-issue a credential or evidence what was completed.
- Trainer applications — [12 months], unless you ask us to keep you on file for longer.
- Accounting records — as long as Indian tax and company law requires, and no longer.
Your rights
Under the DPDP Act you may exercise the following rights, free of charge, by writing to our Grievance Officer below:
- Access — a summary of the personal data we hold about you and how it is processed.
- Correction and completion — have inaccurate or incomplete data fixed.
- Erasure — have your data deleted where we no longer need it for the purpose you gave it for.
- Withdraw consent — as easily as you gave it. Withdrawal doesn't undo processing already carried out lawfully.
- Grievance redressal — a substantive reply from us, and the right to escalate to the Data Protection Board of India if we fail you.
- Nominate — nominate another person to exercise these rights on your behalf in the event of death or incapacity.
Analytics and cookies
We use privacy-respecting, aggregate analytics to understand which pages are useful — how many people opened a syllabus, not who they were. We set no advertising cookies and run no cross-site tracking.
Analytics load only after you accept the notice shown on your first visit. Declining changes nothing about what the site does for you. We never run analytics profiling on users identified as minors.
Security
We apply reasonable security safeguards — encryption in transit, access control on a need-to-know basis, and vendor contracts requiring the same. No system is perfect; in the event of a personal data breach we will notify the Data Protection Board of India and every affected person, as the DPDP Act requires.
Children
A large part of who we teach is under 18. That is handled separately and in detail in our Child Data & DPDP statement, which forms part of this policy.
Changes to this policy
If we change this policy materially we will post the new version here with a fresh date, and — where the change affects how we use data you have already given us — we will tell you directly and, where required, ask for consent again.
Contact and grievances
Write to [Name], Grievance Officer / Data Protection Officer, at [email protected] or [Registered address], [City], [State], India. We respond within 30 days, as required by the DPDP Act.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
How to reach us about your data
[Name] · Grievance Officer / Data Protection Officer
[email protected]
[Registered address], [City], [State], India
We respond within 30 days, as required by the DPDP Act.