Privacy Policy

Who We Are

PRAJNANAM E-Pathsala ("PRAJNANAM," "we," "us," or "our") is an educational coaching institute, offering classroom coaching for students of Class 10 and Class 12 (Arts stream), with online admission and fee payment facilities.

This Privacy Policy explains how we collect, use, store, share, and protect information about you when you visit our website, create a student account, or enroll in our courses. It applies to all users of our website and services.

By using our website or enrolling in a course, you acknowledge that you have read and understood this Privacy Policy. This policy is governed by the Digital Personal Data Protection Act, 2023 (India) and other applicable Indian laws.

Information We Collect

A. Information You Provide Directly

• Identity data: Full name
• Contact data: Email address, mobile phone number
• Academic data: Class and subjects chosen at enrollment
• Account credentials: Password (stored as a one-way cryptographic hash — never in plain text)
• Payment data: Transaction reference numbers, payment method type, amount, and status — we do not store raw card numbers, CVVs, or full bank account details
• Reviews: Rating and review text you voluntarily submit about our services
• Communication data: Messages or queries you send us via email or the website contact

B. Information Collected Automatically When You Use Our Website

• Usage data: Pages visited, time spent on page
• Device & browser data: Browser type and version, operating system, device type (mobile/desktop/tablet)
• Network data: IP address, approximate location (city/region derived from IP — not GPS), access timestamps
• Session data: Login session tokens used to keep you signed in securely

How We Use Your Information

We will never sell or rent your personal data to third parties for their own marketing or commercial purposes.

Payment Data & Razorpay

When you pay fees on our platform, the transaction is processed entirely by Razorpay Payments Private Limited, which is certified under PCI-DSS and compliant with Reserve Bank of India (RBI) guidelines for payment aggregators in India. By making a payment, you also agree to Razorpay's Privacy Policy.

What we store after a payment is completed:

• Razorpay Payment ID and Order ID (for reference and reconciliation)
• Amount paid, date, and course enrolled
• Payment status (Active / Inactive / Pending / Failed)
• Your name, phone, and email linked to the enrollment record

Failed transactions: If your payment fails but your bank account was debited, please contact us at the email below within 48 hours of the transaction. We will coordinate with Razorpay to resolve the issue. Refunds for failed transactions are processed within 5–10 working days back to the original payment source.

Cookies & Session Data

Our website uses server-side sessions and browser cookies to maintain your login state and enable core functionality. We do not use third-party advertising cookies or cross-site tracking cookies.

You can control cookies through your browser settings. Disabling essential session cookies will prevent you from logging in or completing payment.

Data Sharing & Third Parties

We do not sell or rent your personal data. We share your information only as strictly necessary with the following categories of recipients:

• Razorpay (Payment Processing): To process your course fee payments securely. Only the minimum data required for payment is shared (name, email, phone, amount).
• Google (Email & Font Services): We use Gmail to send OTPs, enrollment confirmations, and receipts. Google Fonts are loaded from Google's CDN.
• ip-api.com (Location Lookup): Your IP address is sent to ip-api.com at login time to resolve an approximate location (city/region) for security monitoring purposes. No personally identifying information beyond IP is shared.
• Hosting Provider: Our web server and database are hosted on a secure server. The hosting provider has access to server infrastructure but is contractually bound not to access application data.
• Legal Authorities: If required by law, court order, or lawful government authority under applicable Indian law (including the IT Act, 2000, and DPDPA, 2023).
• Professional Advisors: Lawyers or accountants, bound by confidentiality obligations, if required.

All third-party service providers we engage are required to protect your data and may use it solely for the specific purpose we have engaged them for.

Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy, including:

• Active accounts: Your data is retained for as long as your student account is active
• Enrollment records: Retained for a minimum of 7 years after the last enrollment, as required for financial and tax record-keeping under Indian law
• Payment records: Retained for 7 years in line with GST and income tax compliance requirements
• Reviews: Retained until you delete them or your account is permanently removed. If you delete your account, your review text and a snapshot of your name/email at submission time is retained for the integrity of our public review record — your account login credentials are fully removed
• Login session logs: The last 5 login sessions per account are stored for security monitoring. Older sessions are automatically purged

When you delete your account through the student portal, your email, phone number, and password are immediately and permanently cleared. If you have an active enrollment, your enrollment record is preserved (with your credentials anonymized) for legal compliance, but your login access is revoked.

Your Rights Under the DPDPA, 2023

Under India's Digital Personal Data Protection Act, 2023, and as a user of PRAJNANAM E-Pathsala, you have the following rights with respect to your personal data:

• Right to Access: Request information about the personal data we hold about you and how it is being used
• Right to Correction: Request correction of inaccurate or incomplete personal data. You can update your name, email, and phone directly from your student portal; for enrollment records, contact us
• Right to Erasure: Request deletion of your personal data. You can self-delete your account via the student portal. For data retained for legal purposes (payment records), we will explain what we are required to retain
• Right to Withdraw Consent: Withdraw consent for optional data processing (such as promotional communications) at any time, without affecting the lawfulness of processing already carried out
• Right to Grievance Redressal: File a complaint with our Grievance Officer (see Section 12) or with the Data Protection Board of India once it is operational
• Right to Nominee: In the event of your death or incapacity, a nominated individual may exercise your data rights on your behalf, as provided under the DPDPA

To exercise any of these rights, email us at the address in Section 12 with the subject line "Data Privacy Request – [Your Name]." We will acknowledge your request within 72 hours and respond substantively within 30 days.

Children's Privacy

Our services are intended for students of Class 10 and Class 12, many of whom are under 18 years of age. We take the privacy of minors seriously and comply with the provisions of the DPDPA, 2023, applicable to children's data:

• For students under 18, the enrollment process requires a parent or guardian to provide consent. By submitting enrollment details on behalf of a minor, the parent/guardian confirms they have provided such consent
• We do not display advertising of any kind to users on our student portal or dashboard
• We do not knowingly share personal data of students (including minors) with third parties for marketing purposes
• Parents or guardians may contact us at any time to access, correct, or request deletion of their child's data

If we become aware that we have collected data from a minor without appropriate parental consent, we will promptly delete such data.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

• HTTPS encryption for all data transmitted between your browser and our servers
• Password hashing: All passwords are stored using bcrypt with salt rounds — never in plain text, and never reversible
• Rate limiting: Login, OTP, registration, and recovery endpoints are rate-limited to prevent attacks
• Access controls: Student data is accessible only to the authenticated student and authorized admin staff
• Payment security: All payment processing is handled by Razorpay (PCI-DSS Level 1 certified). Payment signatures are cryptographically verified server-side using HMAC-SHA256 before any enrollment is confirmed

No method of transmission over the internet is 100% secure. In the unlikely event of a data breach that may affect your rights, we will notify affected users and report to relevant authorities as required by applicable law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. When we make changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered users via email if the changes are material (i.e., they significantly affect how your data is processed)
• Post a prominent notice on our website for at least 7 days

Your continued use of our services after the updated policy takes effect constitutes your acceptance of the revised terms. If you do not agree with the changes, you may request deletion of your account.

Contact & Grievance Officer