Privacy Policy & Consent Notice

1. Verifiable Parental/Guardian Consent

Under Section 9 of the DPDP Act 2023, processing the personal data of a child (any individual under 18 years of age) requires the verifiable consent of their parent or lawful guardian.

2. Personal Data We Collect

We collect only the minimum necessary personal data required to manage classes, track academic progress, and bill for services.

3. How & Why We Use (Process) Your Data

We process your personal data under the lawful basis of Consent and Legitimate Use for the following purposes:

1. Academic Tracking: Logging attendance, managing tests, recording exam marks, and mapping performance.
2. Tuition Administration: Placing students into classes/batches, tracking enrollment, and sharing study materials.
3. Parent Communication: Sending progress reports, attendance notifications, and fee reminders via WhatsApp or SMS.
4. Billing & Invoicing: Tracking due fees, processing payments, and issuing PDF receipts.
5. Platform Security: Blocking brute-force hacking, logging out suspicious device changes, and limiting admin access to whitelisted IP addresses.
6. Alumni Records: Retaining basic enrollment details (name, batch, and milestones) to maintain an alumni registry and verify credentials when requested.

4. Children's Data Protection Standards

We strictly comply with DPDP Act constraints regarding children’s data protection:

• No Behavioral Tracking: We do not track, monitor, or profile the online behavior of children.
• No Targeted Advertisements: We do not run ads or share children's data with ad networks.
• No Detrimental Processing: We do not process child data in any manner likely to cause harm or negative effects to their well-being.

5. Data Security & Storage

We implement high-standard physical, technical, and administrative safeguards to protect your personal data:

• Device Authentication: Restricting logins to authorized sessions and ending sessions on device signature (User-Agent fingerprint) changes.
• Intrusion Prevention: Rate-limiting login attempts and locking accounts after 5 failures.
• Database Isolation: Restricting database access strictly to authorized administrators.
• Encryption: Encrypting all data in transit using SSL/TLS (HTTPS).
• Secure Cloud Storage: Storing profile photos and uploaded study resources securely on Supabase S3 cloud storage using segregated folders and access-control policies.

6. Data Retention & Alumni Policy

• Active Students: Data is maintained throughout the student's active enrollment at Ambition Tuition.
• Alumni Registry: Upon graduation/withdrawal, student accounts are deactivated. However, we retain a limited archive containing name, batch, standard, and final academic record for historical registry and credential verification.
• Right to Erasure for Alumni: Parents or graduated students (who have reached age 18) can request the complete deletion of their alumni records at any time.
• Financial Records: Financial ledger data (invoices, transaction logs) is retained for 7 years as required under Indian tax and accounting regulations.

7. Your Legal Rights (Data Principal Rights)

Under the DPDP Act 2023, parents and guardians have the following rights, which can be exercised via the dashboard or by contacting the Grievance Officer:

• Right to Access & Review: View a summary of all collected data, marks, attendance, and ledgers in real-time through the student/parent dashboard.
• Right to Correction & Update: Request edits to inaccurate or outdated personal data (e.g., updating contact numbers).
• Right to Deletion (Erasure): Request deletion of personal data when your child leaves the tuition center, subject to tax audit retention laws.
• Right to Withdraw Consent: Withdraw consent for data processing at any time. Note: This will result in account closure and termination of enrollment as we cannot administer classes without these basic records.