Privacy Policy

01 1. Legislative Mandate, Scope & Data Fiduciary Details

This Privacy Policy is formulated in strict accordance with the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, Republic of India), read alongside the Information Technology Act, 2000 (Section 43A) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

In accordance with Section 2(i) of the DPDP Act 2023, the Data Fiduciary responsible for determining the purpose and means of processing personal data is:

This policy applies to all Data Principals (students, candidates, parents/guardians, alumni, and website visitors) whose digital or digitized personal data is processed across our physical coaching/library campus, progressive web application (PWA), administrative database, and academic mentorship tools.

02 2. Taxonomy of Personal Data We Collect & Process

In accordance with the principle of Data Minimization, ABCD Coaching & Library collects strictly the data required to facilitate admissions, manage library desk allotments, process academic progress, and comply with statutory government verification directives.

03 3. Lawful Basis & Purposes of Data Processing (DPDP Act Sec. 4 & 5)

In compliance with Sections 4, 5, and 6 of the DPDP Act 2023, personal data is processed solely on the following lawful bases:

• Informed Consent (Section 6): Through affirmative action (checking the confirmation agreement on our Admission Form, Achievement Form, or Registration page), the Data Principal grants free, specific, informed, and unambiguous consent for processing their data.
• Legitimate Uses & Legal Compliance (Section 7): Maintenance of student admission registers and attendance logs required under local state administration directives and police safety circulars for private coaching and public library premises in Madhya Pradesh.
• Contractual Performance: Providing academic instruction, allocating dedicated library desks, tracking test series progress, and rendering Guidy mentorship support.

04 4. Google API Services User Data Policy Compliance

ABCD Smart Campus utilizes Google OAuth 2.0 to deliver seamless, secure, single-sign-on (SSO) authentication for students and faculty.

• Limited Scope Adherence: Our application requests strictly non-sensitive OAuth 2.0 scopes: openid, profile, and email. We do NOT request access to Google Drive, Gmail, Contacts, Google Calendar, or private storage.
• Limited Use Requirements: Our use and transfer of information received from Google APIs to any other app adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements.
• Google Data Storage: Google profile data (email, name, avatar image link) is used solely to establish and authenticate your student profile on abcdcampus.in and is never exported to external advertising tracking systems.

05 5. Processing of Personal Data of Children & Minors (DPDP Act Sec. 9)

Recognizing that young competitive aspirants under 18 years of age (minors) enroll in preparatory programs:

• Verifiable Parental Consent: Enrolling students under 18 years of age must provide verifiable parental or lawful guardian information during admission.
• Absolute Ban on Harmful Processing: ABCD Coaching & Library does not engage in tracking or behavioral monitoring of children, nor do we serve targeted advertisements directed towards minors.
• Safeguarding Well-Being: All student communication is educational and strictly focused on study schedule, exam notices, and test evaluations.

06 6. Technical & Organizational Data Security Protocols

In compliance with Section 8(5) of the DPDP Act 2023 and ISO/IEC 27001 reasonable security standards, ABCD implements defense-in-depth safeguards:

• Cryptographic TLS/SSL Transmission: All data exchanged between your device and our web servers is encrypted using Transport Layer Security (TLS 1.3 / 256-bit SSL) with HTTP Strict Transport Security (HSTS) enforced.
• Enterprise Database Architecture: Student databases are hosted on enterprise cloud PostgreSQL infrastructure with automated connection security, network firewalls, and role-based privilege isolation.
• Zero-Knowledge Password Security: User passwords are cryptographically hashed using PBKDF2 with SHA-256 / Argon2 one-way algorithms; clear-text passwords are never stored or visible to administrators.
• Web Application Armor: Strict Content-Security-Policy (CSP), anti-clickjacking headers (X-Frame-Options: SAMEORIGIN), cross-site scripting (XSS) filters, and cryptographic CSRF verification tokens are active on all forms.
• Continuous Security Auditing: Application code undergoes automated dependency and vulnerability scanning (Snyk Code & Security Audit) prior to production deployment.

07 7. Data Retention, Archival & Erasure Policy

In accordance with Section 8(7) of the DPDP Act 2023:

• Active Course Period: Student information is retained during active coaching enrollment or library membership to facilitate daily desk allocation and performance tracking.
• Self-Service Account Deletion: Data Principals may permanently delete their account directly via their Profile page. Personal identity details, profile photos, and communication records are deleted immediately upon confirmation. Associated usernames and email addresses enter a 7-day security quarantine before becoming eligible for re-registration. Certain financial or accounting records may be retained where required by applicable law or legitimate record-keeping obligations.
• Safe Erasure & Archival: Upon expiration of the retention purpose or upon receipt of a valid erasure request from the Data Principal, digital records are purged or anonymized, and physical copies are shredded under administrative supervision. Certain financial or accounting records may be retained where required by applicable law or legitimate record-keeping obligations.

08 8. Statutory Rights of Data Principals (DPDP Act Sec. 11–14)

Under Chapter III of the Digital Personal Data Protection Act, 2023, you are endowed with the following statutory rights:

• Right to Access Information (Section 11): You have the right to obtain a summary of your personal data being processed, identity of third parties (such as cloud hosting) with whom data is shared, and any other relevant processing details.
• Right to Correction & Erasure (Section 12): You have the right to request correction of inaccurate data, completion of incomplete information, and permanent erasure of personal data that is no longer necessary for the original admission purpose.
• Right of Grievance Redressal (Section 13): You have the right to readily accessible grievance redressal provided by our Data Protection Officer.
• Right to Nominate (Section 14): You have the right to nominate any other individual who, in the event of your death or incapacity, shall exercise your rights as a Data Principal.
• Right to Withdraw Consent: You may withdraw your consent at any time by contacting our administration desk. Withdrawal of consent does not affect the lawfulness of processing undertaken prior to such withdrawal.

09 9. Data Breach Notification & CERT-In Protocol

In strict accordance with Section 8(6) of the DPDP Act 2023 and the directives of the Indian Computer Emergency Response Team (CERT-In):

• In the unlikely event of any personal data breach or unauthorized system compromise, ABCD Coaching & Library will notify the Data Protection Board of India (DPBI), CERT-In, and impacted Data Principals in the prescribed form and manner without undue delay.
• The notification will outline the nature of the incident, affected data categories, immediate remediation measures deployed, and recommendations for Data Principals to safeguard their accounts.

10 10. Data Protection & Grievance Redressal Officer

In compliance with Section 13 of the DPDP Act 2023 and Rule 5(9) of the Information Technology SPDI Rules 2011, the designated Data Protection & Grievance Redressal Officer for ABCD Coaching & Library is: