GDPR Notice - Eduplore

1.1. This GDPR Notice (this "Notice") explains how Eduplore collects, uses, stores, shares, and protects personal data, and explains the rights that individuals in the European Economic Area ("EEA") and the United Kingdom ("UK") have under the General Data Protection Regulation (EU) 2016/679 ("EU GDPR") and the UK General Data Protection Regulation ("UK GDPR"), together referred to in this Notice as "GDPR".

1.2. Eduplore is an Indian learning management system and mobile learning application for students in Classes 8, 9 and 10 in Karnataka, India, available on the Google Play Store (https://play.google.com/store/apps/details?id=com.eduplore.app) and through the website eduplore.in (together, the "Platform"). Eduplore provides video courses, interactive three-dimensional STEM laboratories (including the Human Body 3D Atlas, Heart and ECG Lab, Cell Lab, Periodic Table Lab, Molecular Lab, Chemistry Lab, Universe Lab, Solar System Lab, Space Lab, Physics Lab and Vector Calculus Lab), quizzes and assessments, progress analytics, study materials, and related learning features in Kannada and English.

1.3. Although Eduplore is based in India and its primary users are in India, this Notice applies to any person who uses the Platform from the EEA or the UK, and to any processing of personal data that falls within the territorial scope of the EU GDPR or the UK GDPR. This includes, for example, a student or a teacher who uses the Platform while visiting or living in the EEA or the UK, and a parent who contacts Eduplore from the EEA or the UK about their child's account.

1.4. This Notice should be read together with the Eduplore Privacy Policy, which explains how Eduplore processes personal data under Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Where there is a difference between the Privacy Policy and this Notice, this Notice will apply to the processing of personal data that is subject to the GDPR.

1.5. This Notice is written for a general audience, including school students, their parents, teachers, and school administrators. Where a legal term is used, this Notice explains it in plain language. This Notice is not legal advice, and it does not create a lawyer-client relationship between Eduplore and any reader. A person who needs advice about their own rights should consult a qualified lawyer or contact their supervisory authority.

1.6. Eduplore may update this Notice from time to time. The current version will always be available on eduplore.in and inside the app. Material changes will be notified as described in Section 17 of this Notice. Continued use of the Platform after a change takes effect means the user accepts the updated Notice.

2.1. For the purposes of this Notice, the following definitions apply, based on the definitions in Article 4 of the EU GDPR and the UK GDPR:

(a) "Personal data" means any information relating to an identified or identifiable natural person, such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

(b) "Special category data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health, or data concerning a person's sex life or sexual orientation. Eduplore does not intentionally collect special category data, except for health-related information that a user voluntarily provides in a learning context, as described in Section 5.

(c) "Processing" means any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

(d) "Data subject" means the identified or identifiable natural person to whom personal data relates. In this Notice, data subjects include students, parents, teachers, school administrators, and visitors to the Platform.

(e) "Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data. Eduplore is the controller for most processing described in this Notice, as explained in Section 3.

(f) "Processor" means a natural or legal person which processes personal data on behalf of the controller, such as a hosting provider, a payment processor, or an analytics provider.

(g) "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

(h) "Child" means, for the purposes of this Notice and the GDPR, a person under the age of eighteen years, and for the purposes of Article 8 of the EU GDPR, a person below the age of digital consent set by the relevant Member State, which ranges from thirteen to sixteen years depending on the Member State.

(i) "Supervisory authority" means an independent public authority established by a Member State or by the UK to monitor the application of the GDPR, such as the Information Commissioner's Office ("ICO") in the UK.

(j) "Data Protection Officer" or "DPO" means the person designated by Eduplore to advise on data protection obligations, to monitor compliance, and to act as a contact point for data subjects and supervisory authorities.

(k) "Personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

(l) "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a person, in particular to analyse or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

(m) "Third country" means a country outside the EEA, and, for the purposes of the UK GDPR, a country outside the UK.

(n) "School" means a government school or a private school that has an account, a subscription, or an institutional arrangement with Eduplore.

(o) "Account" means a registered user account on the Platform, including a student account, a parent account, a teacher account, and a school administrator account.

3.1. Eduplore is the data controller for the personal data it collects and processes through the Platform, including account information, learning activity, quiz and assessment results, progress analytics, and communications with users. Eduplore determines the purposes and means of that processing, as described in Section 6 of this Notice.

3.2. Where a school uses Eduplore to provide learning services to its students, Eduplore and the school may each be a controller for different aspects of the processing. For example, the school is the controller for decisions about which students are enrolled, which courses they are assigned, and how the school uses progress data for its own educational purposes, while Eduplore is the controller for the operation of the Platform, the storage of the data, and the provision of the learning services. Where Eduplore and a school are joint controllers for any processing, the arrangement between them will set out their respective responsibilities, and data subjects may exercise their rights against either of them.

3.3. Where Eduplore processes personal data on behalf of a school under a written agreement, and the school determines the purposes and means of that processing, Eduplore acts as a processor for that processing, and the school acts as the controller. In that case, data subjects should contact the school in the first instance, and Eduplore will assist the school in responding to the request, as required by Article 28 of the GDPR.

3.4. Eduplore's third-party service providers, including hosting providers, content delivery networks, payment processors, and analytics providers, act as processors on Eduplore's behalf, under written contracts that require them to process personal data only on Eduplore's instructions, to keep it confidential, and to apply appropriate security measures, as described in Section 13.

3.5. The identity and contact details of Eduplore as controller are set out in Section 21 of this Notice. Data subjects may contact Eduplore through the contact details published in Section 21 and on eduplore.in.

3.6. Eduplore has appointed a Data Protection Officer, Revant (revanth@eduplore.in), whose full details are set out in Section 21 of this Notice. The DPO can be contacted about any matter relating to the processing of personal data and the exercise of data subject rights under the GDPR.

4.1. This Notice applies to the processing of personal data of data subjects who are in the EEA or the UK, where the processing is carried out in the context of the activities of an establishment of Eduplore in the EEA or the UK, or where Eduplore offers goods or services to data subjects in the EEA or the UK, or monitors their behaviour in the EEA or the UK, within the meaning of Article 3 of the EU GDPR and Article 3 of the UK GDPR.

4.2. Eduplore's primary market is India, and Eduplore does not specifically target users in the EEA or the UK through advertising or through localised services in EEA or UK languages other than English. However, the Platform is available worldwide through the Google Play Store and the website, and Eduplore recognises that persons in the EEA or the UK may access and use it. This Notice therefore explains the GDPR rights that apply to those users.

4.3. Where a data subject in the EEA or the UK uses the Platform, Eduplore will apply the protections described in this Notice to their personal data, including the lawful bases in Section 7, the rights in Section 9, the transfer safeguards in Section 14, and the security measures in Section 15.

4.4. This Notice does not apply to the processing of personal data of persons who are not in the EEA or the UK, or to processing that falls outside the scope of the GDPR. That processing is governed by the Privacy Policy and by Indian law, including the DPDP Act. However, Eduplore applies the same high standards of care to all personal data, regardless of where the data subject is located, and many of the protections described in this Notice, such as data minimisation, security, and retention limits, are applied by Eduplore to all users.

5.1. Eduplore collects personal data in the following categories. Eduplore collects only the personal data that is necessary for the purposes described in Section 6, and does not collect personal data that it does not need.

5.2. Identity and contact data. This includes the full name of the student, the parent or legal guardian, the teacher, or the school administrator; the email address; the telephone number; the date of birth or age of the student, where required to verify that the student is in the correct class and to apply the children's data protections in Section 12; and the name of the school and the class in which the student is enrolled.

5.3. Account data. This includes the username, the account type (student, parent, teacher, or school administrator), the password in encrypted form, the profile picture if the user chooses to upload one, the preferred language (Kannada or English), and the account settings and preferences chosen by the user.

5.4. Learning and assessment data. This includes the courses in which the student is enrolled; the video lessons watched and the progress made in each lesson; the use of three-dimensional laboratories, including which laboratories were used, how long they were used, and which models and simulations were explored; quiz and assessment attempts, scores, answers, and feedback; homework submissions; and any notes or annotations the student creates within the Platform.

5.5. Progress analytics data. This includes aggregated and individual analytics derived from learning activity, such as completion rates, time spent on each topic, strengths and areas for improvement, and trends over time. These analytics are used to provide feedback to the student, to the parent, to the teacher, and to the school, and to improve the Platform.

5.6. Payment and subscription data. This includes information about the subscription plan, the date of purchase, the renewal date, and the payment status. Payment card details are processed by Eduplore's payment service provider and are not stored by Eduplore. Eduplore receives only limited information from the payment provider, such as a transaction reference, the payment method type, and the payment status.

5.7. Communications data. This includes the content of messages, emails, and other communications between the user and Eduplore, including support requests, feedback, complaints, and correspondence about an account, a subscription, or a data protection request.

5.8. Technical and usage data. This includes the internet protocol address, the device type, the operating system, the browser type, the app version, the device identifiers, the time and date of access, the pages and features used, and the log data generated by the Platform. This data is used for security, for troubleshooting, and for improving the Platform.

5.10. Health-related data. Eduplore does not ask users to provide health information. However, a user may voluntarily provide health-related information in a learning context, for example where a student explores the Human Body 3D Atlas or the Heart and ECG Lab and enters a heart rate for an exercise, or where a parent informs Eduplore of a medical condition that affects the child's learning. Where Eduplore processes such information, it will do so only with the explicit consent of the data subject, or of the parent or legal guardian where the data subject is a Child, and only for the purpose for which it was provided.

6.1. Eduplore processes personal data only for the specific, explicit, and legitimate purposes described in this Section 6, and does not process personal data in a manner that is incompatible with those purposes.

6.2. Providing the learning services. Eduplore processes identity data, account data, learning data, and progress analytics data to create and manage accounts, to enrol students in courses, to deliver video lessons and three-dimensional laboratory sessions, to administer quizzes and assessments, to provide feedback, and to track progress. Without this processing, Eduplore could not provide the Platform.

6.3. Personalising the learning experience. Eduplore processes learning data and progress analytics data to personalise the content shown to a student, such as recommending the next lesson, suggesting a laboratory exercise, or highlighting a topic that needs further practice. Personalisation is based on the student's own activity on the Platform and is not based on data obtained from other sources.

6.4. Communicating with users. Eduplore processes identity data, contact data, and communications data to send service messages, such as account confirmations, password reset instructions, subscription reminders, and notifications about new courses or features; to respond to support requests and enquiries; and to send information about the Platform that the user has requested.

6.5. Managing subscriptions and payments. Eduplore processes identity data, contact data, and payment data to process in-app purchases and subscriptions, to manage renewals and cancellations, to issue receipts, and to handle refunds and billing enquiries.

6.6. Providing progress reports to parents, teachers, and schools. Eduplore processes learning data and progress analytics data to generate reports for the parent or legal guardian of a student, for the student's teacher, and for the student's school, so that they can support the student's learning. A parent can see only the progress of their own child. A teacher can see only the progress of the students in their classes. A school can see only the progress of its own students.

6.7. Improving the Platform. Eduplore processes technical data, usage data, and anonymised learning data to understand how the Platform is used, to identify errors and areas for improvement, to test new features, and to develop new courses and laboratories. Where Eduplore uses personal data for this purpose, it will anonymise or pseudonymise the data wherever possible.

6.8. Ensuring security and preventing abuse. Eduplore processes technical data, usage data, and account data to protect the Platform from unauthorised access, fraud, and misuse; to detect and investigate suspected breaches of the Terms of Use, including copyright infringement; and to enforce Eduplore's legal rights.

6.9. Complying with legal obligations. Eduplore processes personal data where it is necessary to comply with a legal obligation, such as responding to a lawful request from a court or a competent authority, complying with tax and accounting obligations, and complying with the requirements of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

7.1. Under Article 6 of the GDPR, Eduplore must have a lawful basis for each processing activity. The table in this Section 7 sets out the lawful basis for each purpose described in Section 6. A single processing activity may have more than one lawful basis, and Eduplore will rely on the most appropriate basis for the circumstances.

7.2. Performance of a contract. Eduplore relies on Article 6(1)(b) of the GDPR, performance of a contract, for processing that is necessary to provide the learning services under the Terms of Use and, where applicable, under a school agreement. This includes creating and managing accounts, delivering video courses and three-dimensional laboratories, administering quizzes and assessments, and providing progress analytics. If a user does not provide the personal data necessary for the contract, Eduplore may not be able to provide the service.

7.3. Consent. Eduplore relies on Article 6(1)(a) of the GDPR, consent, for processing that is not necessary for the contract but for which the data subject has given consent. This includes sending marketing communications about new courses and features, where the user has opted in; processing health-related information that a user voluntarily provides in a learning context; and processing the personal data of a Child, where consent is given by the parent or legal guardian, as described in Section 12. A data subject may withdraw consent at any time, as described in Section 9.8, and the withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

7.4. Legal obligation. Eduplore relies on Article 6(1)(c) of the GDPR, compliance with a legal obligation, for processing that is necessary to comply with Indian law or with the law of the EEA or the UK, including tax and accounting obligations, responding to lawful requests from courts and competent authorities, and complying with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

7.5. Legitimate interests. Eduplore relies on Article 6(1)(f) of the GDPR, legitimate interests, for processing that is necessary for Eduplore's legitimate interests or for the legitimate interests of a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject. Eduplore's legitimate interests include improving the Platform, ensuring its security, preventing fraud and abuse, handling complaints, and conducting internal administration. Eduplore carries out a legitimate interests assessment before relying on this basis, and will provide a copy of that assessment on request, subject to the redaction of confidential information.

7.8. Special category data. Where Eduplore processes special category data, it relies on an additional condition in Article 9 of the GDPR, in addition to a lawful basis under Article 6. For health-related information that a user voluntarily provides, Eduplore relies on Article 9(2)(a), explicit consent. Eduplore does not process other special category data, and will not do so without identifying and documenting the applicable Article 9 condition.

7.9. Children's data. Where Eduplore processes the personal data of a Child, it relies on the consent of the parent or legal guardian, as described in Section 12, and on the lawful bases described in this Section 7, as applicable to the processing in question. Eduplore takes particular care when relying on legitimate interests for the processing of children's data, and will not rely on legitimate interests where the child's interests override those of Eduplore.

8.1. Eduplore collects personal data from the following sources:

(a) Directly from the data subject, when the data subject creates an account, enrols in a course, completes a quiz or assessment, uses a three-dimensional laboratory, contacts Eduplore, or provides feedback.

(b) From the parent or legal guardian of a Child, when the parent or legal guardian creates an account for the Child, provides the Child's details, or gives consent for the processing of the Child's personal data.

(c) From a teacher or a school administrator, when the teacher or school administrator enrols a student, assigns a course, or provides the student's details under a school arrangement with Eduplore.

(d) From a school, when the school provides a list of students, teachers, and classes for the purpose of setting up institutional accounts.

(e) Automatically from the Platform, when the data subject uses the Platform, including technical data, usage data, and learning activity data generated by the use of the Platform.

(f) From third-party service providers, such as the payment service provider, which provides Eduplore with limited payment information, and the Google Play Store, which provides Eduplore with limited information about downloads and subscriptions.

9.1. Under the GDPR, data subjects have the rights described in this Section 9. These rights apply to personal data processed by Eduplore that is subject to the GDPR. Eduplore will respond to a request to exercise any of these rights in accordance with Section 10 of this Notice.

9.2. Right of access. Under Article 15 of the GDPR, a data subject has the right to obtain confirmation from Eduplore as to whether personal data concerning them is being processed, and, where it is, to obtain access to that personal data and to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data has been or will be disclosed; the envisaged period for which the personal data will be stored, or the criteria used to determine that period; the existence of the rights described in this Section 9; the right to lodge a complaint with a supervisory authority; the source of the personal data, where it was not collected from the data subject; and the existence of automated decision-making, including profiling, and meaningful information about the logic involved and the significance and envisaged consequences of such processing. Eduplore will provide a copy of the personal data undergoing processing, in a commonly used electronic format, free of charge for the first copy.

9.3. Right to rectification. Under Article 16 of the GDPR, a data subject has the right to obtain from Eduplore, without undue delay, the rectification of inaccurate personal data concerning them, and the right to have incomplete personal data completed, including by means of providing a supplementary statement. A data subject may correct their own account details, such as their name, email address, and preferred language, directly through the account settings on the Platform, or may request a correction by contacting Eduplore.

9.4. Right to erasure. Under Article 17 of the GDPR, a data subject has the right to obtain from Eduplore the erasure of personal data concerning them without undue delay, where one of the following grounds applies: the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing; the data subject objects to the processing under Article 21 and there are no overriding legitimate grounds for the processing; the personal data has been unlawfully processed; the personal data has to be erased for compliance with a legal obligation; or the personal data has been collected in relation to the offer of information society services to a Child. Eduplore will erase the personal data, and will inform any processor or recipient to whom the data has been disclosed, unless erasure is not required because an exception in Article 17(3) applies, such as where the processing is necessary for compliance with a legal obligation, or for the establishment, exercise, or defence of legal claims.

9.5. Right to restriction of processing. Under Article 18 of the GDPR, a data subject has the right to obtain from Eduplore restriction of processing where one of the following applies: the accuracy of the personal data is contested by the data subject, for a period enabling Eduplore to verify the accuracy; the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; Eduplore no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise, or defence of legal claims; or the data subject has objected to processing under Article 21, pending the verification of whether Eduplore's legitimate grounds override those of the data subject. Where processing has been restricted, Eduplore will process the personal data only with the data subject's consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another person, or for reasons of important public interest.

9.6. Right to data portability. Under Article 20 of the GDPR, a data subject has the right to receive the personal data concerning them, which they have provided to Eduplore, in a structured, commonly used, and machine-readable format, and has the right to transmit that data to another controller without hindrance from Eduplore, where the processing is based on consent or on a contract, and the processing is carried out by automated means. The right to data portability applies to data that the data subject has provided to Eduplore, such as account details, learning activity, and quiz results, and does not apply to data that Eduplore has derived or inferred, such as analytics or scores calculated by Eduplore. Where technically feasible, Eduplore will transmit the personal data directly to another controller at the data subject's request.

9.7. Right to object. Under Article 21 of the GDPR, a data subject has the right to object, on grounds relating to their particular situation, at any time, to processing of personal data concerning them which is based on Article 6(1)(e) or Article 6(1)(f), including profiling based on those provisions. Eduplore will no longer process the personal data unless Eduplore demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defence of legal claims. A data subject also has the right to object at any time to processing of personal data for direct marketing purposes, including profiling to the extent that it is related to direct marketing, and Eduplore will stop processing the personal data for direct marketing on receipt of such an objection, without the need for the data subject to give a reason.

9.8. Right to withdraw consent. Where processing is based on consent, a data subject has the right to withdraw that consent at any time, by contacting Eduplore or by using the relevant setting on the Platform. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. Where consent is withdrawn, Eduplore will stop the processing that relied on that consent, and will erase the personal data where no other lawful basis applies, subject to Section 9.4.

9.9. Rights in relation to automated decision-making and profiling. Under Article 22 of the GDPR, a data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract, is authorised by law, or is based on the data subject's explicit consent. Eduplore does not make decisions about students based solely on automated processing that produce legal effects or that similarly significantly affect them. Progress analytics and recommendations are provided to support learning, and are not used to make decisions about a student's enrolment, grades, or access to the Platform without human involvement. A teacher or a school administrator always makes decisions about a student's education, and Eduplore's analytics are only one input to those decisions.

9.10. Right to lodge a complaint. A data subject has the right to lodge a complaint with a supervisory authority, as described in Section 18 of this Notice, if the data subject considers that the processing of personal data relating to them infringes the GDPR. A data subject may lodge a complaint with the supervisory authority in the Member State of their habitual residence, their place of work, or the place of the alleged infringement, or, in the UK, with the Information Commissioner's Office.

10.1. A data subject may exercise any of the rights described in Section 9 by contacting Eduplore's Data Protection Officer, Revant (revanth@eduplore.in), using the contact details in Section 21, or by contacting Eduplore through the general privacy contact email (venkatesh@eduplore.in). A data subject may also exercise certain rights directly through the Platform, such as correcting account details through the account settings, and withdrawing consent for marketing communications through the relevant setting.

10.2. A request should include the following information, so that Eduplore can identify the data subject and process the request promptly:

(a) The full name of the data subject, and, where the request is made on behalf of a Child, the full name of the Child and of the parent or legal guardian making the request.

(b) The email address or other contact details associated with the account.

(c) A clear description of the right that the data subject wishes to exercise, and of the personal data to which the request relates.

(d) Any additional information that may help Eduplore to locate the personal data, such as the account username, the school name, and the class.

(e) Where the request is made by an authorised representative, evidence of that authority, such as a power of attorney or a written authorisation signed by the data subject.

10.3. Eduplore will acknowledge receipt of a request within a reasonable time, and will respond to the request without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months where necessary, taking into account the complexity and the number of requests. Eduplore will inform the data subject of any extension within one month of receipt of the request, together with the reasons for the delay.

10.4. Eduplore will provide information in response to a request free of charge, unless the request is manifestly unfounded or excessive, in particular because of its repetitive character. Where a request is manifestly unfounded or excessive, Eduplore may charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or may refuse to act on the request. Eduplore will inform the data subject of the reasons for the fee or for the refusal, and of the data subject's right to lodge a complaint with a supervisory authority.

10.5. Where Eduplore has reasonable doubts concerning the identity of the person making a request, Eduplore may request additional information necessary to confirm the identity of that person. Eduplore will not disclose personal data to a person who cannot be identified as the data subject or as a person authorised to act on the data subject's behalf.

10.6. Where a request is made on behalf of a Child, Eduplore will verify that the person making the request is the Child's parent or legal guardian, or is otherwise authorised to act on the Child's behalf, before disclosing the Child's personal data or taking action on the request. A Child who is old enough to understand their rights may exercise those rights themselves, as described in Section 12.7.

10.7. Where Eduplore refuses to act on a request, in whole or in part, Eduplore will inform the data subject of the reasons for the refusal, without undue delay and in any event within one month of receipt of the request, and will inform the data subject of their right to lodge a complaint with a supervisory authority and to seek a judicial remedy.

10.9. A data subject may also contact their supervisory authority directly, without first contacting Eduplore, as described in Section 18. However, Eduplore encourages data subjects to contact Eduplore first, so that Eduplore can resolve the matter promptly.

11.1. Eduplore will keep personal data only for as long as is necessary for the purposes for which it was collected, as described in Section 6, and for as long as is required by applicable law. Eduplore will not keep personal data for longer than is necessary, and will delete or anonymise personal data when the retention period expires, unless a longer retention period is required by law or by an ongoing legal proceeding.

11.2. The following retention periods apply, unless a different period is required by law, by a court order, or by a written agreement with a school:

(a) Account data, including identity data, contact data, and account settings, will be retained for as long as the account is active, and for a period of twelve months after the account is closed or deleted, for the purpose of handling any queries, complaints, or legal claims relating to the account. After that period, the account data will be deleted or anonymised.

(b) Learning and assessment data, including course enrolments, lesson progress, laboratory usage, quiz and assessment results, and homework submissions, will be retained for as long as the account is active, and for a period of twelve months after the account is closed or deleted, for the purpose of providing a record of the student's learning and for handling queries and complaints. After that period, the learning data will be deleted or anonymised, unless the school has requested a longer retention period under its agreement with Eduplore, in which case the school's retention period will apply to the school's copy of the data.

(c) Progress analytics data will be retained for as long as the account is active, and for a period of twelve months after the account is closed or deleted. Aggregated and anonymised analytics, from which no individual can be identified, may be retained indefinitely for the purpose of improving the Platform and for research, provided that the anonymisation is irreversible.

(d) Payment and subscription data, including transaction references, subscription dates, and payment status, will be retained for a period of seven years from the date of the transaction, for the purpose of complying with tax and accounting obligations. Payment card details are not stored by Eduplore and are retained only by the payment service provider, in accordance with that provider's own retention policy.

(e) Communications data, including support requests, feedback, and correspondence, will be retained for a period of three years from the date of the last communication, for the purpose of handling queries, complaints, and legal claims.

(f) Technical and usage data, including log data and internet protocol addresses, will be retained for a period of twelve months from the date of collection, for the purpose of security, troubleshooting, and improving the Platform. After that period, the data will be deleted or anonymised.

(g) Data subject request records, including the request, the action taken, and the date of the response, will be retained for a period of three years from the date of the response, for the purpose of demonstrating compliance with the GDPR.

(h) Copyright complaint records, including Takedown Notices and Counter-Notices, will be retained for a period of three years from the date of the relevant action, as described in the Copyright and DMCA Policy.

11.3. Where a data subject exercises the right to erasure under Section 9.4, Eduplore will erase the personal data without undue delay, subject to the exceptions in Article 17(3) of the GDPR, and will inform any processor or recipient to whom the data has been disclosed, as required by Article 19 of the GDPR.

11.4. Where personal data is retained for a longer period because it is necessary for the establishment, exercise, or defence of a legal claim, Eduplore will restrict the processing of that data to the purpose of the legal claim, and will not use it for any other purpose.

11.6. When a retention period expires, Eduplore will delete the personal data securely, using methods that prevent recovery, or will anonymise the data so that the data subject can no longer be identified, directly or indirectly. Backup copies of personal data will be deleted or anonymised in accordance with Eduplore's backup retention schedule, and in any event within a reasonable period after the retention period expires.

12.1. Eduplore is designed for students in Classes 8, 9 and 10, many of whom are Children under the age of eighteen. Eduplore takes the protection of children's personal data seriously, and applies the additional protections described in this Section 12, in accordance with Article 8 of the GDPR and with the Digital Personal Data Protection Act, 2023.

12.2. Where Eduplore offers an information society service directly to a Child, and the processing of the Child's personal data is based on consent, Eduplore will obtain the consent of the parent or legal guardian, or of the person who holds parental responsibility for the Child, where the Child is below the age of digital consent in the relevant Member State. The age of digital consent is sixteen years by default under Article 8 of the EU GDPR, but Member States may lower it to thirteen years, and the age differs between Member States. Eduplore will apply the age that applies in the Member State where the Child is located.

12.3. In the UK, the age of digital consent is thirteen years. Where a Child in the UK is thirteen years or older, the Child may give their own consent to the processing of their personal data in relation to an information society service. Where a Child in the UK is under thirteen years of age, Eduplore will obtain the consent of the parent or legal guardian.

12.4. In India, under the Digital Personal Data Protection Act, 2023, Eduplore must obtain verifiable consent from the parent or legal guardian before processing the personal data of a Child under the age of eighteen. Eduplore applies this requirement to all children on the Platform, regardless of where they are located, as a matter of policy, except where the Child is old enough to give their own consent under the law of the country in which they are located and Eduplore has verified that the Child understands the processing.

12.5. Eduplore will make reasonable efforts to verify that consent for the processing of a Child's personal data has been given or authorised by the parent or legal guardian, taking into consideration the available technology. Verification may include asking the parent or legal guardian to confirm their identity and their relationship to the Child, and to provide a contact email address or telephone number that Eduplore can use to confirm consent.

12.6. A parent or legal guardian may withdraw consent for the processing of their child's personal data at any time, by contacting Eduplore using the procedure in Section 10. Where consent is withdrawn, Eduplore will stop the processing that relied on that consent, and will erase the Child's personal data where no other lawful basis applies, subject to Section 9.4. The withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

12.7. A Child who is old enough to understand their rights may exercise their own data subject rights, including the right of access, the right to rectification, and the right to erasure, as described in Section 9. Eduplore will assess the Child's capacity to understand their rights on a case-by-case basis, taking into account the Child's age, maturity, and the nature of the request. Where a Child is not able to understand their rights, the parent or legal guardian may exercise those rights on the Child's behalf.

12.8. Eduplore does not use children's personal data for direct marketing, does not profile children for marketing purposes, and does not sell children's personal data. Eduplore does not use children's personal data to make decisions about a child based solely on automated processing that produces legal effects or that similarly significantly affects the child.

12.9. Eduplore does not permit third-party advertisers to target children on the Platform, and does not allow tracking technologies on the Platform that are designed to profile children for advertising purposes.

12.10. Where a Child's personal data is shared with a parent, a teacher, or a school, Eduplore will share only the data that is necessary for that person to support the Child's learning, as described in Section 6.6. A parent can see only the progress of their own child. A teacher can see only the progress of the students in their classes. A school can see only the progress of its own students.

13.1. Eduplore will not sell personal data, will not rent personal data, and will not share personal data with third parties for their own marketing purposes. Eduplore shares personal data only in the circumstances described in this Section 13, and only to the extent necessary for the purpose of the sharing.

13.2. Sharing with parents, teachers, and schools. Eduplore shares a student's learning data and progress analytics data with the student's parent or legal guardian, with the student's teacher, and with the student's school, for the purpose of supporting the student's learning, as described in Section 6.6. Eduplore shares only the data that is necessary for that purpose, and only with the persons who are authorised to receive it.

13.3. Sharing with service providers (processors). Eduplore shares personal data with third-party service providers who process personal data on Eduplore's behalf, under written contracts that comply with Article 28 of the GDPR. These providers include:

(a) Hosting and infrastructure providers, who store Eduplore's data and provide the servers and networks on which the Platform operates.

(b) Content delivery networks, who deliver video courses and other Content to users efficiently.

(c) Payment service providers, who process in-app purchases and subscriptions. Payment card details are processed by the payment provider and are not stored by Eduplore.

(d) Analytics providers, who help Eduplore to understand how the Platform is used and to improve it. Where an analytics provider is used, Eduplore will configure it to minimise the personal data collected, and will not share children's personal data with an analytics provider for advertising or profiling purposes.

(e) Customer support providers, who help Eduplore to respond to support requests and enquiries.

(f) Communication providers, who help Eduplore to send service messages, such as emails and notifications, to users.

13.4. Eduplore will not engage a new processor, or replace an existing processor, without ensuring that the processor provides sufficient guarantees to implement appropriate technical and organisational measures to protect personal data, as required by Article 28 of the GDPR. Where Eduplore engages a sub-processor, Eduplore will inform the controller, where Eduplore is acting as a processor, and will obtain the controller's authorisation, as required by Article 28(2) of the GDPR.

13.5. Sharing with competent authorities. Eduplore may share personal data with a court, a tribunal, a law enforcement agency, a regulatory authority, or another competent authority, where Eduplore is required to do so by law, by a court order, or by a lawful request from that authority. Eduplore will share only the data that is required, and will inform the data subject of the sharing, unless Eduplore is prohibited by law from doing so.

13.6. Sharing in the event of a business transfer. If Eduplore is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the successor organisation as part of that transaction, subject to the successor organisation agreeing to protect the personal data in accordance with this Notice and with applicable law. Eduplore will inform data subjects of any such transfer, and of their rights in relation to it, before the transfer takes effect.

14.1. Eduplore is based in India, and the Platform is operated from India. Personal data collected from users in the EEA or the UK will be transferred to India, and may be transferred to other countries where Eduplore's service providers are located, for the purposes described in Section 6.

14.2. India is not currently the subject of an adequacy decision by the European Commission under Article 45 of the EU GDPR, or by the UK Secretary of State under Article 45 of the UK GDPR. This means that Eduplore must put in place an appropriate safeguard before transferring personal data from the EEA or the UK to India, as required by Chapter V of the GDPR.

14.3. Eduplore uses the following safeguards for international transfers, as appropriate to the transfer in question:

(a) Standard Contractual Clauses. Eduplore enters into the European Commission's Standard Contractual Clauses, as adopted by Commission Implementing Decision (EU) 2021/914, with its processors and with any other recipient in a third country, where the transfer is from the EEA. For transfers from the UK, Eduplore uses the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as issued by the UK Information Commissioner's Office.

(b) Adequacy decisions. Where Eduplore transfers personal data to a country that is the subject of an adequacy decision, Eduplore will rely on that decision, and will not require an additional safeguard for that transfer.

(c) Binding Corporate Rules. Where Eduplore transfers personal data within a group of undertakings that has approved Binding Corporate Rules, Eduplore will rely on those Rules, in accordance with Article 47 of the GDPR.

(d) Derogations. In limited circumstances, Eduplore may rely on a derogation in Article 49 of the GDPR, such as the explicit consent of the data subject, or the necessity of the transfer for the performance of a contract between the data subject and Eduplore, or for the establishment, exercise, or defence of legal claims. Eduplore will rely on a derogation only where no other safeguard is available, and will document the basis for the derogation.

14.4. Before relying on Standard Contractual Clauses, Eduplore carries out a transfer impact assessment, to assess whether the law of the destination country provides a level of protection for the personal data that is essentially equivalent to the protection provided by the GDPR, and to identify any supplementary measures that may be necessary. Where supplementary measures are necessary, Eduplore will implement them, which may include encryption, pseudonymisation, access controls, and contractual commitments.

14.5. A data subject may obtain a copy of the safeguards used for a transfer of their personal data, including a copy of the relevant Standard Contractual Clauses, by contacting the Data Protection Officer. Eduplore will provide a copy, subject to the redaction of confidential commercial information that is not relevant to the data subject's rights.

14.6. Eduplore will not transfer personal data to a third country unless an appropriate safeguard is in place, or unless a derogation in Article 49 applies. If Eduplore becomes aware that a safeguard is no longer effective, Eduplore will suspend the transfer and will take steps to put in place an alternative safeguard, or to return or delete the personal data, as appropriate.

15.1. Eduplore takes the security of personal data seriously, and implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. These measures are designed to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access.

15.2. Technical measures implemented by Eduplore include:

(a) Encryption of personal data in transit, using Transport Layer Security, and encryption of personal data at rest, using industry-standard encryption, where appropriate to the sensitivity of the data.

(b) Access controls, including authentication, authorisation, and role-based access, so that only authorised personnel can access personal data, and only to the extent necessary for their role.

(c) Pseudonymisation and, where possible, anonymisation of personal data, in particular for analytics and for testing and development purposes.

(d) Firewalls, intrusion detection systems, and regular security monitoring, to detect and respond to unauthorised access and to other security incidents.

(e) Regular security testing, including vulnerability assessments and penetration testing, where appropriate to the risk.

(f) Secure software development practices, including code review, dependency management, and timely application of security patches.

(g) Backup and disaster recovery procedures, to ensure that personal data can be restored in the event of a technical failure or a security incident.

15.3. Organisational measures implemented by Eduplore include:

(a) Policies and procedures for the handling of personal data, including this Notice, the Privacy Policy, and internal data protection policies.

(b) Training for staff and contractors who handle personal data, on their data protection obligations and on the importance of protecting children's data.

(c) Confidentiality obligations for staff, contractors, and service providers who have access to personal data.

(d) Procedures for responding to personal data breaches, as described in Section 16.

(e) Regular reviews of security measures, to ensure that they remain appropriate to the risk.

15.4. Eduplore limits access to personal data to those persons who need it for the purposes described in Section 6. A teacher can access only the data of the students in their classes. A school administrator can access only the data of the school's students and teachers. A parent can access only the data of their own child. Eduplore's staff can access personal data only where it is necessary for their role, such as providing customer support or maintaining the Platform.

15.5. Eduplore requires its processors to implement appropriate technical and organisational measures to protect personal data, and includes those requirements in its contracts with processors, as required by Article 28 of the GDPR.

16.1. A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed. Examples include unauthorised access to a database containing student records, the loss of a device containing unencrypted personal data, and the accidental sending of personal data to the wrong recipient.

16.2. Eduplore has procedures in place to detect, investigate, and respond to personal data breaches. These procedures include monitoring for suspicious activity, investigating suspected breaches promptly, containing the breach, assessing the risk to data subjects, and taking steps to mitigate the risk.

16.3. Where Eduplore becomes aware of a personal data breach, Eduplore will document the breach, including the facts relating to the breach, its effects, and the remedial action taken, as required by Article 33(5) of the GDPR.

16.4. Eduplore will notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than seventy-two hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, as required by Article 33 of the GDPR. Where Eduplore is acting as a processor, Eduplore will notify the controller without undue delay after becoming aware of the breach, as required by Article 33(2) of the GDPR.

16.5. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, Eduplore will communicate the breach to the affected data subjects without undue delay, as required by Article 34 of the GDPR. The communication will describe, in clear and plain language, the nature of the breach, the name and contact details of the Data Protection Officer, the likely consequences of the breach, and the measures taken or proposed to be taken to address the breach and to mitigate its possible adverse effects.

16.7. Where a breach involves the personal data of a Child, Eduplore will inform the Child's parent or legal guardian, in addition to informing the Child where the Child is old enough to understand the communication, and will provide guidance on the steps that the parent or Child can take to protect themselves.

17.1. Eduplore may update this Notice from time to time, to reflect changes in the law, changes in the Platform, or changes in Eduplore's practices. Eduplore will publish the updated Notice on eduplore.in and inside the app, and will update the "Last updated" date.

17.2. Where a change is material, Eduplore will notify data subjects by email, by a notice on the Platform, or by a notification in the app, at least seven days before the change takes effect, or within any longer period required by applicable law. A material change includes a change to the purposes of processing, a change to the lawful bases relied on, a change to the recipients of personal data, or a change to the arrangements for international transfers.

17.3. Continued use of the Platform after a change takes effect means that the data subject accepts the updated Notice. A data subject who does not accept the updated Notice should stop using the Platform and contact Eduplore if they have any questions. Where the processing is based on consent, and a change affects the processing to which the data subject consented, Eduplore will obtain fresh consent before continuing that processing.

18.1. A data subject who has a concern about the processing of their personal data should first contact Eduplore's Data Protection Officer, Revant (revanth@eduplore.in), using the contact details in Section 21, or through the general privacy contact email (venkatesh@eduplore.in) published on eduplore.in. Eduplore will investigate the concern promptly and will respond within a reasonable time.

18.2. A data subject also has the right to lodge a complaint with a supervisory authority, if the data subject considers that the processing of personal data relating to them infringes the GDPR. A data subject may lodge a complaint with the supervisory authority in the Member State of their habitual residence, their place of work, or the place of the alleged infringement.

18.3. In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO). The ICO can be contacted through its website, by telephone, or by post. The contact details for the ICO are published on the ICO's website, and data subjects should check the ICO's website for the current contact details before submitting a complaint.

18.4. In the European Economic Area, each Member State has its own supervisory authority. A data subject can find the contact details for the supervisory authority in their Member State through the website of the European Data Protection Board, which publishes a list of national supervisory authorities and their contact details.

18.6. A data subject who lodges a complaint with a supervisory authority has the right to be informed of the progress and the outcome of the complaint, as required by Article 77(2) of the GDPR. The supervisory authority will inform the data subject of the progress and the outcome of the complaint within a reasonable period.

18.8. In India, a data subject may also raise a concern with the Data Protection Board of India, established under the Digital Personal Data Protection Act, 2023, or with the Grievance Officer appointed by Eduplore under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. The Grievance Officer's details are set out in Section 21.

19.1. Eduplore is an Indian company, and the processing of personal data by Eduplore is also governed by Indian law, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

19.2. Under the DPDP Act, Eduplore is a data fiduciary, and data subjects are data principals. The DPDP Act gives data principals the right to access information about the processing of their personal data, the right to correction and erasure, the right to grievance redressal, and the right to nominate another person to exercise their rights in the event of death or incapacity. These rights are similar to, but not identical to, the rights under the GDPR, and data subjects in India should read the Privacy Policy for a description of their rights under Indian law.

19.3. Under the DPDP Act, Eduplore must obtain verifiable consent from the parent or legal guardian before processing the personal data of a Child under the age of eighteen, and must not track or monitor the behaviour of children, and must not target advertising at children. Eduplore complies with these requirements, as described in Section 12 of this Notice.

19.5. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require Eduplore, as an intermediary, to publish rules and regulations, a privacy policy, and a user agreement, to appoint a Grievance Officer, and to act on complaints within defined timelines. Eduplore complies with these requirements, and the Grievance Officer's details are set out in Section 21.

20.1. The Platform may contain links to third-party websites, applications, or services, and may use third-party services to operate the Platform, as described in Section 13. This Section 20 explains how Eduplore handles personal data in connection with those third-party services and links.

20.2. Eduplore's third-party service providers act as processors on Eduplore's behalf, under written contracts that comply with Article 28 of the GDPR. Eduplore remains responsible for the processing carried out by its processors, and will ensure that they protect personal data in accordance with this Notice and with applicable law.

20.3. The Google Play Store, through which the Eduplore app is distributed, collects personal data from users in accordance with Google's own privacy policy. Eduplore is not responsible for Google's processing of personal data, and users should read Google's privacy policy for further information about how Google processes their data.

20.4. Where the Platform contains a link to a third-party website or service, the user leaves the Platform when they follow that link, and becomes subject to the privacy policy and terms of that third-party website or service. Eduplore is not responsible for the privacy practices of third-party websites or services, and encourages users, and in particular parents and teachers, to read the privacy policies of any third-party website or service before providing personal data to it.

21.1. For any question about this Notice, about the processing of personal data, or about the exercise of data subject rights, contact Eduplore's Data Protection Officer:

• Name: Revant
• Email: revanth@eduplore.in
• Postal address: 1st Floor, SLA Inn, 7, Hootagalli, Hutagalli, Mysuru, Karnataka 570018

21.2. For general privacy enquiries, contact: venkatesh@eduplore.in.

21.3. For complaints and grievances under Indian law, contact the Grievance Officer:

• Name: Venkatesh C
• Email: venkatesh@eduplore.in
• Phone: +91 94802 88911

21.4. Eduplore's registered address is: 1st Floor, SLA Inn, 7, Hootagalli, Hutagalli, Mysuru, Karnataka 570018.

21.5. Representative in the European Union under Article 27 of the EU GDPR: Not appointed (Eduplore is based in India and does not specifically target or maintain an establishment in the European Economic Area). Data subjects in the EEA may contact Eduplore's Data Protection Officer directly at revanth@eduplore.in.

21.6. Representative in the United Kingdom under Article 27 of the UK GDPR: Not appointed (Eduplore is based in India and does not specifically target or maintain an establishment in the United Kingdom). Data subjects in the UK may contact Eduplore's Data Protection Officer directly at revanth@eduplore.in.

21.7. Eduplore will respond to correspondence sent to the addresses in this Section 21 within a reasonable time, and within any timeframe required by applicable law, including the one-month period for responding to a data subject request under Article 12(3) of the GDPR.

22.1. This Notice is governed by the laws of India, without regard to any conflict of laws principles that would require the application of the laws of another jurisdiction, except to the extent that the GDPR applies to the processing described in this Notice by virtue of its own territorial scope, in which case the GDPR will apply to that processing.

22.2. Any dispute arising out of or in connection with this Notice will be subject to the jurisdiction of the courts in Karnataka, India, unless the parties agree otherwise in writing, or unless a mandatory provision of applicable law, including the GDPR, provides otherwise. A data subject in the EEA or the UK may also bring proceedings against Eduplore in the courts of the Member State where the data subject has their habitual residence, as provided by Article 79(2) of the GDPR.

22.3. If any provision of this Notice is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, the remaining provisions will continue in full force and effect, and the invalid provision will be read down to the minimum extent necessary to make it valid and enforceable.

22.4. Headings in this Notice are for convenience only and do not affect the interpretation of the Notice. References to a statute, a regulation, or a rule include any amendment, replacement, or re-enactment of that statute, regulation, or rule.

22.5. In this Notice, "including" means "including without limitation", and "must" means an obligation, while "may" means a permission or a discretion.