Legal
Epoch Olympiad Foundation Pvt. Ltd. and its associated initiatives, including Epoch Olympiad, Brainiac Global and MY CCBee ("we", "us", "our" or "Foundation") respect your privacy and are committed to protecting personal information entrusted to us.
This Privacy Policy explains how we collect, use, disclose, store, protect and otherwise process personal data when you:
Our objective is to process personal data responsibly, transparently and only for legitimate educational, administrative, operational and related purposes.
This Policy applies when you
For privacy-related requests, please contact:
Privacy Contact / Grievance Contact
We believe that educational technology should strengthen learning without compromising privacy.
We therefore follow the principles of:
We collect only information reasonably required for the purposes explained in this Policy and seek appropriate consent wherever required by applicable law.
Depending on the service being used, we may process information relating to:
For example:
Where required for educational participation or reporting:
For example:
We may collect:
We may automatically receive limited technical information such as:
We recognise that children's data requires enhanced protection.
Where applicable, we will:
We will not knowingly permit children's personal data to be used for targeted advertising or behavioural profiling for advertising purposes.
Where applicable law requires additional safeguards for children's data, we will follow those requirements.
The DPDP framework contains specific protections for children, including requirements relating to parental consent and restrictions on certain processing involving children.
We may collect information through:
For example, when you:
A school may provide student, teacher or parent information to us for purposes such as:
Where a school provides personal data on behalf of parents/guardians, the school is responsible for obtaining any consent or authorisation required from the relevant individuals, unless otherwise agreed or required by law.
We may process personal data for the following purposes:
Information may be processed to:
Where applicable, data may be used to:
We may use contact information to:
Marketing communications will be sent in accordance with applicable law and applicable consent/preferences.
Our educational assessments may generate information about a student's:
Such information is used primarily to provide educational assessment, benchmarking, reporting and improvement insights.
Academic Health Reports are intended to provide educational insights and should not be interpreted as medical, psychological, psychiatric or clinical diagnoses unless expressly stated otherwise.
Depending on the circumstances and applicable law, we may process personal data based on:
Where consent is relied upon, we will seek consent in a manner that is appropriately informed, specific and capable of being withdrawn where applicable.
Where consent is required, we will provide information about:
Withdrawal of consent will not affect processing already lawfully undertaken before withdrawal.
However, withdrawal may affect our ability to provide a service where the relevant information is necessary to provide that service.
Our services may use third-party platforms or services, including, depending on the particular service:
Their processing may be governed by their respective privacy policies.
We recommend that users review the privacy practices of third-party services before using them.
We take reasonable technical and organisational measures designed to protect personal data against:
Security measures may include, where appropriate:
The 2025 DPDP Rules specifically contemplate reasonable security safeguards including measures such as encryption, access controls, monitoring, backups and breach detection/response.
No electronic system can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security of information transmitted over the internet.
If we become aware of a personal data breach, we will assess and respond to it in accordance with applicable law.
Depending on the nature and severity of the incident, this may include:
The notified DPDP Rules provide for breach notifications to affected Data Principals and the Data Protection Board, including detailed reporting requirements within the prescribed timeframe.
We retain personal data only for as long as reasonably necessary for:
When personal data is no longer required, we will securely delete, anonymise or otherwise dispose of it, subject to applicable legal or contractual retention requirements.
We will periodically review retention periods.
We seek to maintain accurate and reasonably up-to-date information.
Users, parents/guardians and schools should notify us if information is inaccurate, incomplete or outdated.
Where appropriate, we will take reasonable steps to correct or update the information.
Subject to applicable law, individuals may have rights relating to their personal data, including rights to:
The DPDP framework expressly establishes rights for Data Principals, subject to its provisions and applicable commencement dates.
A parent or lawful guardian may contact us regarding personal data relating to their child.
To protect the child and prevent unauthorised disclosure, we may require reasonable verification of the identity and authority of the person making the request.
We may refuse or limit a request where permitted or required by applicable law.
Where a school provides us with personal data relating to students, parents, teachers or other individuals, the school should ensure that:
Where our agreement with a school allocates particular privacy responsibilities, those contractual arrangements will also apply.
Some of our technology providers may store or process information outside India.
Where personal data is transferred outside India, we will do so in accordance with applicable law and any restrictions or requirements prescribed by the Government of India or other applicable jurisdiction.
We will take reasonable steps to ensure that appropriate contractual, organisational and technical safeguards are in place.
Our primary operations are based in India.
If you access our services from another country or jurisdiction, additional privacy laws may apply depending on the circumstances.
Where laws such as the EU/EEA GDPR, UK GDPR, or other applicable data-protection laws apply to our processing, we will comply with the obligations applicable to us.
This Policy does not by itself create rights under a law that does not otherwise apply to our activities.
As an education research foundation, we may conduct research and statistical analysis using assessment and educational data.
Where research requires identifiable personal data, we will process such data only where legally permitted and for an appropriate purpose.
Where reasonably possible, research and statistical outputs will use:
We will not publicly identify individual students in research publications or public performance analyses without appropriate authority or consent where required.
We may publish information relating to award recipients, participating schools or educational achievements where appropriate and lawfully permitted.
For children, we will obtain appropriate consent/authorisation before publicly displaying identifiable information such as:
Parents/guardians may contact us regarding applicable publicity permissions.
Where a principal, teacher, parent, student or other individual voluntarily provides a testimonial, photograph or video for publication, we will use such material for the purposes for which permission was granted.
We will not imply an endorsement beyond the scope of the permission provided.
Where payments are made through our website or services, payment information may be processed by authorised payment service providers.
We generally do not need to store complete debit-card, credit-card or banking credentials ourselves.
Payment service providers may process payment information according to their own privacy and security policies and applicable financial regulations.
Our website may contain links to third-party websites.
We are not responsible for the privacy practices, security or content of external websites.
Users should review the privacy policy of each third-party website they visit.
We may update this Privacy Policy from time to time to reflect:
The updated version will be published on this page with a revised “Last Updated” date.
Where required by law, we will provide additional notice or obtain consent for material changes.
If you have a privacy concern, complaint or request, please contact:
Privacy & Grievance Contact
Please include:
We may request reasonable information to verify your identity before processing the request.
We will address privacy requests and grievances within the time periods prescribed by applicable law.
For general questions regarding this Privacy Policy:
Epoch Olympiad Foundation Pvt. Ltd.
This Privacy Policy shall be interpreted in accordance with the laws applicable to the processing of personal data and the services provided by us.
For matters governed by Indian law, applicable laws of India shall apply, subject to mandatory rights and remedies available to individuals under applicable law.
