Privacy Policy

1. Introduction

The Future Skills & Social Upliftment Foundation ("FSSUF", "Trust", "we", "us", or "our") operates the CyberYodha cybersecurity and artificial intelligence learning program (the "Program") through this website (the "Platform"). This Privacy Policy explains how we collect, use, disclose, store, and protect personal data belonging to Visitors, Schools, Teachers, Students, and their parents/guardians (collectively, "you" or "Users") when you interact with the Platform.

This Policy is designed to comply with the Digital Personal Data Protection Act, 2023 ("DPDPA") and other applicable Indian data protection law. Under the DPDPA, FSSUF acts as the "Data Fiduciary" in relation to personal data processed through the Platform, and you (or, in the case of a Student who is a minor, the Student's parent/lawful guardian) are the "Data Principal".

This Policy should be read together with our Terms of Service. If you do not agree with this Policy, please do not use the Platform.

2. Key Terms Used in This Policy

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDPA.
• "Processing" means any operation performed on personal data, including collection, storage, use, sharing, disclosure, or erasure.
• "Data Fiduciary" means FSSUF, which determines the purpose and means of processing personal data on the Platform.
• "Data Principal" means the individual to whom the personal data relates — i.e., the Visitor, School representative, Teacher, or Student (through their parent/guardian).
• "Consent Manager" means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review, or withdraw consent through an accessible, transparent platform, where applicable.
• "Child" means an individual who has not completed the age of 18 years, as defined under the DPDPA.
• "SDF" / "Significant Data Fiduciary" is a classification the Central Government may notify for certain Data Fiduciaries based on volume/sensitivity of data processed, triggering additional obligations (see Section 12).

3. Personal Data We Collect

The categories of personal data we collect depend on your role on the Platform:

3.1 Visitors

• Contact details voluntarily submitted through forms (e.g., name, email address, phone number, organization);
• Technical data such as IP address, browser type, device information, and usage data collected via cookies and similar technologies (see Section 8).

3.2 Schools

• Institutional details: school name, address, affiliation/registration number, contact details of the authorized representative;
• Administrative account credentials and role-based access logs;
• Aggregate program participation and performance data of the School's enrolled Teachers and Students.

3.3 Teachers

• Name, official email address, phone number, subject/role, and School affiliation;
• Account credentials and login/access logs;
• Content created on the Platform (e.g., comments, supplementary material, assessment feedback);
• Program usage data (login frequency, modules accessed, time spent).

3.4 Students

• Name, date of birth or age band, class/grade, School, and a unique student/enrollment identifier;
• Parent/guardian contact details, provided by the School, for consent and communication purposes;
• Learning data: course progress, quiz/assessment scores, exercise submissions, certificates earned;
• Login credentials and technical/usage data necessary to operate the Student's Account;
• We do not knowingly collect more personal data from Students than is reasonably necessary for participation in the Program, and we do not collect sensitive categories of data (e.g., health, financial, biometric data) from Students unless specifically required for a defined educational purpose and with appropriate consent.

3.5 Data We Do Not Seek to Collect

We do not request or knowingly collect Student payment card details, government identity numbers, precise geolocation, or biometric identifiers through the Platform. Where any third-party payment processor is used for School-level fees, such processing is subject to that processor's own privacy and security terms.

4. How We Collect Personal Data

• Directly from you or your School, when you register, log in, complete a profile, or submit a form;
• Automatically, through cookies, log files, and analytics tools when you use the Platform (see Section 8);
• From your School, in the case of Students and Teachers, who provide enrollment information to FSSUF on your behalf.

5. Purposes and Legal Basis for Processing

Under the DPDPA, FSSUF processes personal data only for a specified, lawful purpose for which the Data Principal has given consent, or that qualifies as a "legitimate use" recognized under the Act. Our specific purposes are:

6. Consent

1. Where consent is the basis for processing, we will seek your free, specific, informed, unconditional, and unambiguous consent through a clear affirmative action, accompanied by a notice describing the personal data to be collected and the purpose of processing.
2. You (or, for a Student, the Student's parent/guardian) may withdraw consent at any time, with the ease of withdrawal comparable to the ease with which consent was given. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and may result in our being unable to continue providing certain Program features.
3. Where a Consent Manager framework becomes operational and applicable, we will enable you to manage your consent through a registered Consent Manager as required by law.

7. Special Provisions for Children's Data (Section 9, DPDPA)

Because a significant number of our Users are Students who are Children under the DPDPA, we apply the following additional safeguards:

• Verifiable Parental Consent: Before processing a Child's personal data, we require the enrolling School to obtain verifiable consent from the Child's parent or lawful guardian, in a manner consistent with DPDPA requirements.
• No Tracking or Behavioural Monitoring: We do not undertake tracking or behavioural monitoring of Children, and we do not engage in targeted advertising directed at Children, as prohibited under Section 9(3) of the DPDPA.
• No Detrimental Processing: We do not process Children's personal data in any manner likely to cause any detrimental effect on the well-being of the Child.
• Purpose Limitation: A Child's personal data is used strictly for purposes connected to delivering the Program (enrollment, learning progress, assessment, certification, and safety), and for no other commercial purpose.
• School as Point of Contact: Parents/guardians may exercise rights on a Child's behalf by contacting the School, which will coordinate with FSSUF, or by contacting FSSUF directly using the details in Section 15.

Note: The DPDPA permits the Central Government to exempt certain classes of Data Fiduciaries from some Section 9 obligations. FSSUF will apply any such exemption only where it is formally notified and applicable.

8. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies to enable core functionality (such as keeping you logged in), remember preferences, and understand aggregate Platform usage through analytics. We do not use tracking or behavioural-advertising cookies on Accounts identified as belonging to Children. You can control non-essential cookies through your browser settings; disabling essential cookies may affect Platform functionality.

9. Sharing and Disclosure of Personal Data

We do not sell personal data. We may share personal data only in the following circumstances:

• With the relevant School's authorized administrators, for Teacher and Student data connected to that School's Program participation;
• With Teachers, limited to data reasonably necessary to deliver and assess the Program for their own Students;
• With service providers and processors who support Platform operations (e.g., hosting, email delivery, analytics), under contractual obligations to protect the data and use it only for the specified purpose;
• With the Data Protection Board of India, courts, law enforcement, or regulators, where required by law;
• With a successor entity in connection with a merger, acquisition, or restructuring of FSSUF, subject to equivalent privacy protections;
• With your explicit consent, for any other purpose not covered above.

10. Rights of Data Principals

Subject to the DPDPA and its rules, you (or a Student's parent/guardian, on the Student's behalf) have the following rights:

• Right to Access Information: Obtain a summary of personal data processed and the processing activities undertaken by FSSUF.
• Right to Correction and Erasure: Request correction of inaccurate/incomplete data, updating of data, and erasure of personal data no longer necessary for the stated purpose, unless retention is required by law.
• Right to Grievance Redressal: Raise a complaint regarding processing of your personal data and receive a response within a reasonable time (see Section 14).
• Right to Nominate: Nominate another individual to exercise your rights under the DPDPA in the event of death or incapacity.
• Right to Withdraw Consent: Withdraw previously given consent at any time (see Section 6).

To exercise any of these rights, please contact us using the details in Section 15. We may need to verify your identity before acting on a request.

11. Data Retention

• We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to comply with legal, accounting, or reporting obligations, or as agreed with the relevant School;
• Student and Teacher data is generally retained for the duration of the individual's enrollment/affiliation with a registered School, plus a reasonable period thereafter for record-keeping, certification verification, and legal purposes, after which it is deleted or anonymized;
• Where you withdraw consent and no other legal ground or retention obligation applies, we will erase the corresponding personal data and direct any relevant data processors to do the same, in accordance with Section 8(7) of the DPDPA;
• Account data may be deleted or anonymized after a defined period of inactivity, following prior notice where required by law.

12. Data Security

We implement reasonable technical and organizational security safeguards to protect personal data against unauthorized access, disclosure, alteration, or destruction, as required under Section 8(5) of the DPDPA. These include, as applicable:

• Access controls and role-based permissions restricting data access to authorized personnel only;
• Encryption of data in transit and, where appropriate, at rest;
• Regular security reviews, monitoring, and vulnerability management of the Platform;
• Confidentiality obligations for FSSUF personnel and contracted service providers;
• Maintenance of logs and technical measures to detect and respond to personal data breaches.

In the event of a personal data breach, FSSUF will notify the Data Protection Board of India and affected Data Principals in the manner and timeframe required under Section 8(6) of the DPDPA and its rules.

13. Cross-Border Data Transfers

Personal data collected through the Platform is primarily stored and processed in India. Where FSSUF engages service providers (e.g., cloud hosting or communication tools) that process data outside India, such transfers will be made in accordance with Section 16 of the DPDPA — that is, to countries not restricted by the Central Government — and subject to appropriate contractual safeguards to protect the data.

14. Grievance Redressal and Data Protection Officer

In accordance with the DPDPA, FSSUF has designated a contact person to address questions and grievances regarding personal data processing:

Grievance Officer / Data Protection Contact
Name: [Insert Name]
Email: [Insert Grievance Email Address]
Address: [Insert Registered Address]

We will acknowledge and respond to grievances within the timeframe prescribed under applicable law. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India, once operational, or pursue other remedies available under law.

15. Contact Us

For any questions about this Privacy Policy, to exercise your rights as a Data Principal, or to raise a concern about a Child's data, please contact:

Future Skills & Social Upliftment Foundation (FSSUF)
Email: ecyberyodha@gmail.com
Website: https://ecyberyodha.com

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, the Program, or applicable law (including the notification of DPDPA rules). Material changes will be notified through the Website or via email to registered School administrators, along with the "Last Updated" date at the top of this Policy. We encourage you to review this Policy periodically.