Privacy Policy – PHIR SHIKSHA

This Privacy Policy explains how we collect, receive, use, process, store, protect, disclose and otherwise handle personal data when you access or use the PHIR Shiksha website, mobile application, digital platforms, educational services, courses, programs, communication channels and related services (collectively, the “Services”).

We respect your privacy and are committed to handling personal data responsibly, transparently and securely.

By accessing or using PHIR Shiksha, you acknowledge that you have read and understood this Privacy Policy. Where consent is required under applicable law, we will obtain your consent before processing personal data for the relevant purpose.

1. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data collected through:

• The PHIR Shiksha website;
• PHIR Shiksha mobile applications;
• Online registration and admission/application forms;
• Course and program enrolment;
• University/institution partnership and admission-related services;
• Payment and transaction processes;
• Contact, enquiry and counselling forms;
• Customer support and communication channels;
• Emails, SMS, WhatsApp or other communications initiated through or on behalf of PHIR Shiksha;
• Digital marketing, campaign and promotional activities;
• Cookies and similar technologies used on our website or application; and
• Other digital services operated by or on behalf of PHIR Shiksha.

This Policy applies to students, prospective students, parents/guardians, users, visitors, applicants, institutional representatives, partners and other persons who interact with PHIR Shiksha.

2. IDENTITY OF THE DATA FIDUCIARY

For purposes of applicable data protection law, the entity determining the purpose and means of processing personal data will act as the relevant Data Fiduciary.

Where PHIR Shiksha engages another organisation to process personal data on its behalf, such organisation may act as a Data Processor subject to applicable contractual and legal obligations.

3. PERSONAL DATA WE MAY COLLECT

Depending on the Services you use, we may collect the following categories of personal data.

3.1 Identity and Contact Information

• Full name;
• Date of birth, where necessary;
• Gender, where voluntarily provided and relevant;
• Email address;
• Mobile number;
• Residential/correspondence address;
• City, state and country;
• Profile photograph, where applicable;
• Communication preferences.

3.2 Educational Information

• Educational qualifications;
• School/college/university information;
• Course/program preferences;
• Academic records and relevant details;
• Examination details;
• Admission/application information;
• Certificates or supporting documents voluntarily submitted by you;
• Skills, interests and educational preferences.

We will collect only information reasonably necessary for the relevant educational service.

3.3 Account Information

• Login credentials;
• Registered email/mobile number;
• User ID;
• Profile information;
• Account preferences;
• Account activity;
• Course enrolment history.

Passwords, where collected, are intended to be stored using appropriate security mechanisms and should not be stored or displayed in plain text.

3.4 Transaction and Payment Information

• Transaction ID;
• Order ID;
• Amount paid;
• Date and time of transaction;
• Payment status;
• Payment method;
• Billing information;
• Invoice details;
• Refund information;
• Payment gateway reference information.

PHIR Shiksha does not ordinarily store complete debit-card, credit-card, CVV, UPI PIN, net-banking password or other highly sensitive payment credentials on its own servers.

Payments may be processed through authorised third-party payment gateway/service providers. Such providers may process payment information according to their own privacy policies, security standards and applicable laws.

3.5 Communications

• Your name;
• Contact details;
• Enquiry details;
• Messages and correspondence;
• Support requests;
• Feedback;
• Complaints;
• Call or communication records where legally permitted and appropriately notified.

3.6 Technical and Usage Information

• IP address;
• Browser type;
• Operating system;
• Device type;
• Device identifiers;
• Approximate location derived from technical information, where applicable;
• Website pages visited;
• Referring pages;
• Access time and date;
• Session information;
• Clicks and interaction data;
• Error logs;
• Application performance information.

This information may be used for security, analytics, troubleshooting, service improvement and fraud prevention.

4. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA

4.1 Providing Educational Services

To:

• Create and maintain user accounts;
• Provide courses and educational services;
• Process enrolments;
• Facilitate applications;
• Provide course information;
• Enable access to educational content;
• Provide student support;
• Communicate service-related information.

4.2 Admission and University/Institution Services

Where applicable, information may be processed to:

• Facilitate applications;
• Connect users with participating educational institutions;
• Share necessary application information with relevant institutions;
• Support admission processes;
• Verify information submitted by applicants;
• Communicate application status.

Information will be shared only to the extent reasonably necessary for the relevant service.

4.3 Payments and Transactions

• Process payments;
• Confirm successful transactions;
• Generate invoices/receipts;
• Process refunds;
• Reconcile transactions;
• Detect suspicious or fraudulent transactions;
• Maintain financial and transaction records.

4.4 Customer Support

• Respond to enquiries;
• Resolve complaints;
• Provide technical assistance;
• Provide service-related communications;
• Improve customer experience.

4.5 Security and Fraud Prevention

• Prevent unauthorised access;
• Detect fraudulent activity;
• Protect our platform;
• Investigate security incidents;
• Protect users and our organisation;
• Enforce our Terms and Conditions.

4.6 Service Improvement

• Improve website performance;
• Improve application functionality;
• Understand usage patterns;
• Develop new services;
• Improve educational offerings;
• Identify technical problems.

4.7 Marketing and Communications

Where legally permitted and, where required, based on consent, we may use contact information to send course updates, educational opportunities, offers and promotions, events, newsletters and PHIR Shiksha announcements.

You may opt out of non-essential marketing communications at any time.

4.8 Legal and Regulatory Compliance

• Comply with applicable laws;
• Respond to lawful requests;
• Meet accounting and taxation requirements;
• Maintain transaction records;
• Establish, exercise or defend legal claims;
• Prevent fraud or unlawful activities;
• Comply with court, government or regulatory requirements.

5. LEGAL BASIS FOR PROCESSING

Depending on the circumstances, PHIR Shiksha may process personal data on the basis of consent, to provide a service requested by the user, to perform or facilitate a transaction, for legally permitted uses, to comply with applicable legal obligations, to protect the security and integrity of the Services, or for other purposes permitted under applicable law.

Where consent is required, consent will be requested in a clear and understandable manner.

Where applicable, the Digital Personal Data Protection Act, 2023 (DPDP Act) requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action.

6. CONSENT

Where processing is based on consent:

• We will request consent through an appropriate affirmative action;
• The purpose of processing will be communicated clearly;
• We will not unnecessarily bundle unrelated purposes;
• You may withdraw consent where legally applicable;
• Withdrawal of consent will not affect the lawfulness of processing performed before withdrawal;
• Certain services may no longer be available where the relevant processing is necessary to provide those services.

Consent withdrawal mechanisms will be designed to be reasonably accessible and comparable to the manner in which consent was provided.

7. WITHDRAWAL OF CONSENT

You may withdraw consent, where consent is the applicable basis for processing, by using relevant account/privacy settings where available, contacting our privacy contact, sending an email to info@phirshiksha.com, or following the unsubscribe mechanism in promotional communications.

Upon receiving a valid withdrawal request, we will cease relevant processing within a reasonable period, subject to processing that is permitted or required by applicable law.

8. SHARING OF PERSONAL DATA

PHIR Shiksha does not sell or rent users’ personal data for monetary consideration.

We may share necessary personal data with the following categories of recipients:

8.1 Educational Institutions

Where required for an application, admission, counselling or educational service, relevant information may be shared with participating universities, colleges, schools or other educational institutions.

8.2 Payment Gateway and Financial Service Providers

Transaction information may be shared with payment gateways, banks and authorised payment service providers to process payments, refunds, reconciliation and fraud prevention.

8.3 Technology and Service Providers

• Hosting;
• Cloud services;
• Database services;
• Analytics;
• Customer support;
• Communication services;
• Email/SMS services;
• Security services;
• IT maintenance;
• Software services.

Such parties may process personal data only to the extent reasonably required to provide the contracted services and subject to applicable confidentiality and security obligations.

8.4 Government and Regulatory Authorities

We may disclose information where required or permitted by applicable law, regulation, court order or lawful government request.

8.5 Professional Advisers

Information may be disclosed where reasonably necessary to lawyers, auditors, accountants, consultants or professional advisers, subject to appropriate confidentiality requirements.

8.6 Business Transfers

If PHIR Shiksha undergoes a merger, restructuring, acquisition, sale of assets or similar corporate transaction, personal data may be transferred as part of that transaction, subject to applicable law.

9. PAYMENT INFORMATION

PHIR Shiksha may use a third-party payment gateway for online payments.

When you initiate a payment:

1. You may be redirected to or interact with the payment gateway’s secure interface;
2. Payment details may be processed directly by the payment service provider;
3. PHIR Shiksha may receive transaction confirmation/reference information;
4. Payment status may be recorded against your account/order;
5. Refunds, cancellations and payment reversals may require processing through the relevant payment provider.

Users should review the privacy policy and terms of the relevant payment gateway before completing a transaction.

PHIR Shiksha does not request or store your UPI PIN, ATM PIN, CVV or banking password through ordinary customer-support channels.

Never share OTPs, PINs, passwords or payment authentication credentials with PHIR Shiksha employees or any third party claiming to represent PHIR Shiksha.

10. COOKIES AND SIMILAR TECHNOLOGIES

PHIR Shiksha may use cookies and similar technologies to enable essential website functions, maintain login sessions, remember preferences, improve website performance, understand website usage, detect security threats, analyse traffic, improve user experience and support permitted marketing activities.

Essential Cookies

Required for core website functionality.

Functional Cookies

Used to remember user preferences.

Analytics Cookies

Used to understand how visitors interact with our website.

Marketing Cookies

Where used, these may support permitted advertising or campaign measurement.

You may manage cookies through your browser settings. Disabling certain cookies may affect website functionality.

11. THIRD-PARTY WEBSITES AND SERVICES

The PHIR Shiksha website may contain links to third-party websites, applications, payment gateways, educational institutions or other services.

PHIR Shiksha is not responsible for the privacy practices, security, content or policies of third-party websites.

Users should review the privacy policy and terms of any third-party service before providing information.

12. DATA SECURITY

PHIR Shiksha takes reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, misuse, unauthorised disclosure, alteration and cybersecurity threats.

Depending on the nature of the data and risk, safeguards may include:

• Access controls;
• Authentication mechanisms;
• Role-based access;
• Encryption or secure transmission;
• Secure hosting;
• Logging and monitoring;
• Backup and recovery procedures;
• Security testing;
• Vendor controls;
• Employee confidentiality obligations.

No digital system can guarantee absolute security. Users should also maintain the confidentiality of their login credentials and immediately notify us of any suspected unauthorised account activity.

13. DATA BREACHES AND SECURITY INCIDENTS

In the event of a personal data breach, PHIR Shiksha will take reasonable steps to:

1. Identify and investigate the incident;
2. Contain and mitigate the impact;
3. Assess affected data and users;
4. Take corrective and preventive measures;
5. Make notifications or disclosures required by applicable law;
6. Cooperate with competent authorities where required.

14. DATA RETENTION

PHIR Shiksha will retain personal data only for as long as reasonably necessary for:

• Providing Services;
• Maintaining user accounts;
• Completing transactions;
• Processing refunds;
• Meeting legal and regulatory obligations;
• Accounting and taxation;
• Resolving disputes;
• Preventing fraud;
• Maintaining security;
• Enforcing agreements;
• Establishing or defending legal claims.

When personal data is no longer required, PHIR Shiksha will take reasonable steps to delete, destroy, anonymise or otherwise dispose of it, subject to applicable law and legitimate retention requirements.

15. ACCOUNT DELETION

Users may request deletion of their PHIR Shiksha account by contacting info@phirshiksha.com.

The request should include sufficient information to allow us to identify the relevant account without unnecessarily requesting additional personal information.

Upon receiving a valid request:

1. We will verify the request where reasonably necessary;
2. We will assess whether the account/data can be deleted;
3. We will delete or anonymise information that is no longer required;
4. Certain information may be retained where required by law or reasonably necessary for legal, accounting, fraud-prevention, security or transaction-related purposes;
5. Retained information will remain subject to applicable privacy and security obligations.

Deletion of an account may result in loss of access to courses, certificates, applications, transaction history or other Services associated with that account.

16. DATA PRINCIPAL RIGHTS

Subject to applicable law and prescribed procedures, users may have rights including:

• The right to obtain information about processing of their personal data;
• The right to request correction or updating of inaccurate personal data;
• The right to request erasure/deletion where applicable;
• The right to withdraw consent where processing is based on consent;
• The right to access information regarding processing;
• The right to nominate another individual where applicable under law;
• The right to raise a grievance regarding processing of personal data.

The DPDP framework provides rights to Data Principals and requires mechanisms through which such rights can be exercised.

Requests may be submitted to info@phirshiksha.com.

17. GRIEVANCE REDRESSAL

If you have any concern regarding the processing of your personal data, you may contact our Grievance Officer.

We will acknowledge and handle grievances in accordance with applicable law and our internal grievance-handling procedures.

Users may be required to provide sufficient information to enable us to investigate and respond to their grievance.

18. CHILDREN’S PERSONAL DATA

PHIR Shiksha may provide educational services that could involve students who are below eighteen years of age.

Where applicable law requires parental or lawful guardian consent for processing a child’s personal data, PHIR Shiksha will implement appropriate mechanisms for obtaining and verifying such consent.

We will not knowingly undertake processing of children’s personal data in a manner prohibited by applicable law.

Parents or lawful guardians who believe that information relating to a child has been submitted improperly may contact us at info@phirshiksha.com.

The DPDP Act defines a child as an individual who has not completed eighteen years of age and contains specific requirements concerning children’s data.

19. ACCURACY OF INFORMATION

Users are responsible for providing accurate, complete and updated information.

Users should promptly update their information if there is any change.

PHIR Shiksha may rely on information provided by users unless it has reason to believe that the information is inaccurate or incomplete.

20. INTERNATIONAL DATA TRANSFERS

PHIR Shiksha may use technology, hosting, communication, analytics or other service providers that may process information outside India.

Where personal data is transferred outside India, PHIR Shiksha will undertake such transfer subject to applicable Indian law, contractual safeguards and any restrictions or requirements applicable to such transfer.

The DPDP framework provides for government-regulated conditions concerning transfers of personal data outside India.

21. DIRECT MARKETING

Where permitted by law, PHIR Shiksha may communicate with users about educational programs, courses, admissions, events, webinars, offers, new Services and platform updates.

Users may unsubscribe from promotional communications at any time.

Service-related communications, including transaction confirmations, security alerts, account notifications and important service information, may continue where necessary.

22. DO-NOT-TRACK AND BROWSER SIGNALS

Different browsers and devices may offer privacy preferences or tracking controls.

PHIR Shiksha may not respond to every browser-based tracking signal where technical standards or applicable law do not require such response.

Users can manage cookies and privacy controls through their browser or device settings.

23. FRAUD PREVENTION

PHIR Shiksha may process information to detect and prevent:

• Payment fraud;
• Identity misuse;
• Account takeover;
• Fake applications;
• Unauthorised access;
• Abuse of promotional offers;
• Other unlawful or fraudulent activities.

Information may be shared with relevant payment providers, technology providers, institutions or authorities where reasonably necessary and legally permitted.

24. BUSINESS AND SERVICE COMMUNICATIONS

By registering for a PHIR Shiksha service, users may receive communications necessary for:

• Account verification;
• OTP/authentication;
• Course registration;
• Application updates;
• Payment confirmation;
• Refund status;
• Important service announcements;
• Security notifications;
• Customer support.

These communications are operational in nature and may continue even if the user has opted out of promotional communication.

25. THIRD-PARTY DATA PROCESSORS

PHIR Shiksha may appoint third-party Data Processors to support its operations.

Such processors may include providers of:

• Cloud hosting;
• Website/application development;
• Payment processing;
• Email;
• SMS;
• WhatsApp/business communication;
• Analytics;
• CRM;
• Customer support;
• Cybersecurity;
• Document management;
• IT infrastructure.

PHIR Shiksha will seek to ensure that processors handle personal data in accordance with applicable contractual and legal requirements.

26. USER RESPONSIBILITIES

Users must:

1. Provide accurate information;
2. Keep account credentials confidential;
3. Not share passwords or OTPs;
4. Notify PHIR Shiksha of suspected unauthorised access;
5. Use the Services lawfully;
6. Not attempt to access another user’s account;
7. Not submit personal information belonging to another individual without appropriate authority or consent.

27. CHANGES TO THIS PRIVACY POLICY

PHIR Shiksha may update this Privacy Policy from time to time to reflect changes in our Services, technology, applicable laws, regulatory requirements, data processing practices or security measures.

The updated version will be published on the PHIR Shiksha website with a revised Last Updated date.

Where legally required, we will provide additional notice or obtain consent for material changes.

28. GOVERNING LAW

This Privacy Policy shall be governed by the laws applicable in India.

Any dispute concerning this Privacy Policy shall be subject to the applicable jurisdiction of the competent courts/authorities having jurisdiction over Indore, Madhya Pradesh, India, subject to applicable law.

29. CONTACT US

For questions regarding this Privacy Policy, data processing, consent withdrawal, account deletion or privacy-related matters, please contact:

30. QUICK PRIVACY SUMMARY

What we collect

Information necessary to create accounts, provide educational services, process applications, process payments, communicate with users and maintain platform security.

Why we collect it

To provide PHIR Shiksha Services, process transactions, support users, improve the platform, prevent fraud and comply with law.

Who we may share it with

Relevant educational institutions, payment gateways, technology/service providers, professional advisers and authorities where legally required or permitted.

Do we sell personal data?

PHIR Shiksha does not sell or rent personal data for monetary consideration.

Do we store card details?

PHIR Shiksha does not ordinarily store complete card credentials such as CVV or banking passwords. Payment processing may be handled by authorised third-party payment providers.

Can I delete my account?

Yes, subject to applicable law and legitimate retention requirements.

Can I withdraw consent?

Yes, where processing is based on consent and subject to applicable legal requirements.

Can I raise a privacy complaint?

Yes. Contact the PHIR Shiksha Privacy/Grievance contact provided in this Policy.

IMPORTANT NOTICE

This Privacy Policy is intended to provide a comprehensive privacy framework for PHIR Shiksha. It is designed to align with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable rules and regulations, as amended or brought into force from time to time. PHIR LIFE should review this Policy with its legal/compliance adviser before publication and periodically thereafter to confirm that it accurately reflects the website, mobile application, payment arrangements, third-party processors, data retention practices, cookie/analytics technologies, institutional data-sharing arrangements and applicable legal requirements.

This Privacy Policy should be read together with PHIR Shiksha’s applicable Terms and Conditions, Refund/Cancellation Policy, payment terms and other service-specific policies.

Nothing in this Privacy Policy limits any rights or obligations that cannot lawfully be excluded or restricted under applicable law.