eGuruzy Learning Shortcuts Private Limited (“Company”, “we”, “us”, “our”), operating under the brands eGuruzy® and Counseling Shortcuts™ across the websites, web applications and mobile applications listed in Annexure A (each a “Platform”), is committed to protecting the personal data of every individual who uses a Platform. This Privacy Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and rules made thereunder, and other Applicable Law, and describes how we collect, use, store, share and protect personal data, and the rights available to you in respect of your personal data.
This Policy applies uniformly across every Platform listed in Annexure A. Where a Platform or Service is governed by a separate, signed service agreement, this Policy applies in addition to, and shall be read together with, the data-protection provisions of that agreement.
1. DEFINITIONS
“Personal Data” means any data about an individual who is identifiable by or in relation to such data, in accordance with the DPDP Act.
“Data Principal” means the individual to whom the Personal Data relates, and, where that individual is a child, includes the parent or lawful guardian of the child.
“Data Fiduciary” means the Company, which determines the purpose and means of processing Personal Data collected through the Platforms.
“Child” means an individual who has not completed the age of eighteen (18) years, in accordance with the DPDP Act.
“Consent” means the free, specific, informed, unconditional and unambiguous indication of the Data Principal’s wishes, given by clear affirmative action, signifying agreement to the processing of their Personal Data for a specified purpose.
“Processing” means any operation performed on Personal Data, including collection, storage, use, sharing, and erasure.
2. THE DATA FIDUCIARY
Personal Data collected through the Platforms is processed by eGuruzy Learning Shortcuts Private Limited (CIN: U80903UP2022PTC173928), having its Registered Office at 2nd Floor, Plot No. A-100, A Block, Sector 58, Noida, Gautam Buddha Nagar, Uttar Pradesh, India – 201301.
3. PERSONAL DATA WE COLLECT
3.1 Information provided directly by you
Identity and contact information: name, date of birth, gender, address, email address, and mobile number.
Account credentials, and information provided during registration, enrolment or application (including academic records, examination details, and, where relevant to admission/counselling Services, information about your preferences and eligibility).
Payment-related information, collected and processed through our payment gateway partners; we do not store full card or bank account numbers on our own servers.
Communications with our CARE Team/Grievance Officer, including recordings of onboarding and grievance calls made with your consent under Clause 5.
3.2 Information collected automatically
Device and usage information: IP address, browser type, operating system, pages visited, and session activity, collected through server logs and cookies (see Clause 9).
3.3 Device permissions (mobile applications)
Our mobile applications may request specific device permissions, each used strictly for the stated purpose and never collected in bulk merely because a permission is available:
Camera and photo/media storage – solely to enable document upload (such as identity or academic documents) or profile photo upload, where you choose to use that feature.
SMS/OTP access – solely to auto-read a one-time password for the purpose of verifying your mobile number during login or transaction confirmation.
Location – solely where a feature you actively use requires it (such as showing nearby centres), and never collected in the background.
Each such permission is requested at the point the relevant feature is used, may be declined without loss of access to unrelated features, and may be withdrawn at any time through your device settings, subject to the resulting loss of that specific feature.
4. PURPOSE OF PROCESSING
We process your Personal Data only for the following specified purposes: (a) creating and administering your account; (b) delivering the Service(s) you have registered for or enquired about; (c) processing payments and refunds; (d) responding to your queries and grievances; (e) verifying your identity and preventing fraud; (f) complying with our obligations under Applicable Law; and (g) with your consent, sending you promotional or marketing communications. We do not process Personal Data for any purpose beyond those disclosed to you at the time of collection, or subsequently consented to by you.
5. CONSENT
5.1
We seek your Consent, through a clear affirmative action, before collecting or processing your Personal Data for a specified purpose, except where processing is permitted without Consent under the DPDP Act (such as for compliance with a legal obligation or in response to a medical emergency).
5.2
You may withdraw your Consent at any time, with the same ease with which it was given, by writing to the Grievance Officer under Clause 11. Withdrawal of Consent does not affect the lawfulness of processing carried out before withdrawal, and does not affect our ability to retain data required to comply with a legal obligation or to enforce a legal claim.
5.3
Where a call is recorded under Clause 3.1 for quality-assurance, training or evidentiary purposes, this is disclosed to you at the outset of the call, and your continuation of the call constitutes your Consent to such recording.
6. PROCESSING OF A CHILD’S PERSONAL DATA
6.1
Where a Data Principal is a Child, we process their Personal Data only with the verifiable consent of their parent or lawful guardian, obtained at the time of enrolment (consistent with the parent/guardian co-contracting requirement described in Clause 3.2 of our Terms and Conditions).
6.2
We do not undertake tracking or behavioural monitoring of a Child, and do not carry out targeted advertisement directed at a Child, and do not process a Child’s Personal Data in any manner that is likely to cause any detrimental effect on the well-being of the Child, in accordance with the DPDP Act.
7. HOW WE SHARE YOUR PERSONAL DATA
We do not sell or rent your Personal Data to any third party. We share Personal Data only in the following circumstances:
With payment-gateway providers, solely to process a payment or refund you have initiated.
With service providers engaged to support platform operations (such as cloud hosting, SMS/email delivery, or customer-support tools), who are contractually bound to process the data only for the purpose for which it was shared and in accordance with our instructions.
With a third-party institution to which you have applied, solely to the extent necessary to process your application or admission, and only with your knowledge at the time of application.
Where required by an order of a court, tribunal, or law-enforcement/regulatory authority acting under Applicable Law.
In connection with a merger, acquisition, or sale of business assets, subject to the acquiring entity being bound by protections at least equivalent to this Policy.
8. DATA RETENTION AND ERASURE
We retain your Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required under Applicable Law (including limitation periods for the resolution of disputes). Where you withdraw Consent or request erasure under Clause 10, and no legal obligation requires further retention, we will erase your Personal Data, or cause our processors to erase it, within a reasonable period.
9. COOKIES AND TRACKING TECHNOLOGIES
Our Platforms use cookies and similar technologies to remember your preferences, keep you logged in, and understand how a Platform is used, so that we can improve it. You may disable cookies through your browser settings; doing so may limit certain Platform functionality. We do not use cookies to build advertising profiles of Children.
10. YOUR RIGHTS AS A DATA PRINCIPAL
Subject to the DPDP Act, you have the right to:
Obtain a summary of the Personal Data we hold about you and the processing activities undertaken;
Request correction, completion, or updating of your Personal Data;
Request erasure of your Personal Data, where retention is no longer necessary for the purpose for which it was collected or required by Applicable Law;
Withdraw Consent at any time, as described in Clause 5.2;
Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
Register a grievance in the manner described in Clause 11.
We will respond to a verified request under this Clause 10 within thirty (30) days of receipt.
11. GRIEVANCE OFFICER / DATA PROTECTION CONTACT
In accordance with the DPDP Act and the Information Technology Act, 2000, the Company has designated the following contact for all queries, complaints or requests regarding this Policy or your Personal Data:
Grievance Officer: Ms. Aditi Ranjan
Email: grievance@eguruzy.com
Address: 2nd Floor, Plot No. A-100, A Block, Sector 58, Noida, Gautam Buddha Nagar, Uttar Pradesh, India – 201301
We will acknowledge a grievance within forty-eight (48) hours and endeavour to resolve it within thirty (30) days. If you are not satisfied with our response, you may approach the Data Protection Board of India or any other competent authority under Applicable Law.
12. DATA SECURITY
We implement reasonable security safeguards, including technical, administrative and physical measures, to protect Personal Data against unauthorised access, disclosure, alteration or destruction, consistent with the standards prescribed under the Information Technology Act, 2000 and rules made thereunder. Access to Personal Data within the Company is restricted to personnel who require it for the purposes described in Clause 4. While we take these safeguards seriously, no method of transmission or storage over the internet is entirely secure, and we cannot guarantee absolute security.
13. DATA BREACH NOTIFICATION
In the event of a personal data breach that is likely to affect you, we will notify you and the Data Protection Board of India, in the manner and within the timelines prescribed under the DPDP Act.
14. CROSS-BORDER TRANSFER
Personal Data collected through the Platforms is primarily stored and processed in India. Where Personal Data is transferred outside India (including to a cloud service provider with servers outside India), such transfer is made only to a country or territory not restricted by the Central Government under the DPDP Act, and subject to appropriate contractual safeguards with the recipient.
15. CHANGES TO THIS POLICY
We may update this Policy from time to time to reflect changes in our practices or in Applicable Law. The updated Policy will be posted on the Platforms with a revised “Last Updated” date, and, where the change is material, we will provide additional notice (such as by email) before it takes effect.
16. CONTACT US
For any question about this Policy that does not concern the exercise of your rights under Clause 10, write to info@eguruzy.com.