PRIVACY POLICY
This Privacy Policy governs how StayStillScaleHigh collects, uses, retains, and discloses your personal information. By accessing or using our platform or services, you consent to the practices described in this policy. If you do not agree with these terms, please discontinue use of the platform immediately.
1. INTRODUCTION AND IDENTITY OF DATA FIDUCIARY
StayStillScaleHigh ("we," "our," or "us") is the data controller responsible for the personal information you provide when using our platform, attending our events, accessing our content, or participating in our community.
We are committed to protecting your personal data and processing it in a fair, transparent, and lawful manner in accordance with applicable data protection laws.
We are committed to protecting your personal data and processing it in a fair, transparent, and lawful manner in accordance with applicable data protection laws.
2. DEFINITIONS
In this Policy, unless the context otherwise requires:
"Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023, and includes Sensitive Personal Data.
"Sensitive Personal Data or Information" (SPDI) means data as defined under Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including passwords, financial information such as bank account and payment card details, and health-related data.
"Data Fiduciary" has the meaning assigned to it under the Digital Personal Data Protection Act, 2023, and refers to the Operator in the context of this Policy.
"Data Principal" has the meaning assigned to it under the Digital Personal Data Protection Act, 2023, and refers to the individual (i.e., the Subscriber or user) whose personal data is being processed.
"Data Processor" means any person who processes personal data on behalf of the Data Fiduciary.
"Processing" means any operation performed upon personal data, including collection, recording, storage, retrieval, use, disclosure, transmission, erasure, or destruction.
"Consent" means a free, specific, informed, unconditional, and unambiguous indication of the Data Principal’s agreement to the processing of their personal data for a specified purpose, as required under the DPDPA.
"Cookies" means small text files placed on a device by a website or application to store and retrieve information about the user’s browsing activity.
"Platform", "Operator", "Subscriber", "Terms", and other defined terms have the meanings assigned to them in the Terms and Conditions of Use.
3. PERSONAL DATA WE COLLECT
3.1 Data Provided Directly by You
When You register, subscribe, or otherwise interact with the Platform, You voluntarily provide us with the following categories of personal data:
Identity Data: Full name, username or display name, and photograph (if uploaded as a profile picture).
Contact Data: Email address, mobile number, and postal address (where required for billing or correspondence).
Account Credentials: Password (stored in encrypted form; we do not have access to Your plain-text password).
Payment and Financial Data: Transaction reference numbers, payment method type (e.g., credit card, UPI, net banking), and billing address. Full payment card details are processed solely by the Payment Gateway and are not stored on our servers.
Educational and Interaction Data: Course enrolment history, progress records, quiz responses, assignments submitted, completion status, and certificates issued.
Communications Data: Messages, queries, feedback, reviews, comments, and any other content You submit through the Platform’s communication or interactive features.
Identity Verification Data: Government-issued identification documents or other KYC documentation, where required to be collected under Applicable Laws.
3.2 Data Collected Automatically
When You access or use the Platform, we may automatically collect the following data through cookies, web beacons, log files, and similar technologies:
Device and Technical Data: IP address, browser type and version, operating system, device type, device identifier, time zone setting, and screen resolution.
Usage Data: Pages visited, content accessed, videos played, duration of viewing sessions, clickstream data, search queries made within the Platform, and navigation paths.
Log Data: Server logs recording access times, error reports, and actions performed on the Platform.
Location Data: Approximate geographic location derived from IP address (country and city level only), unless You grant explicit permission for precise location access.
3.3 Data Received from Third Parties
We may receive personal data about You from third parties in the following circumstances:
Payment Gateway Providers: Transaction confirmation details, transaction identifiers, and payment status updates.
Social Login Providers: If You choose to register or log in using a third-party service (such as Google), we receive the data You have authorised that service to share with us, typically Your name, email address, and profile picture.
Analytics Providers: Aggregated and pseudonymised analytical data about how users interact with the Platform.
3.4 Data You Are Not Required to Provide
Certain fields on the Platform are optional. Where fields are mandatory, they will be clearly marked. You may choose not to provide optional data, though this may limit certain features or the quality of Your experience on the Platform.
4. PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA
We process Your personal data only for specific, lawful purposes. The table below sets out the categories of data we may collect and the corresponding purposes for which each is processed:
Category of Data
Purpose of Processing
Providing membership access and platform services
Providing membership access and platform services
Account Credentials
Authentication and secure access to Your account; password recovery.
Payment and Financial Data
Processing subscription and enrolment fees; issuing invoices and receipts; complying with GST obligations; fraud prevention; record-keeping under the Income Tax Act, 1961.
Educational and Interaction Data
Delivering Course content; tracking and displaying Your progress; issuing certificates; improving Course quality; analysing learning outcomes.
Communications Data
Responding to Your queries; moderating platform discussions; improving the Platform; addressing complaints and grievances.
Device, Technical, and Usage Data
Maintaining platform security; diagnosing technical issues; improving platform performance and user experience; analysing engagement trends.
Location Data (approximate)
Fraud prevention; compliance with regional access restrictions; tailoring content or pricing where applicable.
Identity Verification Data
Compliance with KYC and anti-money laundering requirements under Applicable Laws.
4.1 The Operator processes Your personal data on the following legal bases, as applicable:
Contractual Necessity: Processing necessary to perform Our obligations to You under the Terms and Conditions of Use (e.g., delivering the Course, processing payments).
Consent: Where You have provided free, specific, informed, and unambiguous consent, particularly for the processing of Sensitive Personal Data, marketing communications, and the use of non-essential cookies.
Legal Obligation: Processing required to comply with Applicable Laws, including tax laws, anti-money laundering regulations, and court or regulatory orders.
Legitimate Interest: Processing for Our legitimate business interests, such as maintaining platform security, preventing fraud, and improving the Platform, where such interests are not overridden by Your rights and interests.
4.2 We shall not use Your personal data for any purpose that is incompatible with the purposes for which it was originally collected, without Your prior consent.
5. MARKETING COMMUNICATIONS
We may send you information about our services, events, resources, and community updates that we believe may be of interest to you. We will only do so where we have a lawful basis (your consent, or our legitimate interest where permitted).
You may opt out of marketing communications at any time by clicking the "Unsubscribe" link in any email or by updating your preferences in your member account settings. Opting out of marketing communications will not affect service-related messages.
You may opt out of marketing communications at any time by clicking the "Unsubscribe" link in any email or by updating your preferences in your member account settings. Opting out of marketing communications will not affect service-related messages.
6. COOKIES AND TRACKING TECHNOLOGIES
6.1 Types of Cookies Used
We use the following categories of cookies and similar tracking technologies on the Platform:
Strictly Necessary Cookies: Essential for the Platform to function correctly, including session management, authentication, and security. These cannot be disabled without affecting core functionality.
Functional Cookies: Enable enhanced features such as remembering Your preferences, language settings, and viewing history.
Analytics Cookies: Help Us understand how Subscribers use the Platform, including which pages are visited most frequently and how users navigate through content. We may use third-party analytics services (e.g., Google Analytics) for this purpose. Data collected is aggregated and pseudonymised wherever possible.
Payment and Security Cookies: Placed by the Payment Gateway and security providers to prevent fraud and facilitate secure transactions.
6.2 Third-Party Cookies
Certain third-party service providers integrated into the Platform (such as payment processors, analytics providers, and video hosting services) may place their own cookies on Your device. These are subject to the respective third party’s privacy and cookie policies, over which We have no control.
6.3 How to Manage Cookies
You may control and delete cookies through Your browser settings. Please note that disabling certain cookies may impair the functionality of the Platform.
7. SHARING AND DISCLOSURE OF PERSONAL DATA
7.1 No Sale, Rent or Trade of Data
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.
7.2 Service Providers and Data Processors
We may share your data with trusted third-party service providers who process data on our behalf under written data processing agreements, including:
Payment Gateway Providers: To process subscription and enrolment fees securely.
Cloud Hosting and Infrastructure Providers: To host, store, and deliver the Platform and its content.
Email and Communication Service Providers: To deliver transactional emails, notifications, and support communications.
Video Streaming and Content Delivery Services: To host and stream Course videos.
Analytics Providers: To provide aggregated analytical reports about Platform usage.
Customer Support Tools: To manage and respond to Subscriber queries and grievances.
All such service providers maintain appropriate technical and organisational security measures and to process personal data only for the specified purposes.
7.3 Legal and Regulatory Disclosure
We may disclose Your personal data without Your consent where required or permitted by Applicable Laws, including:
In response to a valid court order, summons, or direction issued by a competent court, tribunal, or judicial authority;
In response to a lawful demand or requisition by a government department, law enforcement agency, tax authority, or regulatory body;
To comply with Our obligations under the Information Technology Act, 2000, the Prevention of Money Laundering Act, 2002, the Income Tax Act, 1961, or any other Applicable Laws; or
Where disclosure is necessary to prevent, detect, or investigate an offence, fraud, or breach of these Terms.
7.4 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or a substantial portion of the Operator’s business or assets, personal data held by the Operator may be transferred to the successor entity. In such circumstances, We shall notify You via the email address registered on Your account and shall ensure that the successor entity is bound by a privacy policy that affords a standard of protection at least equivalent to this Policy.
7.5 No Disclosure to Advertisers
We may disclose your personal data where required by law, court order, or governmental authority, or where necessary to protect our legal rights or the safety of our members or the public.
8. CROSS-BORDER TRANSFER OF PERSONAL DATA
8.1 The Platform’s servers and data storage infrastructure are located in India and some jurisdictions through third-party service providers. Some of Our third-party service providers (including cloud infrastructure, video hosting, and analytics providers) may be located in, or may process data in, countries outside India.
8.2 By using the Platform and providing Your personal data, You acknowledge and consent to the transfer of Your data as described in this Clause.
9. DATA RETENTION
9.1 We retain Your personal data only for as long as is necessary for the purposes for which it was collected, or as required by Applicable Laws, whichever is longer.
9.2 Upon expiry of the applicable retention period, personal data shall be securely deleted or anonymised in a manner that renders it irretrievable, in accordance with the Operator’s internal data destruction procedures and the requirements of Applicable Laws.
9.3 Notwithstanding the above, We may retain personal data for a longer period where necessary to comply with a legal obligation, to defend or exercise legal claims, or pursuant to a direction from a competent authority.
10. DATA SECURITY
10.1 The Operator implements appropriate technical and organisational measures to protect Your personal data against unauthorised access, disclosure, alteration, loss, or destruction, in accordance with:
The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and
Industry-standard security practices as applicable to an online educational platform of comparable nature and scale.
10.2 The security measures we employ include, without limitation:
Transmission of data over encrypted channels using SSL/TLS protocols;
Storage of passwords using one-way cryptographic hashing with salting;
Restricted access controls ensuring that personal data is accessible only to authorised personnel or systems on a need-to-know basis;
Regular security assessments of the Platform’s infrastructure; and
Data minimisation practices, collecting only the personal data necessary for the stated purposes.
10.3 While We take all reasonable measures to secure Your personal data, no method of transmission over the internet or electronic storage is completely secure. The Operator cannot guarantee absolute security. You are responsible for maintaining the confidentiality of Your account credentials.
10.4 Personal Data Breach. In the event of a personal data breach that is likely to result in a risk to the rights of Data Principals, the Operator shall:
Take immediate steps to contain and mitigate the breach;
Notify the Data Protection Board of India, upon its establishment and as required under the DPDPA and rules thereunder; and
Notify affected Subscribers at their registered email address, where required by the DPDPA or where the breach poses a high risk to the Subscriber’s rights and interests, providing details of the nature of the breach and recommended protective measures.
11. YOUR RIGHTS AS A DATA PRINCIPAL
Depending on your jurisdiction, you may have the following rights in relation to your personal data:
Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data where there is no compelling reason for continued processing.
Right to Restriction: Request that we restrict processing of your data in certain circumstances.
Right to Data Portability: Receive your data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interest or for direct marketing.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
To exercise any of the above rights, please submit a request through your member account portal. We will respond within the timeframe required by applicable law.
12. CHILDREN’S PERSONAL DATA
Our platform is intended for individuals aged 18 and above. We do not knowingly collect or process personal data from children under the age of 18. If we become aware that a child has provided personal data, we will take immediate steps to delete it.
13. THIRD-PARTY LINKS AND INTEGRATED SERVICES
13.1 The Platform may contain links to third-party websites, payment gateways, social media platforms, or other external services. This Policy does not apply to such third-party services, and the Operator is not responsible for the privacy practices of any third party. We encourage You to review the privacy policies of any third-party services You access through the Platform.
13.2 Where We integrate third-party tools such as video hosting platforms, payment gateways, or single sign-on providers, Your use of such integrated services may involve the transmission of personal data to those providers in accordance with their own terms of service and privacy policies.
14. APPLICABLE LAWS AND COMPLIANCE FRAMEWORK
14.1 The Operator processes personal data in compliance with the following laws, rules, and regulatory frameworks, as applicable.
14.2 The Operator shall update its data processing practices and this Policy as required to reflect changes in the above regulatory framework, including the progressive notification of the DPDPA’s provisions and all other Applicable Law.
15. GRIEVANCE OFFICER AND CONTACT INFORMATION
If you have any concerns, complaints, or requests regarding this Privacy Policy or the handling of your personal data, please contact our designated Grievance Officer through the contact form available in your member account portal or on our official website.
We will acknowledge your grievance within 48 hours and aim to resolve it within 30 days of receipt.
16. CHANGES TO THIS PRIVACY POLICY
16.1 The Operator reserves the right to update, modify, or revise this Policy at any time to reflect changes in Our data processing practices, applicable legal requirements, or Platform operations. The revised Policy shall be posted on the Platform with an updated “Last Updated” date.
16.2 For material changes to this Policy including changes that significantly alter the purposes of processing, categories of data collected, sharing practices, or Your rights We shall provide You with prior notice via email to Your registered address, and shall seek fresh consent where required by Applicable Laws.
16.3 Your continued use of the Platform following the effective date of a revised Policy shall constitute Your acceptance of the revised terms, except where Your fresh consent is required, in which case continued use shall be conditional on such consent being provided.
17. GOVERNING LAW
Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts of the jurisdiction in which StayStillScaleHigh is registered, in accordance with applicable laws.