DRAFT — pending legal review. Not yet binding; final wording will be confirmed before launch.
BASU LEARN (“we”, “the platform”), operated by Basu Nextgen Education Pvt Ltd, connects families with vetted home tutors. We are committed to protecting personal data and to complying with India's Digital Personal Data Protection Act, 2023 (DPDP). This notice explains what we collect, why, and the choices you have.
Who is the account holder
The parent or legal guardian is the account holder and data principal. BASU LEARN serves children only through their parent's account. We rely on verifiable parental consent (captured at phone-OTP login) as the lawful basis for processing a child's data.
What we collect
- Account: parent name, mobile number, city, and consent record.
- Child (student) record: name, class/board/school, attendance, marks, and session history — entered by you or by the tutor delivering classes.
- Booking & billing: demo requests, subscription plan, and manually-recorded payments (UPI/cash/bank) with GST invoices. We do not store card details.
- Device basics needed to run the app (e.g. push-notification token if you opt in).
Children's data — special protections
- We never profile children, run behavioural tracking, or serve targeted advertising to minors.
- We use no third-party analytics or tracking SDKs anywhere in the app.
- A child's progress data is visible only to the parent account, the assigned tutor, and authorised BASU LEARN staff.
- We collect the minimum needed to deliver and track tuition.
How we use it
To match you with tutors, run free demos, deliver and track classes, process subscriptions and invoices, and send transactional notifications (e.g. demo confirmed, payment recorded). We do not send marketing to children and do not sell personal data.
Your rights (DPDP)
- Access and correct your and your child's data.
- Withdraw consent and request erasure of the child's record.
- Nominate, and raise grievances with, our Data Protection contact.
- Request a summary of processing.
To exercise any right, contact our grievance officer (details below). We respond within the timelines DPDP prescribes.
Retention & security
We keep data only as long as needed to provide the service or meet legal/tax obligations, then delete or anonymise it. Access is role-restricted and write operations are audited.
Grievances
Data Protection / Grievance Officer: [name + email — to be finalised]. We will name a contactable officer before public launch.
Last updated: DRAFT