PRIVACY POLICY

Success Beyond Struggle ("the Platform", "we", "our", or "us") is an online platform that connects learners — including students of all ages — with qualified tutors for educational purposes. We are committed to protecting the privacy of every person who uses our Platform, including learners, parents, guardians, and tutors.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you under the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian law.

By registering on or using the Platform, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Platform.

The following terms are used in this Policy:

• "Data Principal" means the individual to whom the personal data relates — i.e., the learner, tutor, parent, or guardian using the Platform.
• "Data Fiduciary" means Success Beyond Struggle, which determines the purpose and means of processing personal data.
• "Personal Data" means any data by which an individual can be identified, directly or indirectly.
• "Processing" means any operation performed on personal data, including collection, storage, use, and deletion.
• "Consent Manager" means a board-registered entity through which a Data Principal may give, manage, review, or withdraw consent, as applicable under the DPDP Act.
• "Minor" means a person under the age of 18 years.

We collect only the personal data that is necessary for the Platform to function. The data collected varies depending on whether you are a learner, a parent or guardian, or a tutor.

2.1 Learners and Parents / Guardians

• Full name
• Email address
• Mobile number
• City or region of residence
• Educational level and subjects of interest
• Age (to determine whether the learner is a minor)
• Payment information (processed securely via our payment gateway; we do not store card details)
• Communications submitted through the Platform (messages, queries, feedback)

2.2 Tutors

• Full name
• Email address
• Mobile number
• City or region of residence
• Educational qualifications and professional experience
• Subjects and teaching preferences
• Profile photograph
• Identity verification information (where required for onboarding)
• Bank account details (for the purpose of receiving payments through the Platform)
• Communications submitted through the Platform

2.3 Automatically Collected Technical Data

When you access the Platform, we automatically collect limited technical data to keep the Platform secure and functioning, including:

• IP address
• Device type and operating system
• Browser type and version
• Pages visited and session duration
• Date and time of access

This data is used solely for security monitoring, technical troubleshooting, and improving Platform performance. It is not used to profile or identify individual users for any other purpose.

Under the DPDP Act, we are required to process personal data only for a lawful purpose for which a Data Principal has given consent, or for a legitimate use recognised under the Act. The table below sets out our purposes and their basis:

We do not process personal data for any purpose beyond what is listed above without obtaining fresh consent.

We obtain free, specific, informed, and unambiguous consent from every Data Principal before collecting or processing their personal data, in compliance with Section 6 of the DPDP Act.

Consent is obtained:

• At the time of registration, through a clear consent notice that specifies what data is collected and why.
• Separately for each distinct purpose for which data is processed.
• In a language that is clear and plain.

You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the legality of processing carried out before withdrawal. To withdraw consent, please contact us at the details provided in Section 13.

Withdrawal of consent for essential services (such as account creation or payment processing) may result in your inability to access certain features or continue using the Platform.

The Platform serves learners of all ages, including children under 18. We treat the protection of minors' personal data as a matter of highest priority, in compliance with Section 9 of the DPDP Act.

5.1 Parental / Guardian Consent

We do not collect or process the personal data of a Minor without the verifiable consent of their parent or legal guardian. The parent or guardian must:

• Register on the Platform on behalf of the Minor, or separately verify their consent during the Minor's registration process.
• Confirm that they are the lawful parent or guardian of the Minor.
• Review and agree to this Privacy Policy on behalf of the Minor.

We are in the process of implementing a formal verifiable consent mechanism for minors as required under the DPDP Act and the rules thereunder. Until such mechanism is in place, registration on behalf of a Minor is permitted only by a parent or guardian who accepts these terms.

5.2 Restrictions on Processing Minors' Data

In accordance with the DPDP Act, we do not:

• Process personal data of a Minor in a manner that is detrimental to their wellbeing.
• Track or monitor Minors' behaviour for the purpose of targeted advertising or profiling.
• Use a Minor's data for any purpose other than providing the educational services requested.

5.3 Discovered Violations

If we become aware that personal data of a Minor has been collected without the required parental or guardian consent, we will promptly delete such data and notify the parent or guardian.

6.1 No Third-Party Data Sharing

We do not sell, rent, trade, or share your personal data with any third party for marketing, advertising, or commercial purposes.

6.2 Sharing Between Learners and Tutors

To facilitate tutoring sessions, certain information is shared between learners (or their parents/guardians) and tutors on the Platform. This is limited to:

• Name, contact details, and session-related information — shared only to the extent necessary to coordinate tutoring.
• Tutor profile information (qualifications, subjects, ratings, and general location) — visible to learners and parents searching the Platform.

Tutors consent to their profile being visible to prospective learners at the time of registration.

6.3 Payment Processing

Payment transactions are processed through a secure third-party payment gateway. We share only the minimum information required to complete a transaction. We do not store credit or debit card details on our servers. The payment gateway operates under its own privacy policy, which we encourage you to review.

6.4 Disclosure Required by Law

We may disclose personal data where required by:

• A court order or direction of a competent authority under Indian law.
• A requirement under the DPDP Act or any other applicable legislation.
• A legitimate request from a law enforcement agency acting within its authority.

In all such cases, we will disclose only the minimum data required and, where legally permissible, will notify the affected Data Principal.

7.1 Storage Location

All personal data collected through the Platform is stored on servers located within India. We do not transfer personal data outside India.

7.2 Security Measures

We implement reasonable technical and organisational safeguards to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit using industry-standard protocols (e.g. TLS).
• Access controls limiting data access to authorised personnel only.
• Regular security reviews and monitoring of Platform infrastructure.
• Secure processing of payment information through a certified payment gateway.

While we take all reasonable precautions, no online platform can guarantee absolute security. Users are encouraged to use strong, unique passwords and to keep their login credentials confidential.

7.3 Data Breach Notification

In the event of a personal data breach that is likely to affect the rights of Data Principals, we will:

• Notify the Data Protection Board of India within the timeframe prescribed under the DPDP Act.
• Notify affected Data Principals promptly, with details of the nature of the breach and the steps being taken.

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Active account data: Retained for the duration of your account and for a period of 3 years after account closure or last activity, to enable reactivation and resolve any disputes.
• Payment and transaction records: Retained for 8 years from the date of the transaction, as required under Indian tax and financial regulations.
• Support and communication records: Retained for 2 years from the date of the communication.
• Technical and usage data: Retained for 12 months from collection, after which it is deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer identify an individual. Anonymised data may be retained for analytical purposes.

Under the DPDP Act and applicable Indian law, you have the following rights in relation to your personal data:

• Right to access information: You may request a summary of the personal data we hold about you and the purposes for which it is being processed.
• Right to correction and erasure: You may request correction of inaccurate or incomplete data, or erasure of data that is no longer necessary for the purpose for which it was collected.
• Right to grievance redressal: You have the right to have your grievances addressed by us in a timely manner. If you are unsatisfied with our response, you may escalate your complaint to the Data Protection Board of India.
• Right to nominate: You may nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent: You may withdraw consent for any processing that is based on consent, at any time, without affecting processing already carried out.

To exercise any of these rights, please contact our Grievance Officer using the details in Section 13. We will respond to all valid requests within 30 days.

We use cookies and similar technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function (e.g. login sessions, security). These cannot be disabled.
• Functional cookies: Remember your preferences to improve your experience. These are enabled with your consent.
• Analytics cookies: Help us understand how Users interact with the Platform. We use anonymised data only. These are enabled with your consent.

On your first visit to the Platform, you will be presented with a cookie consent notice. You may accept or decline non-essential cookies. You may also manage or withdraw cookie preferences at any time through the [Cookie Settings] link.

The Platform may contain links to external websites or services. We have no control over and are not responsible for the privacy practices, content, or security of any third-party site. We encourage you to review the privacy policies of any external services you access through links on our Platform.

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices.

For material changes — those that significantly affect your rights or the way we handle your data — we will provide at least 14 days' advance notice via email or a prominent notice on the Platform before the changes take effect.

For minor or non-material changes, the updated Policy will be published on the Platform with a revised effective date.

Where required under applicable law, we will seek fresh consent before processing your data under revised terms. Continued use of the Platform after the effective date of any change constitutes acceptance of the updated Policy.

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, we have designated a Grievance Officer to address privacy-related concerns.

If you have any questions, concerns, or complaints about this Privacy Policy or the handling of your personal data, please contact:

This Policy is governed by and construed in accordance with the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the courts of [Insert City], India.