Privacy Policy

This Privacy Policy explains how Edzopp collects, uses, shares, stores and protects your personal data when you use edzopp.in and any related pages, forms, apps or communications (together, the "Platform"). It is our notice to you under section 5 of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and our privacy policy under rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), to the extent those rules apply.

Who we are. "Edzopp", "we", "us" and "our" mean the operator named in the Business Details block (published in the site footer and on our Grievance and Contact page). For the purposes of the DPDP Act, that operator is the Data Fiduciary for personal data processed through the Platform. "You" means any individual who visits or uses the Platform (the Data Principal).

Please read this Policy with our Terms of Use and our Advisor and Communication Consent.

Summary

• We collect the details you give us (such as your name, phone number, email, city and quiz answers), your Google sign-in profile if you use it, and information about how you use the Platform.
• We use them to match you with courses, give you free advice through our advisors, run your account, publish your reviews, keep the Platform safe and improve it.
• We share your details with a course provider only when you ask us to or consent to it (for example, by ticking a box on an enquiry form). We never sell your phone number or other personal data to course providers.
• We use trusted service providers (hosting, database, Google sign-in, analytics, messaging) who process data for us under contract.
• You can withdraw consent, access, correct or erase your data, nominate someone, and raise a grievance at any time. Contact the Grievance Officer named in the Business Details block.

Personal data we collect

We do not ask for passwords (other than through Google), bank or card details, biometric data, health data or government ID numbers. Course fees are paid directly to course providers, not to us. Please do not share sensitive information (such as health, financial or caste details) in reviews, quiz answers or messages to advisors.

Why we use your personal data

(a) On the basis of your consent (section 6, DPDP Act). When you sign up, submit an enquiry, take the quiz or ask for advice, we ask for your consent through a clear, unticked checkbox or similar affirmative action. With that consent we use your data to:

1. create and run your account, including Google sign-in;
2. match you with courses and show you your "top 3 matches" and other recommendations;
3. have our advisors contact you by call, WhatsApp, SMS or email to give free advice (see our Advisor and Communication Consent);
4. share your enquiry with the course provider(s) you choose, so that they can respond to you (see section 4);
5. publish your reviews and ratings with your display name;
6. send you updates, newsletters and offers about Edzopp's own services. You can opt out of these at any time (see section 8), without affecting the rest of your account; and
7. measure and analyse how the Platform is used, fix errors, test features and improve our content, matching and advisory service, including through analytics cookies where those require consent.

(b) For legitimate uses (section 7, DPDP Act). We may process personal data without fresh consent where the DPDP Act permits it, including:

1. where you have voluntarily provided your data for a specified purpose and have not indicated that you do not consent to its use (section 7(a)), for example to reply to a message you send us;
2. to comply with any law in force in India, or any judgment, decree or order (sections 7(d) and 7(e));
3. to respond to a medical emergency or threat to life or health, or during a disaster or breakdown of public order (sections 7(f) to 7(h)); and
4. for any other purpose the Central Government notifies under section 7.

(c) Other uses permitted by law. We may also process personal data, to the extent permitted by section 17 of the DPDP Act and other applicable law, to prevent, detect, investigate and act on fraud, spam, fake reviews, abuse, security incidents and breaches of our Terms of Use, and to establish, exercise or defend legal claims.

We will not use your personal data for a purpose that is not described in this Policy, or that is not compatible with it, without telling you and, where required, asking for your consent.

Who we share your personal data with

Course providers and partners — only at your request or with your consent. When you ask to be connected with a course provider (for example, by clicking "Contact provider", "Request callback" or "Apply", or by ticking the consent checkbox on an enquiry form), we share the details needed for that enquiry, usually your name, phone number, email, city, the course you are interested in and relevant quiz answers. We share with that provider only, and only for that enquiry. Once a provider receives your details, it handles them as an independent Data Fiduciary under its own privacy policy; please read it. We ask providers to use your details only to respond to your enquiry and to respect your opt-out requests.

We never sell, rent or trade your phone number or other personal data to course providers or anyone else. A sponsored listing or referral fee never gives a provider access to your data without your request or consent.

Data Processors. We use service providers who process personal data on our behalf, under a written contract and only on our instructions (section 8(2), DPDP Act). These include providers of:

• website and application hosting and content delivery;
• database and cloud storage;
• authentication, including Google sign-in (Google LLC);
• analytics and error monitoring;
• telephony, WhatsApp Business messaging, SMS and email delivery; and
• customer support and form tools.

Others, where required or permitted by law. We may disclose personal data to courts, regulators, law enforcement and government agencies when required by law or a lawful order (including under section 69 of the Information Technology Act, 2000, rule 3(1)(j) of the IT Rules 2021, and directions of CERT-In); to our legal and professional advisers; and, subject to this Policy, to a successor entity on a reorganisation, merger, transfer of business or change of the operating entity (see section 14).

Anonymised and aggregated data

We may create anonymised and aggregated data from the information we hold, for example the number of learners interested in a subject in a city, or average budgets for a course category. Such data is processed so that it does not identify you and cannot reasonably be used to identify you, and it is therefore not personal data. We may use, publish, share, license or sell anonymised and aggregated data for any purpose, including market research, commercial insights and reports to course providers and partners. We will not attempt to re-identify anyone from such data, and we contractually prohibit recipients from doing so.

Where your data is processed

We store and process personal data in India and, through our service providers, may process it outside India. Any transfer outside India is subject to section 16 of the DPDP Act and will not be made to any country or territory the Central Government restricts by notification. We require service providers to protect your data to the standard this Policy describes.

How long we keep your data

We keep personal data only as long as needed for the purpose for which it was collected, or as required by law (section 8(7), DPDP Act). In particular:

• Account data: while your account is active. If you delete your account, we erase or anonymise your personal data within 30 days, except as stated below.
• Enquiry, quiz and advisory data: for up to 24 months after your last interaction with us, unless you ask us to delete it earlier.
• Inactive accounts: if you have not signed in or interacted with us for 3 years, we may close your account and erase your data after giving you at least 48 hours' notice.
• Published reviews: while published. On erasure, we remove your name and identifiers from your reviews or remove the reviews.
• Logs and traffic data: at least one year, as required by rule 8 of the DPDP Rules and CERT-In directions, and then deleted or anonymised.
• Records needed by law or for claims: we may keep the minimum data necessary, even after you withdraw consent or ask for erasure, where retention is required by law (for example, tax, consumer protection or IT Act obligations, or a lawful order), or is reasonably necessary to deal with a pending complaint, dispute, legal claim or fraud investigation, or to keep a record that you opted out so that we do not contact you again. We will keep such data only for that purpose and for as long as needed.

Your rights as a Data Principal

Under the DPDP Act you have the right to:

1. Withdraw consent at any time, as easily as you gave it (section 6(4)). You can do this from your account settings, by replying "STOP" to our SMS or WhatsApp messages, by using the unsubscribe link in our emails, or by writing to the Grievance Officer. Withdrawal does not affect processing done before it. After withdrawal, we and our Data Processors will stop processing your data within a reasonable time, unless the law permits or requires us to continue. If you withdraw consent to data that is essential to a service (for example, your phone number for advisor calls), we may not be able to provide that service.
2. Access information (section 11): a summary of the personal data we process about you and the processing activities, the identities of the Data Fiduciaries and Data Processors with whom we have shared it and a description of the data shared, and any other information prescribed.
3. Correction, completion, updating and erasure (section 12): you can correct most details in your account settings. You may ask us to erase your data; we will do so unless retention is necessary for the specified purpose or for compliance with law.
4. Grievance redressal (section 13): see section 13 below.
5. Nominate another individual to exercise your rights if you die or become incapable (section 14).

To exercise any right, email the Grievance Officer from your registered email address, or use the options in your account settings. We may need to verify your identity before acting. We will respond within 7 days, and in any event within the period required by law (the DPDP Rules allow a maximum of 90 days).

Your duties (section 15, DPDP Act): please provide accurate information, do not impersonate anyone, do not suppress material information, and do not file false or frivolous complaints.

Our duties as Data Fiduciary

We will:

• process personal data lawfully, for the purposes stated here, and limit it to what is necessary;
• make reasonable efforts to keep data accurate and complete where it is used to make a decision about you or is shared with another Data Fiduciary;
• take reasonable security safeguards to prevent personal data breaches (section 8(5));
• notify the Data Protection Board of India and affected users of a personal data breach as required by section 8(6) of the DPDP Act and rule 7 of the DPDP Rules, and report cyber security incidents to CERT-In as required;
• erase personal data when the purpose is no longer served or consent is withdrawn, unless retention is required by law, and require our Data Processors to do the same; and
• publish the contact details of a person who can answer your questions about the processing of your personal data (see the Business Details block).

Children under 18

Under the DPDP Act, anyone under 18 is a child. Many of our users are school students, so:

• if you are under 18, you may use features that collect personal data (sign-up, quiz, enquiry, advisor requests and reviews) only after your parent or lawful guardian gives verifiable consent in line with section 9 of the DPDP Act and rule 10 of the DPDP Rules (through an OTP sent to the parent's or guardian's mobile number together with a declaration of their identity and relationship);
• we ask for age at sign-up; if we learn that we have collected a child's data without verifiable parental consent, we will stop processing and delete it;
• we do not track, behaviourally monitor or target advertising at children, and we do not process children's data in a way likely to harm their well-being; and
• a parent or guardian may exercise the child's rights by contacting the Grievance Officer.

Cookies and local storage

We use cookies, local storage and similar technologies to:

• keep the Platform working (strictly necessary): sign-in sessions, security, load balancing, remembering your cookie choices and saving quiz progress;
• remember preferences: city, shortlisted courses and display settings; and
• analyse usage (analytics): to understand which pages and features are used, so that we can improve them.

Where consent is required, we ask for it through our cookie banner, and you can change your choice at any time through the "Cookie settings" link in the footer. You can also block or delete cookies in your browser, but parts of the Platform may not work. We use advertising, measurement or remarketing cookies and similar technologies (such as those provided by Meta or Google) only if you consent to them through our cookie banner, and you can withdraw that consent at any time.

Security

We follow reasonable security practices and procedures in line with rule 8 of the SPDI Rules and rule 6 of the DPDP Rules, including encryption in transit (HTTPS), access controls on a need-to-know basis, logging and monitoring of access, regular backups, and contracts with Data Processors that require security safeguards. No system is completely secure. If you believe your account has been compromised, contact us immediately.

Grievances and the Data Protection Board

If you have any question, complaint or request about your personal data, contact our Grievance Officer (name, email and address in the Business Details block). We will acknowledge your complaint within 24 hours and resolve it within 7 days of receipt, which is within the timelines under the IT Rules 2021 (as amended in 2026), the SPDI Rules (one month) and the DPDP Rules (a maximum of 90 days).

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India under section 13(3) of the DPDP Act, through its online platform, after first using our grievance process.

Changes to this Policy and to the operator

We may update this Policy from time to time, for example to reflect changes in the law, our services or our service providers. We will post the updated Policy with a new "Last updated" date. For material changes, we will notify you by email, a notice on the Platform or at sign-in, before the change takes effect. Where the law permits, continued use of the Platform after the effective date means you accept the updated Policy. Where the law requires your consent (for example, for a new purpose), we will ask for it and will not rely on continued use.

If the business of Edzopp is transferred to another entity (including a new company, LLP or sole proprietorship formed to run Edzopp), your personal data may be transferred to that entity, which will continue to process it under this Policy. We will update the Business Details block and notify you.

Contact

Grievance Officer: see the Business Details block (Tathagat Sankritayan, tathagat@signalroom.in, at C-1483, Indira Nagar, Lucknow 226016).

Other legal pages

• Terms of Use
• Advertising and Affiliate Disclosure
• Review Policy
• Advisor and Communication Consent
• Grievance Redressal and Contact
• Refund and Cancellation Note
• Disclaimer