Privacy Policy

1. Introduction

Aura EduAid Private Limited ("Aura EduAid", "Company", "we", "us", or "our"), a company incorporated under the Companies Act, 2013, with its registered office at [REGISTERED OFFICE ADDRESS], Mumbai, Maharashtra, India (CIN: U85499MH2025PTC445706), operates the consumer-facing brand and programme "PocketEd". Any reference to "PocketEd" in this Policy or on our Website refers to the products, services, curriculum, and brand assets owned and operated by Aura EduAid Private Limited.

We are committed to protecting the privacy of every individual who interacts with our website, applications, and services.

This Privacy Policy explains how we collect, use, store, share, and protect personal information of school administrators, teachers, parents, students, and other website visitors. It is issued in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable Indian laws.

By accessing or using our website (pocketed.in and any associated subdomains, hereinafter the "Website") or our services, you confirm that you have read, understood, and agree to the practices described in this Policy. If you do not agree, please do not use our Website or services.

2. Scope of this Policy

This Policy applies to all information collected through:

• Our Website, including all pages, contact forms, and inquiry forms;
• Our learning management system (LMS) and any student-facing applications hosted on the same domain or subdomains;
• Communications you send to us via email, telephone, or other channels;
• Engagements during teacher development sessions, workshops, and curriculum delivery at partner schools.

This Policy does not apply to third-party websites or services that may link to or from our Website. We encourage you to review the privacy policies of any such third parties.

3. Information We Collect

We collect only the information necessary to provide our services, communicate with schools, and improve the PocketEd programme. The categories of information we collect include:

3.1 Information You Provide Directly

• School and Principal Contact Information: Name of school, name and designation of the point of contact (principal, coordinator, trustee), school address, city, telephone number, email address, board affiliation (CBSE, ICSE, State Board, etc.), grade levels offered, and approximate student strength.
• Inquiry Details: Any message, question, or specific requirement you share through our contact form or via email.
• Teacher Information (where applicable): Name, subject taught, email, and phone number, collected when teachers register for free Teacher Development Sessions.

3.2 Information Collected Automatically

• Technical Data: Internet Protocol (IP) address, browser type and version, device type, operating system, time zone, and approximate geographic location (city-level).
• Usage Data: Pages visited, time spent on each page, links clicked, and referring URLs. This is collected through cookies and similar technologies.

3.3 Information Relating to Students (Future Scope)

When our student application and LMS go live, we may, with the explicit consent of the school and the verifiable consent of a parent or lawful guardian, collect limited information about students such as:

• First name and class/section;
• Login credentials issued by the school;
• Lesson progress, activity completion, and assessment responses;
• Anonymised engagement analytics for curriculum improvement.

We do not knowingly collect sensitive personal data of students such as biometric information, financial information, or contact details beyond what is strictly necessary for the educational service. Where any data of a child (under 18 years) is processed, we will obtain verifiable parental or guardian consent in accordance with Section 9 of the DPDP Act, 2023.

4. How We Use Your Information

We use the information collected for the following purposes:

• To respond to inquiries from schools, trustees, and educators;
• To schedule and deliver Teacher Development Sessions and curriculum programmes;
• To issue invoices, manage contracts, and process payments for our services;
• To send programme-related updates, certifications, and educational resources to participating schools;
• To improve our curriculum, content, and learning outcomes based on aggregated, anonymised performance data;
• To comply with applicable laws, accreditation requirements (such as NCFE MSSP, NSE Academy), and lawful requests from regulatory or government authorities;
• To detect, prevent, and address technical issues, security incidents, or fraudulent activities.

We do not use personal information for automated profiling, advertising, or any purpose unrelated to the delivery of our educational services.

5. Legal Basis for Processing

Under the DPDP Act, 2023, we process personal data only on one or more of the following lawful grounds:

• Consent: You have provided clear, informed, and specific consent for the processing of your data.
• Legitimate Use: Processing is necessary for the performance of a contract (such as our service agreement with your school) or to respond to your inquiry.
• Legal Obligation: Processing is required to comply with applicable Indian law, taxation requirements, or regulatory directives.

6. Sharing and Disclosure of Information

Aura EduAid does not sell, rent, or trade personal information. We share information only in the following limited circumstances:

• With Partner Schools: Aggregated learning reports and certification data may be shared with the school that has engaged Aura EduAid for the PocketEd programme.
• With Service Providers: Trusted third-party vendors (such as cloud hosting providers, payment gateways, email delivery services, and analytics tools) who process data on our behalf under written agreements that require confidentiality and data protection standards consistent with this Policy.
• For Legal Reasons: Where required by law, court order, or a lawful request by a public authority, or to protect the rights, property, or safety of Aura EduAid, our users, or others.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the successor entity, subject to the same protections set out in this Policy.

7. Cookies and Similar Technologies

Our Website uses cookies and similar tracking technologies to enhance user experience and analyse Website performance. Cookies are small text files stored on your device. The types of cookies we use include:

• Essential Cookies: Required for the Website to function correctly.
• Analytics Cookies: Help us understand how visitors interact with our Website (for example, via Google Analytics or similar tools).
• Preference Cookies: Remember settings such as language or region.

You may disable cookies through your browser settings; however, some Website features may not function properly if you do so.

8. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes outlined in this Policy, including:

• Inquiry-related data: retained for up to twenty-four (24) months from the date of last contact, unless an ongoing engagement is established;
• School contract data: retained for the duration of the contract and for seven (7) years thereafter for legal, accounting, and audit purposes, as required under Indian law;
• Student learning data: retained for the academic year and one (1) subsequent year, after which it is anonymised or securely deleted;
• Website analytics data: retained in anonymised form for up to twenty-six (26) months.

Upon expiry of the retention period or upon a valid request for deletion, we will securely erase or anonymise the data, unless retention is required by law.

9. Data Security

Aura EduAid implements reasonable security practices and procedures as required under the IT Act, 2000 and the DPDP Act, 2023. These include:

• Encryption of data in transit using industry-standard protocols (TLS/SSL);
• Access controls restricting personal data to authorised personnel only;
• Regular review of our security practices and vendor agreements;
• Secure cloud infrastructure with reputable service providers;
• Confidentiality obligations binding all employees, contractors, and partners.

While we take all reasonable steps to protect your information, no method of transmission over the Internet or electronic storage is one hundred percent secure. You acknowledge this inherent risk when sharing information with us.

10. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights with respect to your personal data:

• Right to Access: Obtain confirmation of whether we process your data and request a summary of such data.
• Right to Correction and Erasure: Request correction of inaccurate or outdated data, or erasure of data no longer required.
• Right to Withdraw Consent: Withdraw consent previously given, at any time, by writing to our Grievance Officer.
• Right to Grievance Redressal: File a complaint regarding our data practices.
• Right to Nominate: Nominate another individual to exercise these rights in the event of death or incapacity.

To exercise any of these rights, please contact our Grievance Officer using the details in Section 13. We will respond to all valid requests within the timelines prescribed by law.

11. Children's Privacy

The PocketEd programme is designed for delivery within schools to students in Grades 6 to 8. We do not collect personal data directly from children through our Website. When our student application becomes operational, all data processing involving children will be carried out only after obtaining verifiable consent from a parent or lawful guardian, and through the partner school as the data fiduciary co-ordinator.

We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. All student data is used solely for educational and assessment purposes.

12. Cross-Border Data Transfers

Personal data collected by Aura EduAid is primarily stored on servers located in India. In limited cases, where our service providers are located outside India (for example, cloud-based email or analytics services), data may be transferred outside India. Such transfers will be made only to jurisdictions permitted under the DPDP Act, 2023 and subject to contractual safeguards equivalent to those provided in this Policy.

13. Grievance Officer and Contact Information

In compliance with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, 2023, we have appointed a Grievance Officer to address any concerns regarding this Policy or the handling of your personal data.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. Any updates will be posted on this page with a revised "Last Updated" date. Where the changes are material, we will provide additional notice (for example, via email to schools we are currently engaged with). Your continued use of our Website or services after such updates constitutes acceptance of the revised Policy.

15. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of India. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Mumbai, Maharashtra.