Privacy Policy

1 Who We Are (Data Fiduciary)

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Beyond the Notes acts as the Data Fiduciary — the entity that determines the purpose and means of processing your personal data.

2 Personal Data We Collect

We collect only such personal data as is necessary for the purposes described in this Policy ("data minimisation" as required under the DPDP Act). The categories of personal data we may collect are:

2.1 Data Provided Voluntarily (via Enquiry Form)

• Student Name — to personalise communication regarding the student's admission.
• Parent / Guardian Name — primary contact and decision-maker for admission.
• Parent / Guardian Mobile Number — to respond to enquiries via WhatsApp or call.
• Class Selection (8th / 9th / 10th CBSE) — to match the student to the appropriate batch.
• Subject Selection (Maths / Science / Social Science / English) — to identify the subject of interest.
• Board / Curriculum (CBSE) — to confirm academic board alignment.
• Message / Additional Information — any specific query or requirement shared in the form.

2.2 Data Collected Automatically

• Browser Type & Version — via standard HTTP headers, for compatibility optimisation.
• Device Type (mobile / desktop / tablet) — for responsive design purposes.
• Approximate Geographic Region — country/region level only, not precise location.
• Referring URL — to understand how users find our website.
• Pages Visited & Session Duration — to improve website content and performance.

2.3 Data We Do NOT Collect

• Aadhaar card numbers or government-issued ID numbers.
• Bank account, UPI, or payment card details (no payment is processed on this website).
• Passwords or authentication credentials.
• Precise GPS location data.
• Photographs or biometric identifiers.

3 Purpose of Processing Personal Data

We process your personal data only for specified, explicit and legitimate purposes as required under Section 4 of the DPDP Act, 2023. The purposes are:

We will not use your personal data for any purpose beyond those listed above without obtaining fresh, explicit consent from you.

4 Consent — How We Obtain, Use and Respect It

Under Section 6 of the DPDP Act, 2023, consent must be free, specific, informed, unconditional and unambiguous. We uphold these standards as follows:

4.1 How Consent Is Obtained

• When you voluntarily fill and submit the WhatsApp enquiry form on our Contact & Admissions page, you are providing explicit, affirmative consent to process the data you have shared.
• By proceeding to open WhatsApp after form submission, you further confirm that you wish to send your enquiry details to Beyond the Notes.
• Consent is not obtained through pre-ticked boxes, buried clauses, or conditional service denial.

4.2 Right to Withdraw Consent

You have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. To withdraw consent or request data deletion, please contact our Grievance Officer (see Section 14).

5 Children's Data — Special Protections

Our services are designed for CBSE students in Classes 8, 9 and 10, who are typically 13 to 16 years of age. Under Section 9 of the DPDP Act, 2023, we apply the following special protections:

• All enquiries and consent are obtained from the parent or legal guardian, not the student directly.
• The enquiry form specifically collects the Parent Name and Parent Mobile Number as the primary contact.
• We do not conduct behavioural monitoring, targeted advertising, or profiling of students or minors.
• We do not knowingly allow children to submit personal data independently without parental consent.
• No student data is shared with third-party advertisers or marketing platforms.

6 Data Sharing and Disclosure

We treat your personal data with strict confidentiality. We do not sell, rent, trade, or share your personal data with any third party for commercial purposes. Data may be disclosed only in the following limited circumstances:

6.1 Service Providers (Data Processors)

6.2 Legal Disclosure

We may disclose personal data if required to do so by law, court order, or lawful government authority — including the Data Protection Board of India — provided we are legally compelled and not prohibited from notifying you.

6.3 Business Continuity

In the event of a merger, acquisition, or reorganisation of Beyond the Notes, personal data may be transferred to a successor entity, subject to the same privacy protections as described in this Policy.

7 WhatsApp Enquiry System — Important Notice

Our primary enquiry channel is WhatsApp. Here is how it works and what you should know:

• When you submit the enquiry form, your browser constructs a WhatsApp message on your device containing the information you entered.
• Clicking "Submit Enquiry on WhatsApp" opens the official WhatsApp application or web interface with the pre-filled message.
• You review and send the message manually. Nothing is transmitted without your final action of pressing "Send" in WhatsApp.
• Once sent, your message is handled by WhatsApp / Meta Platforms, subject to WhatsApp's Privacy Policy.
• No enquiry submission is recorded by our website's server. No confirmation email is sent because no server processes the data.

8 Data Retention and Erasure

Consistent with Section 8(7) of the DPDP Act, 2023 (storage limitation), we retain personal data only for as long as necessary to fulfil the purpose for which it was collected:

Upon expiry of the retention period, personal data is securely erased or anonymised so that it can no longer identify any individual.

9 Security Safeguards

Under Section 8(5) of the DPDP Act, we are required to implement reasonable security safeguards to prevent personal data breaches. We maintain the following measures:

• HTTPS / TLS Encryption: All data transmitted between your browser and our website is encrypted using TLS (Transport Layer Security).
• No Backend Database: Since this website does not store personal data server-side, the attack surface for data breaches is significantly reduced.
• Cloudflare Protection: Our website is hosted on Cloudflare Pages, which provides DDoS protection, Web Application Firewall, and secure CDN delivery.
• No API Keys Exposed: No API credentials, private keys, or backend tokens are embedded in this website's client-side code.
• Input Validation: All form fields are client-side validated to ensure data quality and to prevent malformed submissions.
• Regular Review: Security configurations and third-party dependencies are periodically reviewed and updated.

9.1 Data Breach Notification

In the unlikely event of a personal data breach that is likely to result in harm to affected individuals, we will notify the Data Protection Board of India (DPBI) and the affected Data Principals as required under Section 8(6) of the DPDP Act, within the prescribed timelines.

10 Your Rights as a Data Principal

Under Chapter III of the Digital Personal Data Protection Act, 2023, you (the Data Principal) have the following rights:

10.1 Right to Access Information (Section 11)

You have the right to obtain a summary of your personal data being processed by us and the processing activities undertaken with respect to your personal data. You may also request information about the entities to which your data has been shared.

10.2 Right to Correction and Erasure (Section 12)

You have the right to:

• Correct inaccurate or misleading personal data.
• Complete incomplete personal data.
• Update personal data that is out-of-date.
• Request erasure of personal data that is no longer required for the purpose it was collected ("Right to be Forgotten").

10.3 Right to Grievance Redressal (Section 13)

You have the right to have your grievances related to personal data processing addressed in a timely and effective manner. Contact our Grievance Officer (see Section 14).

10.4 Right to Nominate (Section 14)

You have the right to nominate another individual to exercise your data rights on your behalf in the event of death or incapacity.

10.5 Right to Withdraw Consent

As noted in Section 4.2, you may withdraw consent at any time by contacting our Grievance Officer.

10.6 Right to Complain to the Data Protection Board

If your grievance is not addressed satisfactorily by our Grievance Officer within the prescribed period, you have the right to lodge a complaint with the Data Protection Board of India (DPBI), once it is formally constituted and operational under the DPDP Act, 2023.

11 Cookies and Tracking Technologies

This website uses a minimal set of cookies and local browser storage:

We do not use:

• Advertising or tracking cookies (Facebook Pixel, Google Ads, etc.).
• Analytics platforms that identify individual users (Google Analytics, Hotjar, etc.).
• Cross-site tracking or retargeting technologies.

To manage or delete cookies, you may adjust your browser settings at any time. Disabling strictly necessary cookies may affect website functionality.

12 External Links and Third-Party Platforms

This website contains links to external platforms, including:

• Instagram (@beyond_the_notz) — operated by Meta Platforms, Inc.
• YouTube (@beyondthenotz) — operated by Google LLC.
• WhatsApp (wa.me) — operated by Meta Platforms, Inc.

When you click on external links, you are leaving our website. We are not responsible for the privacy practices of these third-party platforms. We encourage you to review their respective privacy policies before interacting with them.

All external links on this website are opened in a new browser tab with rel="noopener noreferrer" attributes applied for security.

13 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in applicable law (including DPDP Rules, once notified).
• Changes in our data processing activities or website features.
• Recommendations from regulatory authorities.

When we make material changes to this Policy, we will update the "Last Updated" date at the top of this page. For significant changes, we may also display a notice on the website's homepage. We encourage you to review this Policy periodically.

Your continued use of this website after changes are posted constitutes your acknowledgement of the updated Policy.

14 Grievance Officer (DPDP Act, Section 13)

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023, and to address grievances regarding processing of personal data, the following person has been designated as the Grievance Officer for Beyond the Notes:

Response Time Commitment:

• Acknowledgement of grievance: Within 3 working days of receipt.
• Resolution of grievance: Within 30 days of receipt (extendable if complexity requires).
• If not satisfied with our resolution, you may escalate to the Data Protection Board of India, once constituted.

15 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please reach out to us through any of the following channels:

• Phone / Call: +91 8625946442
• WhatsApp: wa.me/918625946442
• Instagram: @beyond_the_notz (DM)
• YouTube: @beyondthenotz
• Enquiry Form: Contact & Admissions Page