1. Who We Are (Data Fiduciary)
This Privacy Policy applies to Nappilos Educations (website: education.nappilos.com), an educational initiative operated by [NAPPILOS LLP], [NAPPILOS], registered COUNTRY [INDIA], ("Nappilos", "we", "us").
Under India's Digital Personal Data Protection (DPDP) Act, 2023, we act as the Data Fiduciary for the personal data described below. You can reach our Grievance Officer & Data Protection Officer at any time (Section 12).
2. Scope
This policy covers personal data processed through this website (education.nappilos.com), including its waitlist form, emails we send, and any beta platform that later runs on this domain. It applies to parents and legal guardians (adults) and — with parental consent — to children under 18, who are "Children" under the DPDP Act.
3. What Data We Collect (Data Minimisation)
| Data | Source | Required? | Purpose |
|---|---|---|---|
| Parent/guardian name | Waitlist form | Yes | Addressing you in emails |
| Email address | Waitlist form | Yes | Launch updates & confirmations |
| Child's age group (a range, e.g. 6–8) | Waitlist form | Yes | Relevant launch content — never a child's identity |
| Consent record (timestamp) | Waitlist form | Yes | Proof of DPDP consent |
| Server logs (technical, may include IP) | Hosting provider | Automatic | Security & abuse prevention only |
4. Why We Use It (Purpose & Legal Basis)
- Legal basis — Consent (DPDP Section 6): You ticked the consent box; we process your data to send you launch updates and manage your waitlist place.
- Legal basis — Legitimate security interest: Server logs are processed strictly to protect the site from abuse, bots and attacks.
- We do not use your data for profiling, behavioural advertising, or any purpose incompatible with what is stated here (DPDP Section 5).
5. Children's Data (DPDP Section 9 — Our Highest Duty)
- We do not knowingly process a child's personal data without verifiable parental consent. See our Parental Consent page.
- We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children — prohibited by the DPDP Act and our own policy.
- Any future platform accounts will be created and controlled by a parent/guardian, with content delivered only after consent verification.
- We benchmark our practices against COPPA (USA), the UK Age Appropriate Design Code and EU GDPR-K, in addition to Indian law.
6. Cookies & Trackers
This website sets no advertising cookies and loads no third-party trackers. We use one browser session storage entry (for our own form rate-limiting) and Google Fonts (loaded without setting identifying cookies). No data is sold or rented — ever.
7. Who We Share Data With
| Recipient | Role | What & Why |
|---|---|---|
| [Nappilos] | Data Processor (hosting & email) | Stores the site and transmits your waitlist email to us; bound by data-processing terms |
| Our own inbox (education@nappilos.com) | Internal | Your details to send updates |
| Law enforcement / courts | As legally required | Only upon valid legal process under Indian law |
We never sell, rent or trade personal data. If we ever engage a new processor (e.g., an email platform), this policy will be updated and, where required, fresh consent obtained.
8. Data Residency & Retention
- Residency: Waitlist data is stored on servers in/operated for India. We commit to Indian data residency for children's data as DPDP Rules mature.
- Retention — waitlist: Kept until launch communications conclude, or a maximum of [24 months], whichever is earlier — then deleted or erased on request (DPDP Section 8(7): erasure when consent is withdrawn or purpose is done).
- Retention — server logs: [90 days], then auto-purged.
9. How We Protect Data (Security Safeguards)
- HTTPS/TLS encryption in transit; security headers (HSTS, CSP) enforced.
- Waitlist records stored with access restricted to authorised team members; CSV export permission-restricted (0600).
- Bot protection (honeypot + rate limiting) on forms; no admin panel exposed.
- Reasonable security safeguards as required under DPDP Section 8(5) and the IT Act's reasonable-security practices.
- In the unlikely event of a personal-data breach, we will notify affected users and, where required, the Data Protection Board of India, per DPDP Section 8(6).
10. Your Rights (As Per the DPDP Act 2023)
| Right | What It Means | How to Use It |
|---|---|---|
| Access / Summary | Know what data we hold about you | Email us — we reply with a summary |
| Correction | Fix inaccurate data | Email the correction |
| Erasure | Get your data deleted | Email "DELETE" — done within 30 days |
| Withdraw Consent | Stop all processing, as easily as you consented | Reply "UNSUBSCRIBE" to any email |
| Nomination | Appoint someone to exercise rights if you can't | Email us the nomination |
| Grievance | Complain if unsatisfied | Section 12 below → then the Data Protection Board of India |
[EDUCATION@NAPPILOS.COM to ACCESS / CORRECT / DELETE / UNSUBSCRIBE.]
11. Consent Withdrawal & Deletion — Made Simple
Open any email from us (or email education@nappilos.com directly).
Reply with UNSUBSCRIBE (stop contact) or DELETE (erase all data).
We act within 30 days (usually faster) and confirm in writing. Withdrawal never affects data processed before withdrawal.
12. Grievance Officer & Data Protection Officer (IT Rules 2021 + DPDP)
As required by the IT (Intermediary Guidelines & Digital Media Ethics Code) Rules, 2021 and the DPDP Act 2023:
- Name: [Mr Reddy] — Grievance Officer & Data Protection Officer
- Email: education@nappilos.com • Phone: [73825 83039]
- Address: [Hyderabad]
- Response time: Acknowledged within 48 hours; resolved within 30 days as per IT Rules 2021.
- Unsatisfied? You may escalate to the Data Protection Board of India (once operational) and/or [support@nappilos.com].
13. Changes to This Policy
We may update this policy as our services launch and laws evolve (including the full commencement of the DPDP Rules). Material changes will be announced on this page with a new "Last updated" date and, for waitlist members, by email where appropriate.
14. Contact
Nappilos™ — [NAPPILOS LLP]
[Hyderabad, Telangana], India
Email: education@nappilos.com