Privacy Policy
This version takes effect when published on the TRUpreBoards website. It does not retrospectively expand previously obtained permissions.
At a glance
- We use account, assessment and related information to provide and support the requested service.
- Optional research and identifiable scholarship or opportunity sharing have separate permissions where required.
- EduBrahma reserves its rights in proprietary technology and lawfully created non-personal research products, including commercial licensing.
- We do not sell identifiable student profiles as unrestricted data products or use children's assessment information for advertising audiences.
- For privacy questions, withdrawal or a complaint, email hello@trupreboards.com. The full contact details appear in section 14.
This summary is for orientation only. The sections below are the notice.
1. Scope and responsibility
EduBrahma Innovations Private Limited, operating TRUpreBoards ("EduBrahma", "we", "us" or "our"), provides assessment, answer-script evaluation, reporting and learning analytics services. This Policy explains how we process personal information and protect our proprietary technology, research and information products.
It covers our websites, applications, registration, offline collection followed by digitisation, assessments, submitted scripts, reports, support, research and authorised opportunity services. Optional features described here operate only when offered with the required notice, lawful authority and safeguards. Until those requirements are met, the relevant collection, research transformation or external disclosure must not begin. This Policy alone does not enrol a student in an optional programme.
For services we operate directly, EduBrahma determines the purposes and means of processing and bears the corresponding responsibilities. Where an institution determines those matters and we act on its behalf, we process information under its lawful documented instructions and applicable processing agreement. The institution's notice identifies its role and recipients. We remain responsible for any separate purposes that we determine ourselves.
Institutional participation, payment or sponsorship does not confer unrestricted access to student records. Independent research use of institution-supplied information requires an appropriate contractual allocation of rights and a lawful processing basis, including notices and consent where required. Our institutional agreement must expressly address the creation, retention and commercial use of de-identified products.
This Policy governs privacy disclosures. Specific consent notices identify authorised purposes; processing agreements govern institutional instructions; valid Terms of Use and commercial licences govern fees, IP and permitted commercial use. These documents do not expand an individual's consent or override mandatory law. This Policy stands as our general privacy notice; it is not conditional on a future commercial licence being signed. It neither transfers EduBrahma's IP nor grants access to restricted research assets. A commercial recipient must obtain the relevant licence before access.
2. Information categories
Personal Data is information identifying or reasonably linkable to a person. It includes student-level scores, inferences and other outputs, even where created by EduBrahma. Student Content includes submitted handwriting, answers, workings, drawings and supporting files. Assessment Data includes transcriptions, marks, rubric findings, feedback, skill indicators, review decisions and linked test-administration records.
De-identified Data does not identify and is not reasonably linkable to an individual, taking account of available source records, keys and other reasonably accessible information. Aggregated Data meets that same standard through grouping and disclosure controls. Replacing a name with a code, hashing an identifier or stripping a script's header does not by itself meet this standard. Identifiable or linkable data remains subject to personal-data safeguards.
We collect the following only as needed for a disclosed activity:
| Category | Information |
|---|---|
| Account and identity | Student and parent/guardian names, age or date of birth, relationship, contact details, account identifiers and authentication records |
| Educational profile | School, board, curriculum, class, subject, course, academic year, language and relevant prior results |
| Assessment records | Student Content, Assessment Data, report versions, corrections, review requests and supporting evidence |
| Test administration | Registration, attendance, seat/attempt binding, page mapping, submission times and disclosed integrity events |
| Security and technical records | IP address, device/browser details, access events and proportionate fraud or security signals |
| Transactions | Order, invoice, billing details, payment status, refunds and payment-provider references |
| Communications and permissions | Enquiries, messages and replies, call date/time and outcome, delivery status, channel preferences, grievances, notice versions, consent and opt-out records; call recordings or transcripts only under the separately explained conditions in section 10 |
| Optional programme information | Declared interests and eligibility information supplied for a specified scholarship, research or opportunity programme |
| Special feature information | Accommodation information or images, audio, video and screen-capture records only where a particular feature requires and separately explains them |
We do not routinely seek medical history, blood group, precise location, biometric templates or government-ID copies. A feature requiring additional information must explain its necessity before collection and satisfy applicable safeguards. We do not infer health, disability or personality from handwriting for an undisclosed purpose.
Payment credentials are entered with the payment provider. We do not store full card numbers, CVV, PINs or payment OTPs. Necessary refund account details, if requested, are used only to administer the refund and required accounting records.
Aadhaar is not our default identity requirement. Any offered Aadhaar verification must be voluntary, lawful and separately explained, with an appropriate alternative. We retain only the verification information we are legally entitled and required to retain.
Information may come from the person, a parent, an authorised institution or a service provider. Before using third-party information we assess the source's authority and our own processing basis. Public availability is not a general permission to collect unrelated profiles.
3. Purposes and processing authority
Our ordinary basis for processing student Personal Data is specific consent, including verified parental consent where required. We rely on a non-consent statutory ground only where its actual conditions apply. A business interest, contract or description such as "service improvement" does not independently establish that ground. For institutional processing, the institution establishes the lawful basis for its instructions, and EduBrahma verifies the authority relevant to its role.
| Processing purpose | Authority and boundary |
|---|---|
| Account creation, assessment, transcription, evaluation and reports | Core-service consent specifying the relevant data and service; parental verification where required. A statutory use for voluntarily supplied information is used only when in force and where its conditions actually apply, without bypassing child safeguards |
| Necessary service quality assurance, error correction and appeals | Included expressly in the core-service notice and consent; limited to delivering and checking the requested service. Unrelated product research follows the separate research pathway |
| Payment administration and necessary service messages | Core-service consent or the applicable statutory use for the requested transaction; channel-specific permissions and communications rules also apply under section 10. Legally required accounting retention is separately recorded |
| Account security and assessment integrity | Disclosed consent for necessary measures; a specifically applicable legal obligation or offence/legal-claim exemption only for the records and activity it covers. Camera or screen monitoring requires a feature-specific notice and child-law assessment |
| Creating de-identified datasets for independent research, benchmarking, product development or commercial analytics | Separate optional research consent while transforming Personal Data, unless a documented, in-force research/statistical exemption or other specific lawful ground applies. Subsequent use of non-personal outputs follows section 5 |
| Optional identifiable research participation | A separate study notice and consent, with purpose, data, recipient, duration and withdrawal terms. Any claimed exemption is assessed separately |
| Scholarship matching, profile verification and individual referrals | Separate programme consent and, before identifiable external disclosure, recipient-specific authorisation under section 6 |
| Promotional communications | Separate opt-in for the adult recipient and selected channels, including a distinct choice for automated promotional voice calls; no targeted advertising to children or marketing profiles built from children's assessment data |
| Legal demands, mandatory records, disputes and emergencies | The particular applicable obligation or statutory ground, documented and limited to necessary information; a requester's status alone is insufficient |
Optional research, publicity, marketing and opportunity permissions are not conditions for buying an unrelated assessment. Refusal does not change marks or evaluation standards. Existing data is not retrospectively enrolled into a new purpose merely because this Policy is updated.
Non-personal, lawfully generated statistics may be used commercially without repeatedly seeking personal-data consent for each subsequent non-personal use. That does not excuse an unlawful initial collection or transformation, or remove copyright and contractual restrictions on underlying material.
4. Children, parents and consent
For this Policy, a child is a person under 18. We verify parental or lawful-guardian authority to the extent required before child-data processing. A school upload, payment, unchecked declaration or possession of a phone alone does not establish the required verification. We minimise the identity evidence collected and provide an age-appropriate student explanation.
We do not undertake processing likely to harm a child's well-being, targeted advertising directed at children or prohibited tracking or behavioural monitoring. Consent does not override a legal prohibition. An educational or other exemption is used only after confirming that it covers EduBrahma, the particular feature and its purpose; being an education business does not by itself establish eligibility.
At adulthood, the student controls their own ongoing permissions. We obtain or confirm the adult's authorisation for optional processing and continuing parent access. Parenthood alone does not give continuing access to an adult's records. Lawful guardianship arrangements are handled separately.
The collection notice identifies the information requested, its specific use, whether it is necessary or optional, applicable recipients and retention, and how to withdraw or exercise rights. Where required by law, it is available in the chosen supported statutory language. An additional feature requiring sensitive information explains its necessity and obtains the required express permission before collection.
We record the notice and purpose accepted, the person giving consent, verification outcome, time, relevant processors/recipients and subsequent changes. Optional purposes have separate choices. We do not treat inactivity, website browsing or a pre-selected box as consent.
Consent can be withdrawn through the method offered when it was given or by contacting section 14. Withdrawal must be comparably easy. On a valid withdrawal, we cease the affected consent-based processing and cause the relevant processors to cease within the period required by law, without waiting for an ordinary retention period to expire. We also initiate the applicable deletion steps. A stricter service-specific withdrawal commitment continues to apply. If necessary information is refused or its permission withdrawn, we may be unable to provide the directly affected service. We explain that consequence without making withdrawal conditional on accepting that explanation. Other service entitlements and mandatory refund rights remain governed by applicable terms and law.
5. EduBrahma's research and commercial analytics
5.1 Reserved uses
Subject to lawful creation, rights clearance and this Policy, EduBrahma may retain, combine, improve, publish, commercialise and license De-identified and Aggregated Data and products derived from them. Uses include assessment calibration, taxonomy and rubric development, learning research, benchmark distributions, product/model development, research reports, dashboards, APIs, institutional planning, policy analysis and scholarship programme planning.
Recipients may include government organisations, educational institutions, researchers, scholarship agencies, funders and commercial licensees. EduBrahma controls available products, pricing, access, recipient eligibility and licence scope, subject to existing commitments and law. Access does not transfer ownership of the underlying platform, corpus or confidential methods.
No student, institution or other contributor acquires royalties, revenue participation, co-ownership or a right to inspect our research corpus merely by supplying data or receiving a report. Any such entitlement requires a separate valid agreement or applicable legal right. Subject to those rights, EduBrahma may set subscription, access and licence fees and retain the resulting revenue.
5.2 Release safeguards
Before classifying data as non-personal or releasing it externally, we assess identification, linkage, singling-out and inference risks. We use appropriate removal/generalisation, cohort thresholds, suppression, output checks and restrictions on repeated queries. Cohort size alone is insufficient. Rare results, handwriting, free text and combinations of school, location, dates or performance may remain identifying.
Pseudonymised working records and their keys remain protected as Personal Data. Models and embeddings are assessed for recoverable personal information. We do not release information as de-identified merely because the recipient does not receive its key. A material increase in identification risk triggers reassessment and appropriate restriction, replacement or withdrawal of the affected release.
5.3 Licence controls
Non-public access requires an accepted licence defining the product, purpose, users, duration and permitted outputs. Our licences restrict redistribution, sublicensing, scraping, reconstruction of restricted datasets, removal of provenance controls, model training and creation of substitute products from our materials unless expressly authorised, to the extent enforceable under law. We prohibit re-identification and unrelated individual targeting as conditions of access. Any independently authorised student referral uses section 6, not re-identification of a research release.
Licences may allow institutions to build and publish their own research on specified products. They define attribution, publication, output ownership and surviving rights. Such research does not transfer EduBrahma's underlying rights. Government funding or commissioning does not itself transfer background IP; any transfer requires an express valid written agreement.
We may restrict exports, meter queries, authenticate users and suspend affected access for suspected material misuse, subject to contract and law. Suspension does not extinguish mandatory student rights. Licence remedies may include audit, correction, deletion certification, termination, recovery of legally recoverable losses and an application for injunctive relief. These remedies operate through the applicable agreement and law.
5.4 Individual decisions
We do not use a research exemption to make a decision specific to a student. A separate lawful processing pathway is required for scholarship selection, individual profiling or another decision affecting a person. Non-personal population research can inform programme planning without identifying students.
6. Identifiable sharing and opportunities
We do not sell identifiable student profiles or answer scripts as unrestricted data products. We may provide paid analytics, assessment verification, programme administration and authorised opportunity services within this Policy.
Before an optional identifiable disclosure, we explain the named recipient, programme, fields, purpose, contact arrangements, retention and withdrawal consequences and obtain the relevant authorisation. General research permission is not authority to send a student's profile to any future partner. Continuing permissions must specify their scope and recipients; material expansions require fresh authorisation.
We minimise disclosed fields. Raw scripts, full contact lists, accommodation information and verification documents are excluded unless specifically necessary and authorised. Opportunity recipients must accept applicable purpose, security, deletion and onward-sharing restrictions. We record disclosures and convey corrections or withdrawal instructions where required. Independent recipients remain responsible for their own lawful processing; EduBrahma retains its responsibilities for the disclosure and its own services.
Withdrawal stops new optional disclosures and processing based on the withdrawn permission. It does not make past lawful disclosures unlawful. Already disclosed information is not automatically exempt from withdrawal/deletion obligations: recipients must act under their applicable duties and any documented independent retention ground.
We disclose any financial interest material to a recommendation. Sponsors determine their awards and eligibility; EduBrahma does not guarantee admission, funding, a scholarship or future performance. An assessment describes evidence available at its stated date and within its methodology. Paid access does not buy altered marks or favourable conclusions.
7. IP, source content and report use
EduBrahma reserves all IP, confidentiality and contractual rights it owns or validly acquires in its software, workflows, rubrics, taxonomies, schemas, evaluation annotations, report designs, database selection and arrangement, benchmark products, models, research and know-how. No licence, assignment or waiver is implied beyond an express valid grant or applicable law. Ownership and licence records govern third-party components.
Students retain copyright they lawfully hold in their original contributions. Processing permissions and content licences serve different purposes. We exercise any content licence only within its valid scope, including authorised processor use and the permitted territories, term and purposes. De-identification does not erase copyright in student expression or examination-board material. Public reproduction of protected extracts requires the appropriate rights even after personal identifiers have been removed.
Lawfully created non-identifying statistics and EduBrahma's independent methods may continue to be used after an account closes or personal-data consent is withdrawn. This survival does not permit continued use of linkable records or protected expression without authority. Facts, general ideas and human abilities are not claimed as exclusively owned merely because our systems analyse them.
A student may retain and share their supplied report for personal educational purposes and exercising rights. This does not grant bulk extraction, resale, redistribution of other students' information or access to our underlying corpus. Other commercial use requires a licence. Reports may combine company IP with Personal Data; each retains its applicable protection.
We may protect source code, model weights, proprietary methods and third-party confidential information when responding to requests, while providing information and explanations required by law. Requests do not confer a general right to source code, model weights, the research corpus or other students' records. We nevertheless provide the requesting student's information and explanations that the applicable law requires.
8. Processors, security and international processing
Authorised providers may support hosting, scanning, evaluation, AI processing, communications, payments, support and security. We require appropriate contracts, access limits, purpose restrictions and security duties. Affiliates have no unrestricted exception. Relevant processor identities and material processing details are supplied with applicable notices and are available through section 14.
Student-linked information is sent only through approved routes and to admitted processors. This Policy does not amend a stricter governing processor, transport or retention restriction. Independent vendor training on Student Content or Personal Data is not authorised by this Policy. Adding or replacing an AI processor that receives children's Personal Data requires the applicable processor-change notice and fresh verified parental consent under our governing controls before the new processor receives that data. This Policy does not itself approve a new processor or training use.
International processing is subject to the applicable restrictions and safeguards for the route, recipient and jurisdiction. We verify material residency and retention representations before making them. The applicable collection notice identifies material overseas processing and any specific location or retention commitment. Where the 2011 SPDI Rules apply, the recipient must ensure the required equivalent level of protection, and the transfer must satisfy the applicable contract-necessity or consent condition. We do not make a blanket India-only storage or zero-retention representation.
We maintain safeguards proportionate to the data and risks, including applicable access, confidentiality, logging, recovery and processor controls. We do not promise absolute security. A breach triggers containment, investigation and required notifications within each applicable deadline. Using a processor does not remove EduBrahma's duties.
9. Retention and deletion
We retain Personal Data only for the disclosed purpose, necessary service administration and any specifically applicable lawful retention requirement. The assessment or programme notice states its access and review window and any fixed retention period before the relevant collection. We do not extend those periods merely because information might be useful commercially.
| Records | Retention rule and end action |
|---|---|
| Raw answer-script images | For the disclosed dispute/re-evaluation window after the final report, followed by the approved 30-day closure margin; then delete, subject to an earlier applicable erasure duty or a specifically justified legal hold. A shorter promised period prevails |
| Linked transcriptions, evaluation records and reports | While necessary for the disclosed report-access, review and authorised service purpose. On expiry or valid erasure, delete the personal information or retain only a lawfully created, non-personal result meeting section 5.2. An opaque identifier or immutable ledger does not by itself justify retention |
| Account and educational profile | While necessary to provide the requested account services; close or remove information when the purpose ends or a valid erasure request requires it. Account activity does not extend expired script or programme retention |
| Minimal consent and notice evidence | Three years after the relevant purpose ends or consent is withdrawn, as applicable, solely to evidence the permission and handle legally supportable compliance or claims; then delete unless a specific law or documented legal hold requires further retention. This is a company retention rule, not a universal statutory minimum |
| Raw identity or parental-verification documents | Only while necessary to complete the authorised verification or satisfy a specific legal requirement; retain the necessary verification result instead of an unnecessary document copy |
| Optional identifiable research and opportunity records | Until the disclosed study/programme endpoint, permission expiry or withdrawal ends the authority, whichever applies first; then cease use and erase within the applicable legal period. Any exceptional retention is restricted to its documented lawful purpose |
| Support and grievance records | For handling the matter and the specifically applicable complaint, dispute or evidence period; retain only relevant records and remove them when that need ends |
| Payment, tax, corporate and mandatory security/processing records | For the applicable statutory period and actual record scope, with use restricted to that purpose. This includes Personal Data, associated traffic data and processing logs where an in-force requirement covers them |
| Backups and processor copies | Remove from active use and delete through the applicable controlled deletion or backup-expiry process. Provider-specific residual periods are disclosed in the relevant processing notice and explained in the erasure response; backup retention is not authority for ordinary reuse |
| Lawfully created non-personal research products and company IP | No fixed expiry while the information remains non-personal and its continued use respects the applicable IP and contractual rights |
Earlier withdrawal, completion of the purpose or a valid erasure entitlement takes precedence over an ordinary business-retention period. A specific in-force legal retention requirement applies only to the records and purposes it actually covers. A service-specific period cannot override law or silently extend an existing shorter commitment.
Deletion has distinct stages: ending active processing and access; deleting active records and instructing processors; and expiry or lawful deletion of remaining restricted copies. We explain any remaining category, purpose and expected deletion date or determinable retention event. We do not state that every copy is gone while a backup, processor copy or legal hold remains. Restored backups must have applicable deletion restrictions reapplied before returning to ordinary service.
A legal hold identifies its obligation or claim, relevant records, responsible owner and review date. It lasts only as lawfully necessary. Records held solely for compliance or a claim are not available for optional research, marketing or routine evaluation. We do not start a research transformation after its authority ends to avoid deletion. Information already lawfully rendered non-personal need not be re-identified to process an erasure request.
10. Cookies, WhatsApp, SMS, email and telephone communications
10.1 Cookies and similar technologies
Essential technologies support authentication, security and requested functionality. Optional analytics or other tracking is activated only after the choice required for the person and purpose. Where consent is required, continued browsing is not consent and non-essential tracking remains off until permission is given. Where optional technologies are offered, the collection notice identifies their purpose, provider, duration and controls before activation. Third-party embeds are not an exemption from our responsibilities.
10.2 Channels and service updates
EduBrahma/TRUpreBoards may communicate with you through WhatsApp messages, SMS, email, telephone calls, automated or pre-recorded voice calls (robocalls), interactive voice response (IVR), and in-app or push notifications, where the channel is offered and lawfully available for the purpose. Communications may be sent directly or through authorised communications providers acting for us.
Service communications include requested-enquiry responses, verification and account security, registration and payment confirmations, assessment schedules and reminders, submission or evaluation status, report availability, review requests, support and important changes affecting a service you have requested. The applicable processing basis and any additional channel permission are required; calling a message a service update does not exempt it from communications rules.
For children, account administration and permission requests are directed to the authorised parent or guardian. Any direct student communication must be age-appropriate, within the authorised service and permitted by applicable platform age rules. A parent supplying a child's number does not override those rules. We minimise student information in messages and use controlled-access links for detailed reports rather than disclose raw scripts or detailed records in an unsolicited message or automated call.
10.3 Promotional updates and choices
Optional communications may include news, educational resources, webinars, new assessments, offers and programme announcements. When they promote services or encourage a new purchase, we treat them as promotional rather than necessary service notices. We send them only to adult recipients who have separately opted in for the relevant purpose and channels. Permission for promotional automated/pre-recorded voice calls is a distinct, express choice, not inferred from permission for email, SMS, WhatsApp or an ordinary support call.
Buying an assessment, providing a phone number, accepting service Terms or viewing this Policy does not by itself provide permission for every communications channel or for marketing. Declining promotions does not change marks or prevent access to an unrelated purchased assessment. Children's assessment information is not used to construct advertising audiences.
10.4 WhatsApp and voice/SMS safeguards
Business-initiated WhatsApp contact requires the recipient's number and the opt-in required by WhatsApp's applicable policy. We observe its messaging, calling and template requirements and honour WhatsApp opt-outs, including requests received outside WhatsApp. A service-message label does not override a WhatsApp channel opt-out.
SMS and telephone campaigns, including automated or pre-recorded calls, must comply with the applicable TRAI/TCCCPR framework and telecom-provider requirements. These include the registration, sender identification, template, consent/preference, calling-time and automated-calling requirements applicable to the route and communication. We do not treat this Policy as a waiver of DND preferences or other protections. An automated call identifies EduBrahma/TRUpreBoards and its purpose; it is not presented as a live human conversation.
10.5 Opt-out and necessary notices
You may withdraw optional communications permission through the unsubscribe or opt-out method provided with the communication, by telling our representative during a live call, or by emailing hello@trupreboards.com. Specify whether your request concerns a particular channel or all promotional communications. We honour clear requests made through any available contact route and apply them within the applicable legal or platform deadline. A minimal suppression record may be retained as lawfully necessary to avoid contacting you again; it is not a marketing profile.
An opt-out from promotions does not stop genuinely necessary service or legally required notices, but those notices may use only a channel and basis that remain permitted. If you opt out of WhatsApp or automated calls, we do not continue using that channel merely because a message concerns your account. Where needed, we explain the available permitted alternative and any directly affected service limitation.
10.6 Communications providers, records and recording
To deliver communications, we may disclose the necessary contact details, message or call content, relevant service reference, channel permissions and delivery instructions to authorised messaging, email, telecommunications, cloud-telephony or support providers. WhatsApp/Meta and telecommunications networks may also process information under their applicable terms and privacy notices. Provider processing and overseas transfers remain subject to section 8; this section does not admit an unapproved provider or permit independent marketing with student data.
We use necessary message/call metadata, delivery results, replies and consent/opt-out records to deliver and support the communication, maintain preferences and evidence lawful use, subject to section 9. Receiving an automated message does not mean your voice is being recorded. If call recording, transcription or an AI voice assistant is offered, we explain that feature, its purpose and relevant retention before it begins and obtain any required permission. This Policy alone does not authorise biometric voice profiling or training an unrelated model on conversations.
11. Access, correction and grievances
An eligible person may exercise applicable rights to access processing information, correct or complete data, request erasure, withdraw consent, raise a grievance and nominate a representative where the law provides. Information about recipients is furnished at the level required by law, including identities where required. Additional jurisdiction-specific rights apply where their conditions are met.
Use the original consent/rights control where available or contact section 14. We verify identity and authority proportionately without routinely demanding a complete government-ID copy. Requests concerning processor-only records are referred to the responsible institution and assisted within our role; we remain responsible for responding about processing purposes we determine ourselves. A rights request does not require consent to marketing or optional research. We protect other persons' information and restrict a request only on an applicable lawful ground, explaining the reason where permitted.
Factual, transcription, association and evaluation errors may be raised through support or the applicable review process. An assessment judgement is not changed merely because it is challenged, but it receives the review appropriate to the alleged error. Review evidence and corrected versions are recorded; material corrections are conveyed to authorised recipients as required.
We handle privacy grievances expeditiously and within one month after receipt, or any shorter mandatory period. Where applicable consumer law requires acknowledgement within 48 hours, that requirement applies. A request for necessary verification does not automatically restart or extend a statutory clock. If unresolved, the individual may approach the authority or forum available under applicable law, subject to its procedure. No terms prevent lawful complaints or regulatory cooperation.
12. Legal disclosures and business changes
We may disclose necessary information to professional advisers under confidentiality, for a specific legal obligation or claim, to address an applicable emergency or offence, or in an appropriately safeguarded business transaction. We verify legal demands and limit disclosure to their lawful scope. Voluntary policy research with a government organisation follows section 5; identifiable programme sharing follows section 6 or a specifically applicable statutory route.
Due diligence uses non-identifying information where practicable. Necessary personal-data disclosure requires a lawful basis, confidentiality and access restrictions. A business transfer preserves applicable privacy commitments and does not sell or assign a person's consent as unrestricted property; materially new purposes require their own authority. Neither government status nor acquisition creates unrestricted rights to student records.
13. Changes, governing law and reserved rights
We may update this Policy prospectively and retain previous versions. A material change is communicated as required before implementation. Fresh consent is obtained where needed for new purposes or expanded sharing. Existing permissions and stricter approved processor controls are not silently broadened. We may change or discontinue optional research products and partner access subject to contract, law and required handling of existing records.
Indian law governs, together with mandatory laws applicable to the particular processing. DPDP provisions apply according to their commencement and scope. Valid Terms or signed agreements specify commercial dispute arrangements and any choice among legally competent courts; statutory forums and mandatory privacy rights remain available.
This Policy does not create a warranty of scholarship outcomes, absolute security, exclusive ownership of unprotectable facts or unrestricted access to company IP. Commercial warranties, indemnities, limitations and remedies belong to the applicable valid agreement and operate only to the extent permitted by law. No provision excludes a non-excludable responsibility. An invalid provision is severed to the extent possible without defeating the lawful remainder or expanding consent.
14. Privacy contact
Contact this address for processing questions, recipient information, consent withdrawal, correction, erasure or grievances. Include the account or assessment reference and the request; do not send passwords, payment credentials or an unnecessary identity-document copy. Where an online consent mechanism is used, an equally accessible withdrawal mechanism will accompany it.
- Data Fiduciary
- EduBrahma Innovations Private Limited — TRUpreBoards
- Grievance Redressal Officer
- Gaurav Rana