ArtShala Center for Design Privacy Policy

ArtShala Center for Design Private Limited (“ArtShala”, “we”, “us”, or “our”) is a private limited company incorporated in India, with its registered office at C-14, Sector 44, Noida, Uttar Pradesh 201301, India (CIN: U72200UP2020PTC138359). This Privacy Policy explains how we collect, use, store, share, and protect personal data in connection with our website www.artshala.online, our design-thinking programs, contests (including Kaun Banega DesignoSaurus), school partnerships, and related services (together, the “Services”). This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and, where applicable to our online payment and sale of services, the Consumer Protection (E-Commerce) Rules, 2020. A large proportion of our users are children (persons under 18 years of age) accessing our Services through a parent or school. Section 5 sets out the special protections that apply to their data, in line with Section 9 of the DPDP Act and Rules 10–12 of the DPDP Rules, 2025.

1. Scope and Who This Policy Covers

This Policy applies to personal data we collect from:

Parents/guardians, schools, and students (including minors) who register for or enquire about our programs, camps, or contests, whether directly, through our website, or through partner schools;
Visitors to our website and social media pages;
School partners and their staff who engage with us on behalf of students;
Job applicants, trainers, mentors, and vendors, to the limited extent addressed here (a separate HR/vendor privacy notice governs employees).

2. Personal Data We Collect

2.1 Data provided directly by you

Name, age/date of birth, grade/class, and school name of the student;
Parent/guardian name, email address, phone number, and billing/shipping address;
Payment and transaction details processed via our payment partner (Razorpay) — we do not store full card, UPI, or net-banking credentials ourselves;
Contest and program submissions, including design work, images, videos, or written responses submitted by students;
Communications you send us (emails, forms, WhatsApp, survey responses, testimonials).

2.2 Data collected automatically

IP address, device and browser type, approximate location, and pages visited on our website;
Cookies and similar technologies as described in Section 9;
Attendance, participation, and performance data generated during online or in-person sessions (e.g., session logs, assessment scores, mentor feedback).

2.3 Data we do not knowingly collect

We do not collect financial account credentials, government identity numbers (such as Aadhaar), or health data from students, and we do not knowingly collect any personal data of a child directly without a verifiable parent/guardian relationship being established first, as described in Section 5.

3. Why We Collect and Use Your Data

We process personal data only for the following purposes, and only to the extent necessary for each:

To register students for programs, camps, contests, and school partnerships, and to deliver those Services;
To process payments and fees, including the ₹399 rescheduling/pause fee and contest entry fees, through Razorpay;
To communicate with parents/guardians about schedules, sessions, results, and administrative matters;
To evaluate and provide feedback on student design work as part of our curriculum;
To improve our curriculum, website, and Services based on aggregated, de-identified usage patterns;
To send promotional communications about our programs — only to parents/guardians who have opted in, and never in the form of targeted advertising directed at a child (see Section 5.3);
To comply with applicable law, respond to lawful requests from authorities, and enforce our Terms & Conditions.

Our lawful basis for each of these is the consent of the parent/guardian (or, for adult learners aged 18+, the individual themselves), given at the point of registration or through this Policy, except where processing is necessary to comply with a legal obligation or for a purpose the DPDP Act recognises as a “legitimate use” (for example, responding to a request you have made, such as a support query).

4. Consent and How You Give It

We seek consent through clear, itemised notices at the point of data collection (for example, on registration and payment forms) rather than through a single blanket checkbox. Each notice specifies what data is collected, why, and who it may be shared with. You (or your parent/guardian) may withdraw consent at any time by writing to info@artshala.online; withdrawal will not affect the lawfulness of processing carried out before withdrawal, and may mean we are unable to continue providing a program you have enrolled in.

5. Special Protections for Children’s Data

5.1 Verifiable Parental Consent

Where a student is under 18 years of age, we process their personal data only on the basis of verifiable consent given by a parent or lawful guardian. We verify this relationship at the point of registration using the details already provided by the parent (such as matching billing and student information) and, where required, additional verification steps consistent with Rule 10 of the DPDP Rules, 2025.

5.2 What We Will Never Do

We will not track, monitor, or build a behavioural profile of a child for advertising purposes;
We will not serve targeted advertisements to a child;
We will not process a child’s data in any manner likely to cause detrimental effect to their wellbeing;
We will not require a child to disclose more personal data than necessary to participate in a program or contest.

5.3 Parent/Guardian Rights

A parent or guardian may, at any time, request access to, correction of, or erasure of their child’s personal data, or withdraw consent for its processing, by writing to info@artshala.online. We will act on such requests within a reasonable time and, in any event, within the timelines prescribed under the DPDP Rules, 2025.

5.4 Contest and Program Submissions by Students

Where a student’s design work, name, school, or photograph/video is proposed to be displayed publicly (for example, on our website, social media, or in a winners’ showcase for Kaun Banega DesignoSaurus), we obtain separate, explicit parental consent for that specific display before publishing it.

6. How We Share Your Data

We do not sell, lease, or trade personal data. We share personal data only in the following circumstances:

With Razorpay and other payment processors, solely to complete transactions;
With partner schools, strictly for coordinating program delivery to their enrolled students;
With trainers, mentors, and academic staff, solely to deliver and evaluate the program a student is enrolled in;
With IT service providers (such as our website host, email, and scheduling tools), under contractual confidentiality obligations;
Where required by law, court order, or a lawful request from a government or regulatory authority;
With your express consent, for any other purpose we specifically disclose to you at the time.

Every third party we share personal data with is bound by contract to use it only for the purpose disclosed and to apply security safeguards consistent with this Policy.

7. Cross-Border Data Transfer

Our website and some service providers (such as cloud hosting and payment processing infrastructure) may store or process data outside India. Where this occurs, we take reasonable steps to ensure the receiving party maintains a comparable standard of protection, and we comply with any government notification restricting transfer of personal data to specific countries under the DPDP Act.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose it was collected for, or as required by law (for example, financial records under applicable tax and company law), whichever is longer. As a general rule:

Student and parent registration data: retained for the duration of enrolment plus 3 years, to handle post-program queries and re-enrolment;
Payment and transaction records: retained as required under applicable financial and tax regulations;
Website analytics and cookie data: retained for up to 12 months;
Contest submissions: retained for the duration of the contest cycle and any winners’ showcase period, unless separately agreed.

Where you withdraw consent or request erasure, we will erase your personal data unless retention is required by law, and we will notify you before erasure where required under the DPDP Rules, 2025.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to remember your preferences, understand how visitors use our site, and improve our Services. We use the following categories:

Strictly necessary cookies — required for the website and payment pages to function;
Analytics cookies — to understand aggregate visitor behaviour;
Preference cookies — to remember settings such as language.

We do not use cookies to build behavioural advertising profiles of children. You can control or disable cookies through your browser settings; disabling some cookies may affect site functionality. Where our website places any non-essential cookie, we will seek your consent through a cookie banner before doing so.

10. Data Security

We implement reasonable security practices and procedures as required under the Information Technology Act, 2000 and applicable rules, including access controls, encrypted transmission of payment data (handled by Razorpay under PCI-DSS standards), restricted internal access to student data on a need-to-know basis, and regular review of our security measures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a personal data breach that poses a risk to you, we will notify the Data Protection Board of India and affected individuals as required under the DPDP Act, generally within 72 hours of becoming aware of the breach, describing the nature of the breach, the data affected, and the steps you can take to protect yourself.

12. Your Rights as a Data Principal

Subject to the DPDP Act and applicable exemptions, you (or, for a child, your parent/guardian) have the right to:

Request correction, completion, or updating of your personal data;
Request erasure of personal data that is no longer necessary for the purpose it was collected;
Withdraw consent at any time, as easily as it was given;
Register a grievance with us, and if unsatisfied, approach the Data Protection Board of India.

To exercise any of these rights, write to info@artshala.online. We will respond within a reasonable time in accordance with applicable law.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, we have designated the following Grievance Officer / Data Protection point of contact:

Name: Karan Awasthi

Designation: Founder & Academic Head

Email: info@artshala.online

Address: C-14, Sector 44, Noida, Uttar Pradesh 201301

The Grievance Officer will acknowledge and address complaints within a reasonable time, in accordance with applicable law.

14. Third-Party Links

Our website may contain links to third-party websites (for example, payment gateways, social media, or partner school pages). We are not responsible for the privacy practices of these third parties, and we encourage you to review their privacy policies independently before sharing any personal data with them.

15. Children Under 18 — Age Representations

By registering a student for any Service, the parent/guardian confirms that they are the parent or lawful guardian of the student, or otherwise authorised to give consent on the student’s behalf, and that the information provided is accurate.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. The “Effective Date” at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically to stay informed of any changes.

17. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

ArtShala Center for Design Private Limited

Registered Office: C-14, Sector 44, Noida, Uttar Pradesh 201301, India

Phone: +91 9810625045