Data Protection and Privacy Compliance

Last updated on 14 October 2026

1. Our Commitment to Data Protection

Elevate Education Technology Private Limited (“Elevate”, “we”, “our” or “us”) recognises the importance of protecting Personal Data and maintaining the confidentiality, integrity and security of information processed through its website, platforms, products and services.

We are committed to handling Personal Data responsibly, transparently and in accordance with applicable data protection and privacy laws, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made thereunder, to the extent applicable and in force.

Our data protection practices are designed to support lawful processing, transparency, purpose limitation, data minimisation, appropriate security safeguards, accountability and the exercise of individual privacy rights.

2. Scope

This statement applies to Personal Data processed by Elevate in connection with its website, digital platforms, software products, educational technology solutions, customer relationships and related business operations.

Where Elevate processes Personal Data on behalf of an educational institution, corporate customer or other organisation, the applicable customer agreement and data-processing arrangements will govern the respective responsibilities of the parties, subject to applicable law.

3. Our Data Protection Commitments

3.1 Lawful and Transparent Processing

We will process Personal Data only for lawful purposes and on a basis permitted under applicable law.

We will provide appropriate information concerning the Personal Data collected, the purposes of processing and relevant individual rights through our Privacy Policy, applicable privacy notices and other communications, as required by law.

3.2 Purpose Limitation and Data Minimisation

We will seek to collect and process only Personal Data that is reasonably necessary for the relevant and specified purposes.

We will not use Personal Data for materially unrelated purposes unless such use is permitted by applicable law and any required notice or consent requirements have been satisfied.

3.3 Consent and Individual Choices

Where consent is required, we will implement appropriate mechanisms to obtain and record consent in accordance with applicable law.

Where applicable, individuals will be provided with a mechanism to withdraw consent. Withdrawal will be handled in accordance with applicable law and will not affect the lawfulness of processing undertaken before withdrawal.

3.4 Accuracy and Data Management

We will take reasonable steps, appropriate to the nature and purpose of processing, to maintain accurate and relevant Personal Data where accuracy is necessary for the relevant use.

We will provide appropriate channels through which individuals may request correction or updating of their Personal Data, subject to applicable law.

3.5 Data Retention and Deletion

We will retain Personal Data only for as long as reasonably necessary for the purposes for which it is processed, subject to legal, regulatory, contractual, security and recordkeeping requirements.

When Personal Data is no longer required, we will take appropriate steps to delete, anonymise or securely dispose of it, subject to applicable law and technical limitations.

Where we process Personal Data on behalf of a customer, retention, return and deletion will also be governed by the applicable contractual arrangements.

3.6 Security Safeguards

We will implement and maintain reasonable technical and organisational measures designed to protect Personal Data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

Depending on the nature of the processing, these measures may include access controls, authentication measures, logging and monitoring, encryption where appropriate, backup and recovery arrangements, personnel confidentiality obligations and incident response procedures.

Security controls will be appropriate to the nature of the information, the relevant systems and the risks associated with processing.

3.7 Personal Data Breach Management

We will maintain appropriate procedures for identifying, assessing, responding to and documenting Personal Data breaches affecting information for which we are responsible.

Where required by applicable law or contract, we will notify affected individuals, customers, regulators or other relevant parties within the applicable timeframes and provide the information required by law.

Where Elevate acts as a processor on behalf of a customer, we will notify the customer in accordance with the applicable agreement and legal requirements.

3.8 Individual Rights and Grievances

Subject to applicable law, individuals may request information concerning their Personal Data, seek correction or deletion where available, withdraw consent where applicable, and raise privacy-related grievances.

Requests and complaints may be submitted using the contact details set out in our Privacy Policy and Privacy and Grievance Redressal Mechanism.

We will review and address such requests in accordance with applicable law and the circumstances of the relevant processing activity.

3.9 Protection of Children's Personal Data

Where our services involve the processing of children's Personal Data, we will apply the safeguards required under applicable law, including applicable requirements concerning parental or lawful guardian consent and child-specific protections.

Where we process such information on behalf of an institution, the institution must ensure that it is authorised to provide the information and that the applicable legal requirements have been satisfied.

3.10 Service Providers and Data Processors

Where third-party service providers process Personal Data on our behalf, we will take appropriate steps to establish contractual, confidentiality and security safeguards consistent with applicable law.

Where Elevate processes Personal Data on behalf of an institutional or business customer, the processing will be governed by the applicable agreement and, where required or agreed, a Data Processing Agreement.

3.11 Access Controls and Confidentiality

We will seek to restrict access to Personal Data to authorised personnel and service providers who require such access for legitimate business, operational, security or compliance purposes.

Appropriate confidentiality obligations and access controls will be applied in accordance with the nature of the information and applicable requirements.

3.12 Retention of Compliance Records

We may maintain appropriate records of consents, privacy requests, grievances, security incidents, disclosures and other relevant processing activities to the extent necessary for operational, contractual, legal and compliance purposes.

Such records will be handled in accordance with applicable retention and security requirements.

4. Processing on Behalf of Customers

Where Elevate provides technology solutions or related services to educational institutions, corporate customers or other organisations, the relevant customer may determine the purposes and means of processing certain Personal Data.

In such cases, Elevate will process Personal Data in accordance with the applicable agreement, documented instructions and applicable law.

The customer remains responsible for obligations allocated to it under applicable law, including determining the lawful basis for the processing it directs and providing required notices or obtaining required permissions.

Elevate will remain responsible for obligations that apply directly to it under applicable law and the relevant contractual arrangements.

5. Privacy Requests and Grievance Redressal

Individuals may contact Elevate to raise questions, requests or complaints concerning Personal Data.

Privacy Contact / Grievance Officer: info@elevate.education
Email: info@elevate.education
Address: SCO 27, AIHP (Highway Side), Institutional Area, Sector 32, Gurugram, Haryana 122001

Please use the subject line “Privacy Request” or “Privacy Grievance”.

Requests will be reviewed in accordance with applicable law. We may request reasonable information to verify identity or authority before disclosing or modifying Personal Data.

Where a request concerns information processed on behalf of an institution or another organisation, we may coordinate with that organisation or direct the requester to its designated contact, as appropriate.

6. Related Policies and Documents

This statement should be read together with the following documents, where applicable:

• Privacy Policy / Privacy Notice: explains how Personal Data is collected, used, disclosed and retained.
• Website Terms of Use: governs access to and use of our website.
• Privacy and Grievance Redressal Mechanism: explains how privacy requests and complaints may be submitted and handled.
• Customer Agreements and Data Processing Arrangements: govern processing responsibilities where Elevate provides services to institutional or business customers.

7. Updates to This Statement

We may update this statement to reflect changes in our services, data-processing practices, security measures or applicable law.

The revised version will be published on our website with an updated “Last Updated” date. Where required by law, we will provide additional notice or obtain the necessary consent.

8. Contact Us

For questions concerning our data protection practices, please contact:

Elevate Education Technology Private Limited
Privacy Contact / Grievance Officer
Email: info@elevate.education
Address: SCO 27, AIHP (Highway Side), Institutional Area, Sector 32, Gurugram, Haryana 122001