This Privacy Policy explains how IRO Design Academy Private Limited collects, uses, shares, and stores personal data. For that data, IRO is the Data Fiduciary. This Privacy Policy prevails over the short privacy summary in the Terms and Conditions.

1. Who we are

1.1 IRO Design Academy Private Limited (“IRO”, “we”, “us”) operates the website https://irodesignacademy.com and the live programmes, workshops, and learner portals offered under the name IRO Design Academy.
1.2 For personal data collected through that website, an application, a payment, a class, or a support channel, IRO is the Data Fiduciary. We decide why the data is processed and how.
1.3 This policy applies to Visitors, Applicants, Students, parents or guardians of a minor Applicant, and people who write to us. It does not apply to staff records, which are handled under a separate internal notice.

2. What this policy covers

2.1 It covers digital personal data processed in India in connection with the Website and our Programmes. “Personal data” means any data about an individual who is identifiable by, or in relation to, that data.
2.2 It does not cover anonymous statistics that cannot be linked back to a person, or third-party sites linked from our Website. Those sites have their own policies.

3. Personal data we collect

3.1 Data you give us

• Identity and contact: name, email, phone number, city, and, where a form asks for it, date of birth.
• Application and academic: education, work status, portfolio links, answers to counselling questions, and parent or guardian details if the Applicant is under 18.
• Account and support: login identifiers, messages you send us, and grievance correspondence.
• Payment references: name on the transaction, amount, payment mode, and the gateway reference. We do not store card numbers, CVV, UPI PIN, or net-banking passwords. Those are handled by the payment gateway.
• Class participation: comments in chat, work you submit, and video or audio if you turn your camera or microphone on in a recorded session.

3.2 Data collected automatically

• Device and log data: IP address, browser type, operating system, date and time of access, pages viewed, and the address of the site you came from.
• Cookie and similar identifiers, as described in section 7 of this Privacy Policy.

3.3 Data from others

We may receive a payment status from the payment gateway, a lead from an advertising partner if you submitted a form on their page, or attendance data from the live-class tool. We treat that as personal data under this policy.

4. Why we use it

4.1 To respond to an enquiry and provide counselling you asked for.
4.2 To process an application, take payment, issue a tax invoice, confirm a seat, and deliver the Programme, including live sessions, materials, critiques, and certificates.
4.3 To send service messages about a batch, a payment due, a class link, or a change to a Programme you have paid for, by email, SMS, phone, or WhatsApp.
4.4 To provide career support where your Programme includes it, and to share your profile with a hiring partner only if you have asked us to, or the enrolment terms say we will.
4.5 To keep the Website secure, prevent fraud, fix errors, and understand which pages are used, using aggregated or limited technical data.
4.6 To send offers about other IRO programmes, only where you have consented, or where the law allows a message of that kind. You can opt out without losing service messages.
4.7 To meet tax, accounting, and legal duties, and to establish or defend a legal claim.

We do not sell personal data. We do not use it for a purpose that is incompatible with the purpose you were told at collection, unless the law allows that use or you consent.

5. Notice and consent

5.1 Where processing depends on consent, we will ask for it before or at the time of collection, in a notice that states the personal data, the purpose, the way to withdraw consent, and how to complain. Consent must be a clear positive act. A pre-ticked box is not consent.
5.2 Service delivery and marketing are separate. You can refuse marketing and still apply or enrol.
5.3 You may withdraw consent by writing to privacy@irodesignacademy.com. Withdrawal does not affect processing already done. If we cannot deliver a Programme without the data, we will tell you before closing the enrolment. Fees then follow the Refund and Cancellation Policy.
5.4 Some processing does not depend on consent, including processing needed to perform our contract with you, to comply with law, or to respond to a medical emergency or a legal order, as the Digital Personal Data Protection Act, 2023 allows.

6. Children and minors

6.1 A Programme is contracted with a person of 18 or older, or with a parent or legal guardian. We do not knowingly collect personal data from a child under 13.
6.2 If an Applicant is under 18, the parent or guardian must complete the consent step and is the contracting party. We will take verifiable parental consent before processing a child’s data, as required by the Act.
6.3 We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.
6.4 If we learn that we hold a child’s data without the required consent, we will delete it.

7. Cookies and tracking

7.1 The Website may use cookies and similar tools to remember a session, understand traffic, and keep the site reliable. A cookie is a small file stored on your device.
7.2 Strictly necessary cookies are required for pages such as checkout to function. Analytics cookies help us see which pages are used. They are used only as stated in the cookie notice on the site.
7.3 A cookie does not by itself collect your name. If you have already given us identifying details, a cookie may be tied to that record so we can keep you signed in or complete a payment.
7.4 Aggregate cookie statistics may be processed by an analytics provider acting on our instructions. You can block cookies in your browser. Some features, including payment, may then fail.

8. Who we share data with

8.1 Staff and mentors who need the data to teach, assess, or support you.
8.2 Processors engaged under a contract that limits them to our instructions. Typical categories are: payment gateway (currently Razorpay, or the gateway named at checkout); live-class and recording tools; email, SMS, and WhatsApp delivery; website hosting; and accounting.
8.3 Hiring partners, only for Students who have opted into placement support and only to the extent needed for an introduction.
8.4 Professional advisers, insurers, and authorities, where we must disclose for tax, a legal order, or to establish or defend a claim.
8.5 A buyer of the business, if the academy is transferred, in which case you will be told of the change of fiduciary.

Processors may not use the data for their own purposes. We remain responsible for their processing done for us.

9. Transfers outside India

Some tools we use may store or access data outside India. We transfer personal data outside India only as the Digital Personal Data Protection Act, 2023 and its Rules allow, and not to a country the Central Government has restricted. On request, we will tell you the categories of overseas tools used for your Programme.

10. How long we keep it

10.1 Enquiry data that does not become an enrolment: 12 months from the last contact, unless you ask us to delete it sooner.
10.2 Application, payment, and invoice records: 8 years from the end of the financial year, to meet tax and company-law duties.
10.3 Academic records, submitted work, and certificate data: for the period we need to verify completion, ordinarily 3 years after the cohort ends, unless a longer period is required for a credential check.
10.4 Class recordings: for the access window in the Admission and Academic Policy, and a short archive after that for quality and disputes, then deletion or de-identification.
10.5 Marketing contact: until you withdraw consent or opt out.

When the purpose is over, and the law does not require us to keep the data, we erase it or de-identify it. You can also ask for erasure under section 12 of this Privacy Policy, subject to those legal holds.

11. Security

11.1 We use reasonable technical and organisational safeguards appropriate to the data, including access limits, encrypted payment hand-off, and restricted mentor access to cohort records.
11.2 No online transmission is perfectly secure. You are responsible for keeping your login and mailbox secure.
11.3 If a personal-data breach occurs that the Act requires us to notify, we will inform the Data Protection Board of India and affected people in the form and time the Rules prescribe.

12. Your rights

Subject to the Act, you may ask us to:

• confirm whether we process your personal data, and for a summary of what we process and the persons with whom it has been shared;
• correct or complete data that is inaccurate or incomplete;
• erase data that is no longer needed for the purpose, unless a law requires us to keep it;
• withdraw consent, where processing was based on consent;
• nominate another person to exercise these rights if you die or become incapacitated;
• complain to the Accounts Department, and then to the Data Protection Board of India, once that route is open.

Write to privacy@irodesignacademy.com from the email we hold for you, or with enough detail for us to identify the record. We will acknowledge within 48 hours and respond within 30 days, or sooner if the Rules in force require a shorter period. We may ask you to confirm your identity before releasing data.

13. Calls, SMS, email, and WhatsApp

13.1 If you submit a phone number or email, we use it for messages about the enquiry, application, or Programme you started. Those service messages are part of delivering what you asked for.
13.2 Promotional calls and messages follow the Telecom Commercial Communications Customer Preference Regulations and your consent. Registering a number on the Do Not Disturb list does not, by itself, authorise promotional contact. We do not treat a DND registration as consent.
13.3 You can opt out of marketing by the link in the message, by replying STOP where the channel supports it, or by writing to privacy@irodesignacademy.com. Service messages about a paid Programme continue until that Programme ends.

14. Third-party links

The Website may link to external sites, tools, or resources. We are not responsible for their privacy practices or content. Read their policies before submitting personal data there.

15. Changes to this policy

We may update this policy to reflect a change in the academy, a tool we use, or the law. The new version will be posted with a revised date. A change that expands how we use data already collected for a new purpose will be notified to you, and we will take fresh consent where the Act requires it. Continued use of the Website after a posted change applies to new processing. Enrolled Students will be emailed if a change affects data we hold for their Programme.

16. Grievance and contact

16.1 Grievances are handled by the Accounts Department of IRO Design Academy Private Limited, 400-A, 4th Floor, 12 Ajit Singh House, Yusuf Sarai Commercial Complex, New Delhi 110016. There is no named grievance officer. Email privacy@irodesignacademy.com or hello@irodesignacademy.com. Phone: +91 7982367687.
16.2 Write “Privacy grievance” in the subject line, with your name, registered email or phone, and what you want corrected, deleted, or explained. We will acknowledge within 48 hours and aim to close the grievance within 30 days.
16.3 If you are not satisfied, you may approach the Data Protection Board of India in the manner prescribed under the Digital Personal Data Protection Act, 2023, once that mechanism applies.
16.4 This policy is governed by the laws of India. Courts at New Delhi have jurisdiction, subject to any non-excludable right to approach the Board or a consumer forum.