Privacy policy
Last updated 25 October 2026
This notice explains what personal data we collect, why we need it, who we share it with, how long we keep it, and how you can control it. It is written for India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and its rules.
1. Who is responsible for your data
Delhi School of Retail is run by , . We decide why and how your personal data is used, which makes us the "Data Fiduciary" under the DPDP Act. For anything about your data, write to [email protected] or use our data request form.
2. What we collect and why
| What | Why we use it |
|---|---|
| Account: name, email, profile photo (from Google sign-in) | To create your account, sign you in, and put your name on certificates |
| Profile (optional): phone, city, store or company, whether to show you on the leaderboard | To show you on the leaderboard and store rankings if you choose, and to contact you about your account |
| Learning: courses joined, lessons finished, quiz answers and scores, XP, streaks, badges | To save your progress, award XP and badges, and issue certificates |
| Certificates: your name, the course, the date and the certificate ID | So you, and anyone you give the ID to, can check the certificate is real |
| Resume (optional): what you add, such as headline, experience, education, skills and languages. Phone and email only if you choose to show them | To build your resume page, which anyone with your Resume ID can see |
| Payments: name, email, phone, amount, order and payment IDs, payment status | To give you access to what you bought, send receipts, process refunds and keep tax records |
| Forms: name, email, phone, organisation and your message (contact, hiring, team training, data requests, waitlists) | To reply to you and handle what you asked for |
| Practice lab (when it opens): what you do in practice tasks and your scores | To give you feedback and track your practice |
| Technical: device and browser type, pages viewed, and IP address | To keep the site secure, stop spam and fix problems. For our forms we keep only a one-way scrambled version of your IP address, not the address itself |
We don't collect government ID numbers, biometric data or your location from your phone. We never see or store your card, UPI PIN or bank login: Razorpay handles those details when you pay.
3. Your consent
We use your personal data with your consent, which you give when you sign up, fill in a form or choose optional features. We may also use it for the other lawful purposes the DPDP Act allows, for example to meet legal duties such as keeping tax records.
You can withdraw consent at any time, as easily as you gave it:
- Hide yourself from the leaderboard, or remove your phone, city or store, in Profile and settings.
- Delete or unpublish your resume on the resume page.
- Ask us to delete your account using the data request form.
Withdrawing consent doesn't undo anything done before you withdrew. Some features, like certificates, can't work without the data they need.
4. Who we share it with
We don't sell your data. Ads appear only on our public blog, never in the app or in your courses (see section 10). We share data only with:
- Service providers who run parts of the site for us, under contract and only for our purposes:
- Google (Firebase) for sign-in and our database
- Cloudflare for hosting, our server code and cookie-free visit statistics
- Bunny.net for videos and files
- Razorpay for payments
- Google AdSense for ads on our public blog
- People you choose: anyone you give a certificate ID or Resume ID to.
- Employers: only after you agree to be introduced to them for a job.
- Your employer: if your employer paid for your seat, they see your progress in the courses they paid for.
- Authorities, when the law requires it.
5. Where it's stored
Your data is stored with our providers, mainly on servers in India. Some providers may process it in other countries; we do this only where Indian law permits.
6. How long we keep it
| Data | How long |
|---|---|
| Account, learning, certificates and resume | While your account is open. We delete them within 30 days of an account deletion request. Your certificates stop verifying once they're deleted. |
| Payment and invoice records | As long as tax and accounting law requires, usually up to 8 years |
| Form messages | Up to 2 years after our last contact with you |
| Security logs | Up to 1 year |
7. Your rights
Under the DPDP Act you can:
- Get a summary of the personal data we hold about you, what we do with it, and who we've shared it with
- Correct, complete or update it
- Have it erased, unless the law requires us to keep it
- Withdraw consent (see section 3)
- Nominate someone to use these rights for you if you die or can't act for yourself
- Complain to our Grievance Officer, and then to the Data Protection Board of India if you're not satisfied
To use any of these rights, go to Data protection (DPDP). We reply within 30 days. You also have a duty under the Act to give us true information and not to file false or frivolous complaints.
8. Children
Delhi School of Retail is for people aged 18 and over. We don't knowingly collect personal data from anyone under 18 without the verifiable consent of a parent or lawful guardian. We never track children's behaviour or show them targeted ads. If you think a child has signed up, tell us and we'll delete their data.
9. How we protect it
- Everything travels over encrypted connections (HTTPS).
- Database rules let you see and change only your own data.
- Certificates and XP can be written only by our server, not from anyone's browser.
- Payments go through Razorpay, which is certified to the PCI-DSS card security standard.
If a data breach affects you, we'll tell you and the Data Protection Board of India, as the law requires.
10. Cookies and similar storage
We use your browser's storage to keep you signed in and to remember small preferences, like light or dark mode or which tab you had open. Our visit statistics (Cloudflare Web Analytics) don't use cookies. When you pay, Razorpay's checkout may use its own cookies to process the payment safely.
Advertising on the blog. Our public blog may show ads from Google AdSense. Google and its partners use cookies to show ads based on your visits to this and other websites. You can turn off personalised ads in Google's Ads Settings, read how Google uses information from sites that use its services, and manage other ad companies' cookies at aboutads.info. There are no ads in the app, in courses or on pages you see while signed in.
11. Changes to this notice
We'll update the date at the top when this notice changes. For important changes, we'll tell signed-in learners and ask for consent again where the law requires it.
12. Contact and Grievance Officer
For privacy questions, requests or complaints, contact our Grievance Officer. We'll acknowledge within 48 hours and resolve within 30 days.