Privacy Policy

1. Who we are (Data Fiduciary)

This policy is published by Vivencia Educational Services, a registered education-services business operating from Plot No. 288, Road No. 78, Jubilee Hills, Hyderabad 500033, Telangana, India.

For DPDP Act purposes, Vivencia is the Data Fiduciary when we determine the purpose and means of processing personal data submitted through this website.

2. Whose data we process

• School representatives — principals, academic heads, teachers, and other staff who submit consultation enquiries or correspond with us.
• Book customers — individuals and institutions who buy books from vivenciaedu.com/shop.
• Assessment candidates — students or applicants who take an aptitude test through this site (when made available).
• Website visitors — anonymous traffic captured for security and performance only.

Vivencia does not currently collect personally identifiable data about children under 18 through this website. Where a school provides student records or work samples to us as part of a paid programme engagement, that data is governed by the separate Data Processing Agreement signed with that school and is not covered by this policy.

3. What data we collect and why

We do not use cookies for advertising, third-party tracking, or behavioural profiling. The site uses only a small set of local-storage entries (cart, session token, accessibility preferences) which are first-party and not shared.

4. Where your data is stored

Most personal data is stored on Vivencia's own server located in India:

• Vivencia VPS (Hostinger, India) — contact leads, customer accounts, orders, addresses, uploaded images, and admin records. Stored as encrypted JSON files; backups are taken on the same server.
• Postfix mail server on the same VPS sends enquiry notifications to info@vivenciaedu.com; the recipient inbox is operated through standard email providers such as Google Workspace, which may store mail outside India.

Some optional features may transfer specific data to providers outside India:

• Supabase (Singapore) — used only when a candidate takes the /test assessment. The assessment data leaves India during the test session.
• Shipping aggregator (Shipway / Shiprocket, India) — when you place a book order, the recipient address and phone are sent to the shipping aggregator so they can dispatch and track the parcel.
• Payment gateway — when online payment is used, card / UPI / netbanking data is sent directly to a PCI-DSS-compliant gateway (e.g. Razorpay). Vivencia never sees or stores card numbers.

By submitting data through features that require cross-border transfer, you consent to that transfer in accordance with section 16 of the DPDP Act and any rules notified under it.

5. How long we keep data

After the period above, data is either deleted or anonymised so it can no longer identify you.

6. Your rights under the DPDP Act

You have the following rights with respect to your personal data:

• Right to information — ask us what data we hold about you and how it's used.
• Right to correction and erasure — ask us to fix wrong information or delete data we no longer need to keep.
• Right to grievance redressal — raise a concern about how we handle your data; we will respond within 15 working days.
• Right to nominate — nominate another person to exercise your rights in case of death or incapacity.
• Right to withdraw consent — tell us to stop processing data you previously consented to; this will not affect processing already done before withdrawal.

To exercise any of these rights, email info@vivenciaedu.com with the subject line "DPDP rights request" and a description of what you'd like us to do. We may ask you to verify your identity before acting.

7. How we protect your data

• Encryption in transit — the entire site runs on HTTPS with HSTS enabled (TLS 1.2+).
• Server-side hashing — account passwords are stored using bcrypt; we never see your plain-text password.
• Signed admin tokens — the admin panel uses HMAC-signed bearer tokens with an 8-hour expiry.
• Headers — HTTP responses include security headers: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
• Access control — lead and customer data is accessible only via admin-authenticated endpoints; uploads cannot execute server-side code (PHP/CGI disallowed in the uploads folder).
• Backups — data is backed up regularly to an isolated location.

8. Personal data breaches

If we become aware of a personal data breach that is likely to affect you, we will:

1. Notify the Data Protection Board of India within the time prescribed under DPDP Rules (typically 72 hours).
2. Notify affected users by email with the nature of the breach, likely consequences, and the steps we are taking.

9. Third-party services we use

The following third parties may receive specific personal data only when necessary for the feature you are using:

• Hostinger (web hosting, India) — provides the server infrastructure.
• Google Maps embed — loads on the Contact page; Google may receive your IP when the map renders.
• WhatsApp (Meta Platforms, Inc., USA) — if you choose "Continue on WhatsApp", your message and phone interaction are governed by WhatsApp's own privacy policy.
• Shipway / Shiprocket — for order dispatch and tracking when you buy books.
• Razorpay / Shiprocket Checkout — for processing online payments when you check out.
• Supabase — only for the optional /test assessment feature.
• Postfix & recipient mail providers — to deliver enquiry notifications.

We do not embed advertising or behavioural tracking pixels.

10. Children's data

This website is not directed at children under 18. We do not knowingly collect personal data of children through marketing pages, the contact form, or the shop. If a child under 18 takes an assessment or buys a book independently and we become aware of it, we will delete the data on request from the parent or legal guardian.

For programme delivery inside schools — where Vivencia handles student work, scores, or photographs — we execute a separate Data Processing Agreement with the school. That agreement carries explicit parental consent obligations on the school side and minimum-necessary processing on ours.

11. Changes to this policy

We may update this policy as our services evolve, the law changes, or our security practices change. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be highlighted at the top of the page for at least 30 days.

12. Contact & grievance officer

For any questions, requests, complaints, or grievances under the DPDP Act, contact:

Grievance & Privacy Contact
Vivencia Educational Services
Plot No. 288, Road No. 78, Jubilee Hills,
Hyderabad 500033, Telangana, India
Email: info@vivenciaedu.com
Phone: +91 97063 36699

If you are not satisfied with our response, you may also lodge a complaint with the Data Protection Board of India under section 27 of the DPDP Act.