Privacy notice
Who we are. Versa Olympiads, [legal entity name and address], the Data Fiduciary under the Digital Personal Data Protection Act 2023. Contact: [email protected].
Children are never named. We do not collect, store or process any child's name, date of birth, photograph, voice, video or free-text writing that could identify them. Each child is represented only by a token issued to the registering parent. The link between a token and a child is known to the parent and to the school; it is not held by us.
What we collect, and why
| Who | What | Why | Kept for |
|---|---|---|---|
| Parent or guardian | Name, mobile, email, school code, grades registered, payment reference | To register, issue the token, send results and receipts | Season plus 12 months |
| Child (as token) | Token, grade, band, exam answers and timings, scores; in Versa Club, team work and a short reflection | To run the exam, score it, and report results by token | Raw answers 90 days after publication; scores season plus 12 months |
| School staff | Principal and coordinator name, role, phone, email; teacher name for clubs | To arrange the exam and clubs with the school | While the school works with us plus 12 months |
What we do not do. No advertising, no profiling of children, no tracking pixels in our emails, no analytics or cookies in the exam page, no sale or sharing of data with anyone for their own purposes.
Who processes data for us. Our registered service providers, each bound by their own terms and data processing agreements: a CRM for school and parent contacts, a forms service for registration and exam capture, a database for tokens and scores, a payment gateway for fees (we never see card or bank details), Google Workspace for email, a hosting provider for the exam page, and an integration gateway that connects these tools. Some of these providers store data outside India. Transfers are permitted under the Act except to countries the Central Government restricts.
Your rights. You may ask what we hold about you and your child's token, ask for correction, withdraw consent, or ask for deletion. Write to [email protected] with the token or your registered email. We respond within [30] days. If you are not satisfied, you may complain to the Data Protection Board of India.
Security. Two-step verification on every account we use, least-privilege access per tool, per-school read-only links that expire at season end, and no shared logins. Incidents that affect you are notified to you and to the Board as the Act requires.
Consent. By registering and paying, you consent to this processing for your child, as the parent or lawful guardian. Consent can be withdrawn at any time; withdrawal ends future processing and does not affect what was lawfully done before.
Version 1, [date]. Changes are dated here.