Privacy policy
1. Who we are
This policy covers designschools.in ("we", "us"). For India's Digital Personal Data Protection Act, 2023 (DPDP Act) we act as the Data Fiduciary. Where the GDPR or UK GDPR applies, we act as the controller for the data we process.
2. What we collect
- If you contact us: your name, email address, subject, message, the page you tell us about, and the IP address the request came from. We collect this only when you send the contact form and tick the consent box.
- Server logs: our hosting provider, Cloudflare, processes technical data such as IP address, browser type and requested pages to deliver the site and protect it from abuse.
- Tools and filters: what you type into the search and filter boxes stays in your browser. We do not store it.
The site does not currently run advertising or analytics scripts and does not set advertising cookies. See the cookie notice. If that changes, we will update this policy and the cookie notice first and, where required, ask for consent before any non-essential cookie is set.
3. Why we use it
- Legitimate interests: running, securing and improving the site, and preventing spam (the contact form uses a Cloudflare Turnstile check and rate limiting).
- Consent: replying to the message you send us.
- Legal obligation: where the law requires us to keep or share data.
4. Who receives it
We use service providers to run the site and handle messages: Cloudflare (hosting, security and the Turnstile check), our email provider, and an email delivery service used to send contact messages and automatic replies. We do not sell personal data.
5. Transfers
Data may be processed outside your country, for example in the United States, under standard contractual clauses or the applicable frameworks.
6. How long we keep it
Contact messages are kept for up to 3 years so that we can follow up on corrections and requests, and are then deleted. Server logs are kept by our hosting provider for a short period.
7. Your rights
- India (DPDP Act): information, correction, erasure, grievance redressal and nomination.
- EU and UK (GDPR / UK GDPR): access, rectification, erasure, restriction, objection, portability, and the right to complain to a supervisory authority.
- US states: notice and opt-out of sale or sharing. We do not sell or share personal data.
8. How to use your rights or raise a grievance
Use the contact form and choose "Privacy / data request / grievance". We acknowledge requests within 7 days and resolve them within 30 days, or sooner where the law requires.
9. Children
The site is written for students and parents and is not directed at children. We do not knowingly collect children's data. The DPDP Act requires verifiable parental consent for anyone under 18, so if you are under 18, please ask a parent or guardian to contact us.
10. Security
We use reasonable technical and organisational measures. No method of transmission or storage is completely secure.
11. Changes
The "Last updated" date at the top shows when this policy last changed.
12. Governing law
This policy is governed by the laws of India. See the terms of use for how disputes are resolved.