Draft for legal review
Privacy policy
Last updated 26 Sep 2026 · Effective from [date]
This policy explains what personal data Edshaala collects, why, and the choices you have. It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and the rules made under it. In short: you can use Edshaala without an account, we don't take bookings or payments, and we don't sell your data.
1. Who we are
Edshaala ("we", "us") is operated by [Company legal name], [registered address], India, [CIN / registration number]. For personal data you give us, we are the Data Fiduciary under the DPDP Act. Contact: [privacy@edshaala.com].
2. Scope
This policy covers edshaala.com and its forms. It does not cover the websites of the hosts we list. When you click "Go to [Host] to book", you leave Edshaala and the host's own privacy policy applies.
3. What we collect
| Data | When | Where it is stored |
|---|
| Saved workshops, recently viewed, activity counts | When you save or open a listing | Your browser only (local storage). Never sent to us. Clear it any time from Profile. |
| Report an error: reason, note, optional email | When you submit the form | Our servers |
| Suggest a workshop: link, note, optional email | When you submit the form | Our servers |
| Host requests: name, official email or social handle, details | When a host asks us to update or remove a listing | Our servers |
| Technical data: IP address, browser, pages requested, button clicks | Automatically, as you use the site | Server logs and cookieless, aggregated analytics |
Email is always optional. Add it only if you want a reply.
4. What we don't collect
- No accounts, passwords or login.
- No payment or card details. Edshaala doesn't take bookings or payments.
- No advertising or tracking cookies, and no third-party pixels.
- No sensitive data such as health, financial, biometric or religious information. Please don't put it in the free-text fields.
5. Why we use it
We use form data only for the reason you gave it to us: to fix a listing, review a suggestion, handle a host request, or reply if you left an email. We use technical data to run, secure and improve the site, count visits to host pages, and prevent abuse. Where we rely on your consent, you can withdraw it at any time as easily as you gave it, by writing to [privacy@edshaala.com]. Withdrawal doesn't affect processing done before it. We do not sell personal data, use it for advertising, or make automated decisions about you.
6. Information about hosts
Listings describe workshops using business information that hosts publish on their own public pages, such as the host's name, offering, format, price shown, location and website. We link to the source and show when we last checked it. We don't publish hosts' personal phone numbers or emails, and we don't copy host images.
If you are a host, you can ask us to correct your listing, remove it, or remove all your listings using "Update or remove this listing" on any listing page. We verify requests through your official email or social account and act on removals within 72 hours. After removal we keep only a minimal record so the listing isn't added again.
7. Children
Some listings are for children, but Edshaala's forms are for adults. We don't knowingly collect personal data from anyone under 18. If a child has sent us personal data without a parent's or guardian's consent, write to us and we will delete it. We don't track, monitor or profile children, and we run no targeted advertising, anywhere on the site.
8. Sharing and transfers
We share personal data only with service providers who process it for us under written contracts, such as [hosting provider], [database provider] and [email provider], and only as far as they need it. We don't pass your report or suggestion to the host with your name or email attached. We may disclose data if the law requires it, to a lawful government request, or to protect our rights and users' safety.
Some providers may store data outside India. We transfer data only to countries the Government of India hasn't restricted under Section 16 of the DPDP Act, and with suitable safeguards.
9. How long we keep it
- Error reports and suggestions: up to [12] months after we close them.
- Host requests and removal records: for as long as needed to honour the removal, and as the law requires.
- Server logs: up to [1 year], or longer if the law requires it.
- Data on your device: until you clear it.
When data is no longer needed we delete it. Where the Rules require it, we will tell you at least 48 hours before erasing data linked to you.
10. Security and breaches
We protect data with reasonable safeguards, including encryption in transit, access limited to people who need it, and access logs. No system is fully secure. If a personal data breach affects you, we will tell you without delay, explaining what happened, what data was involved, what we are doing, and what you can do. We will also report it to the Data Protection Board of India as the Rules require.
11. Your rights
Under the DPDP Act you can:
- Get a summary of the personal data we hold about you and how we use it.
- Ask us to correct, complete, update or erase it.
- Withdraw consent.
- Nominate someone to exercise your rights if you die or become unable to.
- Complain to our Grievance Officer, and then to the Data Protection Board of India.
To use these rights, write to [privacy@edshaala.com] from the email you gave us, or tell us which form you submitted and when. We may ask you to confirm your identity first.
12. Grievance officer
[Name], Grievance Officer
[Company legal name], [address]
[grievance@edshaala.com] · [+91 phone]
We acknowledge complaints within [48 hours] and aim to resolve them within [30 days]. The same officer handles content and takedown complaints under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. If you're not satisfied with our response, you can complain to the Data Protection Board of India.
13. Host websites
Booking happens entirely on the host's website or booking platform. We aren't responsible for how hosts or platforms handle your data. Read their privacy policies before you share anything.
14. Changes to this policy
We will post any changes here and update the date at the top. If a change affects how we use data you have already given us, we will tell you by email if you left one, and ask for fresh consent where the law requires it. This policy is governed by the laws of India. Courts in [city] have jurisdiction.