Privacy Policy

1. Who we are (Data Fiduciary)

DPOCertification.Org (“we”, “us”, “our”) operates the learning and certification platform at DPOcertifications.org (the “Platform”). For personal data processed in connection with your use of the Platform, we act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”).

Educational content on this Platform is for learning purposes only and is not legal advice. This Privacy Policy describes how we process personal data for Platform operations.

2. Personal data we process

Depending on how you use the Platform, we may process:

• Identity & account data — name, email address, mobile number (where OTP sign-in is used), organisation/domain, profile details
• Authentication data — session cookies, OAuth / OTP verification metadata, provider identifiers (e.g. Google, Microsoft)
• Learning & certification data — course enrolments, lesson progress, quiz/exam attempts, scores, certificates and verification codes
• Organisation / enterprise data — membership, department mapping, and admin-managed learner records when an employer sponsors access
• Usage & device data — IP address, browser type, pages viewed, referral codes, approximate location derived from IP
• Communications — support messages, grievance submissions, and marketing preferences where you opt in
• Payment-related data — enrolment/payment status processed via our payment partner (we do not store full card numbers)

3. Purposes of processing

We process personal data for the following purposes, limited to what is necessary:

• Provide accounts, authentication, and secure access to the Platform
• Deliver courses, assessments, exams, certificates, and progress tracking
• Operate organisation / enterprise LMS features and reporting for authorised admins
• Improve Platform performance, security, fraud prevention, and reliability
• Send service notices (account, enrolment, certificate, security alerts)
• Send optional product updates or learning tips only where you have given consent or where otherwise permitted
• Comply with applicable law, respond to lawful requests, and establish or defend legal claims
• Measure and remember cookie / consent preferences via our Consent Manager (Complynz)

4. Lawful basis under DPDP

Where required, we rely on your consent (Section 6) for non-essential cookies, analytics beyond security, and optional marketing communications. Consent is free, specific, informed, unconditional, and unambiguous, and may be withdrawn as easily as it was given.

We may also process personal data for legitimate uses under Section 7 where applicable (for example, performance of a contract to provide the Platform you requested, employment-related processing for enterprise admins acting for their organisation, compliance with law, or establishment of legal claims).

Withdrawal of consent does not affect the lawfulness of processing before withdrawal, or processing that continues on another lawful ground (e.g. retaining exam records required for certificate integrity).

5. Notice (Rule 3)

At or before collection (or as soon as practicable), we provide notice of: the personal data categories collected; purpose(s); how to exercise rights; how to withdraw consent; and how to complain to the Data Protection Board of India after exhausting our grievance process. This Privacy Policy, our Cookie Policy, in-product notices, and the Complynz consent banner together form that notice.

6. Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are loaded only after you grant consent through the Complynz Consent Banner, unless an applicable legitimate use applies for strictly necessary cookies.

7. Children’s data

The Platform is intended for professionals and learners aged 18+. We do not knowingly offer services that require processing children’s personal data. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it, subject to legal retention exceptions.

8. Sharing and processors

We may share personal data with:

• Infrastructure and hosting providers (e.g. Vercel) and database providers (e.g. Supabase)
• Authentication providers (e.g. Google, Microsoft / Azure AD, SMS OTP providers)
• Consent management — Complynz (https://complynz.com/) for cookie consent and related preference records
• Payment processors (e.g. Stripe) for paid enrolments
• Enterprise customers — where your organisation sponsors access, authorised org admins may see enrolment and progress data for their learners
• Professional advisers or authorities where required by law

9. Cross-border transfers

Personal data may be processed on servers located outside India (for example, hosting or authentication regions). We transfer personal data only in a manner consistent with Section 16 of the DPDP Act and applicable Rules, and we apply contractual and technical safeguards appropriate to the risk.

10. Retention

We retain personal data only for as long as necessary for the purposes above, including: account lifetime; certificate verification integrity; legal, tax, and dispute retention; and security logs for a limited period. When no longer required, we erase or anonymise data, subject to legal holds.

11. Security

We implement reasonable security safeguards to prevent personal data breach, including access controls, encrypted transport (HTTPS), session protections, and least-privilege administrative access. No method of transmission or storage is perfectly secure; please use strong unique credentials and protect OTP codes.

12. Your rights as a Data Principal

Subject to the DPDP Act and Rules, you may request:

• Access to a summary of personal data we process about you and processing activities
• Correction and completion of inaccurate or incomplete personal data
• Erasure of personal data no longer necessary for the stated purpose, subject to legal retention
• Data portability where technically feasible and applicable
• Withdrawal of consent for consent-based processing
• Nomination of an individual to exercise rights in the event of death or incapacity (Section 14), where we support that workflow

13. How to exercise rights

Email privacy@dpocertification.org from your registered address (or contact your organisation admin for employer-managed accounts). We will respond within the timelines prescribed under the DPDP Rules.

14. Grievance redressal

Grievance Officer, DPOCertification.Org is the contact for grievances relating to personal data processing.

Email: grievance@dpocertification.org

We aim to acknowledge and resolve grievances within the period prescribed under the DPDP Rules. If unresolved, you may approach the Data Protection Board of India as provided under the DPDP Act.

15. Changes

We may update this Policy to reflect Platform or legal changes. The “Last updated” date will change accordingly. Material changes affecting consent-based processing will be notified through the Platform or consent banner where required.

16. Contact

DPOCertification.Org

Privacy: privacy@dpocertification.org

Grievance: grievance@dpocertification.org

Website: https://dpocertification.vercel.app