Legal basis
Under the DPDP Act, we process your personal data on the basis of your consent and/or for legitimate uses permitted under the Act (such as where you have voluntarily provided your data for a specified purpose, or to fulfil a legal obligation). Where we rely on consent, you may withdraw it at any time (see Section 11).

6. How We Share Your Personal Data
We do not sell your personal data. We share it only as described below:
•Service providers and processors who help us operate the Website and Services, including our web hosting
provider, payment gateway(s), email and communication tools, and analytics providers. These parties are permitted to use your data only to perform services for us.
•Professional advisers, such as accountants, auditors, and lawyers, where necessary.
•Legal and regulatory authorities, where we are required to disclose data by law, court order, or to protect our legal rights.
•In a business transfer, such as a merger, acquisition, or sale of assets, where personal data may be transferred as part of the transaction (subject to this Privacy Policy).

7. Cookies and Similar Technologies
The Website is built on WordPress and uses WooCommerce, Elementor, and related plugins, which set cookies necessary for core functionality. We may use:
•Strictly necessary cookies — required for the shopping cart, checkout, and security to function.
•Functional cookies — to remember your preferences.
• Analytics cookies — to understand how visitors use the Website (if enabled).
• Marketing cookies — for advertising or remarketing (if enabled).
You can control or delete cookies through your browser settings. Disabling certain cookies may affect the functionality of the cart and checkout.

8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:
•Enquiry data: retained for a reasonable period to respond to and follow up on your enquiry.
•Enrolment and transaction records: retained for the duration of your engagement with us and thereafter for the period required to comply with tax, accounting, and other statutory obligations under Indian law. When personal data is no longer required and there is no legal obligation to retain it, we will securely delete or anonymise it.

9. Third-Party Links and Services

The Website contains links to third-party platforms, including our Instagram page (@academiafoto.india) and may embed content from such platforms. We are not responsible for the privacy practices or content of these third parties. We encourage you to review their privacy policies before providing them with your personal data.

10. Data Security
We implement reasonable security practices and procedures designed to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in line with the requirements of the IT Act and the DPDP Act. These may include access controls, secure hosting, and transmission of payment data through PCI-DSS-compliant payment gateways.
However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping any account or login credentials confidential.

11. Your Rights
Subject to applicable law, including the DPDP Act, you have the following rights in relation to your personal data:
• Right to access — to obtain a summary of the personal data we hold about you and how it is processed.
• Right to correction and updating — to request correction, completion, or updating of inaccurate or incomplete data.
• Right to erasure — to request deletion of your personal data where it is no longer required and there is no legal basis to retain it.
• Right to withdraw consent — where we rely on your consent, you may withdraw it at any time; this will not affect the lawfulness of processing before withdrawal.
• Right to grievance redressal — to raise a complaint with our Grievance Officer (see Section 14).
• Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity.
To exercise any of these rights, please contact us using the details in Section 14. We may need to verify your identity before acting on your request.

12. Children’s Privacy
Our courses are generally intended for adults. Where a person under the age of 18 (“child“) wishes to enrol, we require that enrolment and consent be provided by a parent or lawful guardian. In accordance with the DPDP Act, we will obtain verifiable parental consent before processing a child’s personal data and will not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe we have collected a child’s data without appropriate consent, please contact us so we can address it.

13. Transfers of Personal Data
Your personal data is primarily stored and processed in India. Where any of our service providers process data outside India, we will do so in accordance with applicable law and take steps to ensure your data continues to be protected.

14. Grievance Officer and Contact

If you have any questions, requests, or complaints about this Privacy Policy or how we handle your personal data,
please contact our Grievance Officer:
• Name: Kalpak Fadia
• Designation: Grievance Officer / Data Protection Contact
•Email: academiafoto@gmail.com
•Phone: +91 8369834337
• Address: 105, Creative Industries Premises, Sundar Nagar Rd. No. 2, Kalina, Santa Cruz (E), Mumbai 400098
We will acknowledge and respond to your grievance within the timelines prescribed under applicable law.

15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.The updated version will be indicated by a revised “Last updated” date and will be effective when posted on the Website. We encourage you to review this page periodically