This notice explains what personal data ODA3.Academy collects, why, who receives it, how long it is kept and how you can exercise your rights. It covers the ODA3.Academy website, courses, workshops, live sessions and completion records.
1. Who we are
ODA3.Academy is the training service of ODA3 Institute. The legal entity responsible for your personal data is ODA3 Pvt Ltd, a company incorporated in India, registered office Damyanti Sadan, Sarvodaya Nagar, Road No-4, East Gola Road, Danapur, Patna 801503, Bihar, India (“we”, “us”). Under India’s Digital Personal Data Protection Act, 2023 we are the Data Fiduciary. Where the EU or UK General Data Protection Regulation applies, we are the controller.
Contact for privacy matters: contact@oda3.org, or the privacy request form. Grievance Officer: Mukesh Kumar Singh, Director, ODA3 Pvt Ltd (contact@oda3.org, +91 76440 20102).
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, password (stored as a one-way hash), organisation and role if you give them | You |
| Purchase and billing | Billing name and address, GSTIN if you give one, order details, invoice records | You and the payment gateway |
| Payment | Payment status and a transaction reference. Card, UPI and bank details are entered on the gateway’s own systems; we do not receive or store full card numbers | Payment gateway |
| Learning | Enrolments, progress, quiz answers and scores, assignment and lab submissions, instructor feedback, completion records and certificates | You, instructors and the learning platform |
| Live sessions | Attendance, and the session recording if a session is recorded (you are told before recording starts) | You and the video platform |
| Team programmes | Your name, work email and which courses your organisation assigned to you | Your organisation |
| Enquiries and requests | What you write in a form, and the email address you give | You |
| Technical | IP address, browser type, pages requested, error logs and cookies (see the cookie notice) | Your browser |
We do not ask for sensitive details such as health information. If you ask for a reasonable adjustment, you choose what to tell us, and it is used only to arrange the adjustment.
3. Why we use it
| Purpose | Basis |
|---|---|
| Create and run your account; deliver courses you bought or were assigned | Your consent given at sign-up and purchase (DPDP Act); performance of a contract (GDPR) |
| Take payment, issue invoices and keep tax records | Compliance with law, including Indian tax law |
| Assess work and issue completion records and certificates | Your consent; performance of a contract |
| Report progress to the organisation that enrolled you | Your consent, given when you accept the team invitation |
| Reply to enquiries and handle complaints, appeals and requests | Your consent; our legitimate interest in answering you (GDPR) |
| Tell you when a course you registered interest in opens | Your consent, which you can withdraw at any time |
| Keep the site secure and working | Legitimate uses permitted by law; our legitimate interests (GDPR) |
We do not sell personal data, and we do not use it for advertising.
4. Completion records and record check
Each completion record has a record ID. When the public record check is switched on, anyone who enters a record ID can see the name on the record, the course, the completion date and the specification version. Nothing else is shown. You can ask us to withdraw a record from the public check at any time using the privacy request form.
5. Who receives your data
- Our payment gateway (Razorpay), to process payments and refunds.
- Hosting and email delivery providers, who store the site and send its emails on our instructions.
- Video platform (normally Zoom), for live sessions.
- Your organisation, if it enrolled you: its programme lead sees your progress and completions in the courses it assigned.
- Instructors, for the courses you take.
- Professional advisers and authorities, where required by law.
Our current providers are Hostinger (website hosting), Brevo (email delivery), Razorpay (payments) and Zoom (live sessions). They are bound to use the data only to provide their service to us. We will update this list if our providers change.
6. International transfers
Some providers process data outside India. We transfer data only as permitted by the DPDP Act and, where GDPR applies, with appropriate safeguards such as standard contractual clauses.
7. How long we keep it
| Data | Proposed retention |
|---|---|
| Account and learning activity | While your account is open, then 12 months after you close it |
| Completion records | 10 years from completion, so records can still be confirmed, unless you ask us to delete them |
| Orders, invoices and tax records | As long as Indian tax law requires |
| Enquiries and requests | 24 months from the last message |
| Security logs | 90 days |
8. Your rights
Under the DPDP Act you can ask for a summary of the personal data we hold and how it is used, have it corrected, completed, updated or erased, withdraw consent, nominate someone to act for you, and have a grievance addressed. Where GDPR applies, you also have rights to data portability, to restrict or object to processing, and to complain to your supervisory authority.
Use the privacy request form. We acknowledge requests within 3 business days and complete them within 30 days. If you are not satisfied with how we handled a grievance, you may approach the Data Protection Board of India.
Withdrawing consent does not affect processing already carried out, and we may need to keep some records where the law requires it (for example, tax invoices).
9. Security
We use encrypted connections (HTTPS), hashed passwords, access limited to people who need it, and regular updates. If a personal data breach affects you, we will tell you and the relevant authorities as the law requires.
10. Children
ODA3.Academy is for professionals. It is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes to this notice
We will post any change here with a new version number and effective date, and email account holders about significant changes.