This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, how long we keep it, and what rights you have. It applies to learners, parents and legal guardians, website visitors, and contacts at institutional clients.
We do not sell personal data. We do not share personal data for cross-context behavioural advertising.
1. Who We Are
1.1 “ZOE Global Online School” is a brand and trading name operated by Rarepillar Education Services Private Limited, a company incorporated in India with its registered office at C-56 A/12, Second Floor, Technopolis IT Hub, Opposite Stellar IT Park, Block-C, Phase-II, Industrial Area, Sector-62, Noida, Gautam Buddha Nagar, Uttar Pradesh 201309, India (“we”, “us”, “our”, the “Company”). The Company operates the ZOE Global Online School platform under authorisation from the brand owner and is the service provider that delivers the Services.
1.2 The Company is the data controller (and, under India’s Digital Personal Data Protection Act, 2023, the Data Fiduciary) in respect of personal data processed through the ZOE Global Online School platform.
1.3 For all privacy matters, contact support@zoeedtech.com.
2. Personal Data We Collect
2.1 Data you provide
- Identity: Name of learner and of parent or guardian, date of birth or age, gender where provided.
- Contact: Email address, telephone number, postal address, city and country.
- Account: Username, password (stored in hashed form), account preferences.
- Enrolment: Program selected, batch, grade or class level, school or institution, prior academic details where relevant to placement.
- Payment: Billing name and address, transaction identifiers, invoice records, tax identifiers where required.
- Communications: Emails, support tickets, chat messages, feedback, and grievance correspondence.
2.2 Data generated through your use of the Services
- Attendance, session participation, and login records.
- Assessment attempts, scores, submissions, and topic-level performance analytics.
- Content accessed, progress through modules, and time spent on platform features.
- Recordings of live sessions, which may include a learner’s video image, voice, name, and chat contributions.
2.3 Data collected automatically
- IP address, approximate location derived from IP, device type, operating system, browser, and language settings.
- Log data including access times, pages viewed, errors, and referring URLs.
- Cookies and similar technologies strictly necessary to operate the platform, maintain your session, and keep it secure.
2.4 Payment card data
We do not collect or store full payment card numbers, CVV codes, or bank credentials. Card payments are processed directly by regulated payment service providers. We receive only the transaction outcome and limited identifiers such as the last four digits and card type.
3. Children’s and Minors’ Data
This section takes precedence over any inconsistent provision elsewhere in this Policy.
3.1 We provide services to learners under 18. Where a learner is a minor, the account must be created and held by a parent or legal guardian, who provides consent on the minor’s behalf and controls the account.
3.2 Consent basis. We process a minor’s personal data on the basis of verifiable parental or guardian consent, obtained at the point of registration. Under the Digital Personal Data Protection Act, 2023, we obtain verifiable consent of a parent or lawful guardian before processing the data of a child under 18 in India. Where the GDPR or UK GDPR applies, we rely on parental consent for children below the applicable age of digital consent. For learners in the United States, we obtain verifiable parental consent for children under 13 in accordance with the Children’s Online Privacy Protection Act (COPPA).
3.3 Parental access to learner data. Parents and legal guardians are provided access to the minor learner’s attendance, assessment results, and performance metrics through the platform. This access is a core feature of the service and is disclosed at enrolment. The minor learner is informed that their parent or guardian can view this information.
3.4 No tracking or targeted advertising. We do not undertake tracking, behavioural monitoring for advertising purposes, or targeted advertising directed at children. We do not use a minor’s data to build advertising profiles.
3.5 No detrimental processing. We do not process a child’s personal data in a manner likely to cause any detrimental effect on the wellbeing of the child.
3.6 Minimisation. We collect only the data needed to deliver the education, assess progress, keep the learner safe, and communicate with the parent or guardian.
3.7 Recordings involving minors. Live sessions are recorded and may capture minor learners. Recordings are accessible only to enrolled learners of the relevant batch, the instructor, and authorised staff. They are not published, not used in marketing, and not shared with third parties except as required by law or for safeguarding. A learner may participate with their camera off.
3.8 Withdrawal of consent. A parent or guardian may withdraw consent at any time by writing to support@zoeedtech.com. Withdrawal does not affect processing carried out before withdrawal, and may make it impossible to continue delivering the program. Where consent is withdrawn, we retain only what we are legally obliged to retain.
4. Why We Process Your Data and On What Legal Basis
- Create and manage accounts, deliver programs, host sessions, and provide LMS access - performance of a contract.
- Process fees, issue invoices, and maintain financial records - contract and legal obligation.
- Track attendance, assess performance, and report progress to parents and guardians - contract; parental consent for minors.
- Record live sessions for catch-up access, quality assurance, and safeguarding - consent, and legitimate interests in service quality and learner safety.
- Provide support and resolve grievances - contract and legal obligation.
- Secure the platform, prevent fraud, and detect credential sharing - legitimate interests.
- Improve courses and platform functionality using aggregated or de-identified data - legitimate interests.
- Send service and program communications to enrolled learners and parents - contract.
- Send marketing communications - consent, withdrawable at any time.
- Comply with tax, accounting, and regulatory obligations - legal obligation.
Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You may object to such processing as described in Section 9.
5. How We Share Data
5.1 We do not sell personal data, and we do not share it for cross-context behavioural advertising.
5.2 We share personal data only in the following circumstances:
- Cloud infrastructure. Our platform and data are hosted on Amazon Web Services, which processes data on our instructions as a processor.
- Payment service providers, to process transactions and meet financial regulatory obligations. They act as independent controllers for anti-fraud and regulatory purposes.
- Instructors and authorised staff, limited to the learner data required to teach, assess, and support the learner.
- Parents and legal guardians, in respect of a minor learner’s attendance, assessment, and performance data, as described in Section 3.
- Professional advisers, auditors, and insurers, under duties of confidentiality.
- Authorities, courts, or regulators, where required by law or to establish, exercise, or defend legal claims.
- An acquirer or successor entity in the event of a merger, acquisition, or restructuring, subject to this Policy continuing to apply.
5.3 All processors are bound by written agreements requiring them to process data only on our instructions, apply appropriate security, and delete or return data at the end of the engagement.
6. International Transfers
6.1 We operate across India, the GCC region, the EEA, the United Kingdom, the United States, and internationally. Personal data may therefore be transferred to and processed in countries other than the one in which you reside.
6.2 Data is hosted on Amazon Web Services infrastructure. Where data is transferred out of a jurisdiction that restricts international transfers, we rely on an appropriate transfer mechanism, such as Standard Contractual Clauses or an adequacy decision, together with technical and organisational safeguards including encryption in transit and at rest.
6.3 You may request details of the safeguards applied to transfers of your data by writing to support@zoeedtech.com.
7. Retention
7.1 We retain personal data for one year following closure of an account or completion of the program, whichever is later, after which it is deleted or irreversibly anonymised.
7.2 Two exceptions apply:
- Financial and tax records, including invoices and transaction data, are retained for the longer period required by applicable accounting and tax law.
- Data relevant to an actual or anticipated legal claim, regulatory investigation, or safeguarding matter is retained until that matter is concluded.
7.3 Session recordings are retained for the access period of the relevant program and for one year thereafter, unless required for a safeguarding or legal matter.
7.4 Aggregated or de-identified data, from which you cannot be identified, may be retained indefinitely for analytical purposes.
8. Security
8.1 We apply technical and organisational measures appropriate to the risk, including:
- Encryption of data in transit and at rest.
- Passwords stored in hashed form; we never store passwords in plain text.
- Role-based access control, so staff and instructors access only the data they need.
- Access logging, monitoring, and infrastructure hardening on our cloud environment.
- Contractual security obligations on all processors.
8.2 No system is completely secure. You are responsible for keeping your credentials confidential and for notifying us immediately of any suspected compromise.
8.3 Where a personal data breach is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within the timelines required by applicable law.
9. Your Rights
9.1 Subject to the law applicable to you, you may have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct inaccurate or incomplete data.
- Request erasure of your data where there is no continuing lawful basis to retain it.
- Restrict or object to processing, including processing based on legitimate interests.
- Withdraw consent at any time, without affecting processing carried out before withdrawal.
- Receive your data in a portable, machine-readable format.
- Opt out of marketing communications at any time.
- Nominate another person to exercise your rights in the event of death or incapacity, where provided under India’s Digital Personal Data Protection Act, 2023.
- Lodge a complaint with your data protection authority, including the Data Protection Board of India or your local supervisory authority.
9.2 Where the learner is a minor, these rights are exercised by the parent or legal guardian holding the account.
9.3 To exercise any right, email support@zoeedtech.com from your registered email address. We may ask you to verify your identity. We respond within 30 days, or sooner where required by applicable law. There is no fee unless a request is manifestly unfounded or excessive.
9.4 We do not use your personal data to make decisions producing legal or similarly significant effects on you by solely automated means.
10. Cookies
10.1 We use cookies and similar technologies that are strictly necessary to operate the platform: maintaining your logged-in session, remembering preferences, load balancing, and platform security.
10.2 We do not use advertising cookies or third-party tracking pixels, and we do not share cookie data for advertising purposes.
10.3 You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent the platform from functioning.
11. Region-Specific Information
11.1 India
We process personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, and comply with the Information Technology Act, 2000 and the rules made thereunder. You may raise a grievance with our Grievance Officer at support@zoeedtech.com, and escalate to the Data Protection Board of India if unresolved.
11.2 GCC region
For learners in the Gulf Cooperation Council states, we process personal data in accordance with applicable national data protection law, including the Saudi Personal Data Protection Law and the UAE Federal Decree-Law on the Protection of Personal Data, to the extent they apply. Where local law grants rights beyond those in Section 9, those rights apply.
11.3 European Economic Area and United Kingdom
Where the GDPR or UK GDPR applies to our processing, you hold the rights in Section 9 and may lodge a complaint with your national supervisory authority.
11.4 United States (including California)
We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act. California residents may exercise rights of access, deletion, correction, and non-discrimination by contacting support@zoeedtech.com. For children under 13, we comply with COPPA as described in Section 3.
12. Changes to This Policy
12.1 We may update this Policy to reflect changes in our services, technology, or applicable law. The current version, with its effective date, is always published at www.zoeedtech.com.
12.2 Where changes are material, we will notify you by email or platform notification before they take effect. Where a change requires your consent under applicable law, we will obtain it.
13. Contact and Grievances
Data Controller and Fiduciary: Rarepillar Education Services Private Limited
Brand: ZOE Global Online School
Privacy Contact: support@zoeedtech.com
Grievance Email: directordesk@zoeedtech.com
Registered Office: C-56 A/12, Second Floor, Technopolis IT Hub, Opposite Stellar IT Park, Block-C, Phase-II, Industrial Area, Sector-62, Noida, Gautam Buddha Nagar, Uttar Pradesh 201309, India
Response Timeline: Acknowledgement within 48 hours; resolution within 30 working days.
Grievance Officer details are published on our Contact page.