PRIVACY POLICY

1. Introduction

Company Name: Best Brains Education Academy Pvt Ltd

GSTIN/UIN: 36AAGCB0563J1ZP

State: Telangana (Code: 36)

Operating under the name Best Brains Learning Centers ("Best Brains India," "Best Brains Learning Center," "Best Brains," "we," "us," or "our"), we respect your privacy and are committed to protecting personal data entrusted to us.

This Privacy Policy explains how we collect, receive, use, store, disclose, transfer, retain, and protect personal data when you:

Visit [INDIA WEBSITE URL] or another website that links to this Privacy Policy
Submit an enquiry regarding a Best Brains program or learning center
Request a placement test, consultation, center tour, or enrolment information
Register for or use an online learning, parent, student, or support platform
Communicate with Best Brains by telephone, email, text message, WhatsApp, social media, or another channel
Apply for employment, teaching, franchise, or business opportunities
Interact with Best Brains India in another capacity.

This Privacy Policy is intended to comply with the Information Technology Act, 2000, the SPDI Rules, the DPDP Act, and the Digital Personal Data Protection Rules, 2025, in each case to the extent that the relevant provisions are in force and applicable.

In this Policy, "personal data" means information relating to an identifiable individual. "Processing" includes collecting, recording, organising, storing, using, sharing, analysing, updating, and deleting personal data.

2. Scope and Relationship with Franchise Centers

Best Brains learning centers may be owned and operated by independent franchisees. A franchise center is not necessarily owned or directly operated by Best Brains India.

Depending on the interaction:

Best Brains India may determine how and why personal data is processed
An independently owned franchise center may determine how and why personal data is processed
Best Brains India and a franchise center may each process information for separate purposes
Best Brains India and a franchise center may jointly participate in providing services.

When you request information about a particular center, we may provide your information to that center so that it can respond to your enquiry, arrange a placement test, discuss enrolment, or provide services.

The center may provide you with its own privacy notice covering its local operations, student records, billing, classroom activities, CCTV, or other processing.

This Policy does not automatically cover the independent processing activities of a franchise center that are outside Best Brains India's direction or control.

3. Personal Data We Collect

The information we collect depends on how you interact with us.

3.1 Parent, Guardian and Prospective Customer Information

We may collect:

Name
Email address
Telephone or mobile number
Home address, city, state, Union Territory, postal code, and preferred center
Preferred communication method
Program interests
Placement-test, tour, or consultation requests
Communications, enquiries, complaints, and feedback
Marketing preferences
Relationship to the student
Payment status, invoice details, and transaction references
Other information provided through enquiry or registration forms.

3.2 Student and Child Information

We may collect information such as:

Name
Date of birth or age
Grade or educational level
School name, where necessary
Parent or guardian information
Selected center, subjects, and programs
Placement-test responses and results
Enrolment and attendance records
Assignments, assessments, scores, and academic progress
Teacher observations and educational feedback
Account identifiers and login information
Communications submitted through learning platforms
Learning preferences and support requirements
Photographs, videos, or testimonials, but only with the required permission
Accessibility, allergy, medical, or accommodation information where necessary to safely provide services.

We seek to limit student information to what is reasonably necessary for educational, administrative, safety, and legal purposes.

3.3 Website and Device Information

When you use our website or digital services, we may automatically receive:

Internet Protocol address
Browser type and version
Device type, operating system, and device identifiers
General location inferred from an IP address
Language and time-zone settings
Pages viewed and links selected
Referral source
Date, time, and duration of visits
Cookie, pixel, and similar technology identifiers
Account activity and login records
Diagnostic, security, and error logs.

3.4 Account and Authentication Information

Where an account is provided, we may collect:

Username
Encrypted or hashed password
One-time-password or authentication information
User role and permissions
Login history
Password reset and security records.

We will never ask you to provide your password through an unsolicited email, telephone call, or text message.

3.5 Payment Information

Payments may be processed by banks, payment gateways, UPI providers, or other authorised payment-service providers.

Depending on the payment method, the payment provider may collect:

Card, bank-account, or UPI information
Billing address
Payer name
Authentication information
Transaction details.

Best Brains may receive a payment confirmation, transaction identifier, limited payment details, and billing status. We do not intend to store complete card numbers, card verification values, UPI PINs, or online-banking passwords.

3.6 Sensitive Personal Data

Under the SPDI Rules, sensitive personal data may include passwords, financial information, physical or mental health information, medical records, sexual orientation, and biometric information.

Best Brains generally does not require sexual-orientation information or biometric data for ordinary website or learning-center services.

We will collect sensitive information only where:

It is reasonably necessary for a lawful purpose
The individual or parent has been informed of the purpose
The required consent has been obtained
Appropriate security measures are used.

Please do not provide medical, financial, identity, or other sensitive information through an unsecured contact form unless the form specifically requests it.

3.7 Franchise and Business-Opportunity Information

When you enquire about a franchise or business relationship, we may collect:

Name and contact information
Preferred territory or location
Business and professional background
Resume or work history
Business ownership information
Information about available capital or financial capacity
References
Communications and interview notes
Identity, due-diligence, and verification information
Information required to evaluate or administer a franchise relationship.

Financial information submitted for a franchise application will not be used for student marketing purposes.

3.8 Employment and Contractor Information

We may collect:

Resume or curriculum vitae
Contact information
Qualifications and certifications
Employment and education history
References
Interview and evaluation records
Work eligibility information
Background-verification information where lawful and appropriate
Compensation expectations
Information needed to administer an employment or contractor relationship.

4. How We Collect Personal Data

We may collect personal data:

Directly from you
From a parent, guardian, or authorised representative
From a student, with appropriate parental involvement
From a Best Brains franchise center
Through our website, applications, and learning platforms
Through cookies and similar technologies
From payment processors and service providers
From schools, community organisations, or referral partners with appropriate authority
From social-media platforms when you interact with our pages
From public or professional sources in connection with employment or franchise due diligence
From corporate affiliates where legally permitted.

Where personal data is collected directly from you, we will provide an appropriate notice explaining the relevant information, purpose, intended recipients, and contact information.

5. Why We Process Personal Data

We may process personal data for the following purposes.

5.1 Responding to Enquiries

To:

Respond to requests for information
Recommend a nearby center
Arrange calls, tours, placement tests, or consultations
Provide programme, tuition, or enrolment information
Connect you with a selected franchise center.

5.2 Providing Educational Services

To:

Assess an appropriate starting level
Register and enrol students
Create parent and student accounts
Provide classes, assignments, assessments, and learning support
Monitor attendance and academic progress
Communicate with parents and guardians
Prepare progress reports
Support student safety and classroom administration
Provide make-up, online, or supplemental learning services.

5.3 Billing and Administration

To:

Process registrations and payments
Issue invoices and receipts
Administer promotions, discounts, and refunds
Maintain accounting and tax records
Prevent duplicate, fraudulent, or unauthorised transactions
Manage center and franchise operations.

5.4 Communications

To send:

Appointment confirmations
Class reminders
Service announcements
Billing and account notices
Safety and emergency communications
Responses to questions and complaints
Program updates
Marketing messages where permitted.

5.5 Website and Service Improvement

To:

Maintain and improve our website and digital platforms
Understand how visitors use our services
Diagnose errors
Develop new programs and features
Conduct internal analysis
Improve customer and educational experiences.

Where possible, analysis is conducted using aggregated, de-identified, or pseudonymised information.

5.6 Security, Fraud Prevention and Legal Compliance

To:

Protect accounts, systems, and networks
Authenticate users
Investigate suspected fraud, misuse, or unauthorised access
Maintain system and security logs
Protect the safety and rights of students, parents, employees, and others
Respond to lawful government, regulatory, judicial, or law-enforcement requests
Establish, exercise, or defend legal claims
Comply with legal, accounting, tax, cybersecurity, and record-retention obligations.

5.7 Franchise and Employment Purposes

To:

Evaluate franchise and employment applicants
Conduct interviews and due diligence
Administer franchise, employment, or contractor relationships
Protect confidential information and intellectual property
Provide training and system access
Monitor compliance with contractual and operational requirements.

6. Grounds for Processing

Depending on the circumstances and applicable law, we process personal data:

With the individual's consent
With verifiable consent from a child's parent or lawful guardian
For the specific purpose for which the individual voluntarily provided the information
To provide a requested service
To meet legal obligations
For employment-related purposes permitted by law
To respond to medical emergencies or protect an individual's safety
To comply with court orders, regulatory requirements, or lawful government requests
For other legitimate uses specifically permitted by applicable Indian law.

Where consent is required, consent will be requested using clear and understandable language and will be limited to the data necessary for the stated purpose.

We will not make access to an unrelated service conditional on consent to unnecessary processing.

7. Children's and Student Privacy

Best Brains provides educational services primarily involving children. We therefore apply enhanced protections to children's personal data.

7.1 Parental or Guardian Involvement

A person under eighteen should not independently submit personal data, create an account, enrol in a programme, or make a payment unless the process has been authorised by a parent or lawful guardian.

Before processing a child's personal data where required, we may take reasonable steps to verify:

That the person providing consent is an adult
That the adult is the child's parent or lawful guardian
That consent relates to the particular child and processing activity.

Verification may involve an existing parent account, confirmation through a verified contact method, identity or age information, a government-authorised digital token, or another legally permitted method. We will seek to collect the minimum information necessary for verification.

7.2 Use of Student Data

Student data is used for educational, administrative, communication, and safety purposes.

We will not knowingly:

Process a child's personal data in a way likely to have a detrimental effect on the child's well-being
Sell or rent a child's personal data
Use a child's learning difficulties or educational performance for unrelated advertising
Direct behavioural advertising to a child
Track or behaviourally monitor a child for advertising purposes.

Educational progress monitoring, account security, and safety-related monitoring may be conducted where reasonably necessary and permitted by law.

7.3 Photographs, Recordings and Testimonials

We will obtain appropriate permission before using an identifiable child's photograph, video, voice recording, work sample, or testimonial for advertising, public social media, or promotional purposes.

Permission for promotional use should be separate from consent needed to provide educational services and may be withdrawn for future use.

7.4 Parent and Guardian Rights

A parent or lawful guardian may contact us to request access to, correction of, or deletion of a child's information, subject to applicable law and legitimate educational, safety, accounting, and legal-record requirements.

8. Cookies and Similar Technologies

We may use cookies, local storage, pixels, tags, software development kits, and similar technologies.

These technologies may include:

Strictly Necessary Technologies

Used for website operation, security, fraud prevention, authentication, load balancing, and form submission.

Preference Technologies

Used to remember language, location, accessibility, and other choices.

Analytics Technologies

Used to understand website traffic, performance, and user interactions.

Advertising and Social-Media Technologies

Used to measure campaigns, limit repeated advertising, and provide advertising to appropriate adult audiences.

Where legally required, non-essential technologies will not be activated until the user has made the relevant choice. Users may manage choices through our cookie banner or cookie-preference tool.

Browser settings may also be used to block or delete cookies. Blocking necessary cookies may prevent some website features from operating correctly.

We do not knowingly use advertising cookies to profile children or deliver targeted advertising to children.

9. Marketing Communications

With appropriate permission, we may send programme announcements, center-opening information, promotions, newsletters, and event invitations by email, SMS, telephone, WhatsApp, or similar channels.

You may stop promotional messages by:

Selecting the unsubscribe option in an email
Following the opt-out instructions in a message
Replying "STOP" where that option is supported
Changing account preferences
Contacting us at info@bestbrains.com.

Opting out of promotional messages will not prevent us from sending essential service communications, including enrolment, scheduling, payment, security, and safety notices.

We will operate telephone and SMS campaigns in accordance with applicable Telecom Regulatory Authority of India requirements and customer communication preferences.

TRAI's framework treats commercial voice calls and SMS sent without the necessary preference or consent as unsolicited commercial communications.

10. How We Disclose Personal Data

We may disclose personal data to the following recipients where reasonably necessary.

10.1 Best Brains Franchise Centers

We may send enquiry, placement-test, enrolment, and contact information to the center selected by you or the center that serves your area.

10.2 Corporate Affiliates

We may share information with Best Brains corporate affiliates for technology, administration, training, customer support, reporting, programme development, security, or legal compliance.

10.3 Service Providers

These may include providers of:

Website hosting
Cloud storage
Customer relationship management
Learning-management platforms
Email, SMS, and communications
Appointment scheduling
Payment processing
Accounting
Cybersecurity
Analytics
Customer support
Background verification
Document management
Professional consulting.

Service providers are authorised to process information only for the services they provide and are expected to use appropriate confidentiality and security safeguards.

10.4 Professional Advisers

We may disclose information to advocates, accountants, auditors, insurers, consultants, banks, financial institutions, and other professional advisers where reasonably necessary.

10.5 Government Authorities and Legal Recipients

We may disclose personal data where required or permitted by law, including to:

Courts and tribunals
Law-enforcement agencies
Government departments
Regulatory authorities
Tax authorities
Cybersecurity agencies
Child-protection authorities
Other legally authorised public authorities.

Where appropriate, we will evaluate whether the request is lawful and proportionate before making a disclosure.

10.6 Corporate Transactions

Information may be disclosed in connection with:

A merger
Acquisition
Investment
Financing
Restructuring
Sale of assets
Transfer of a business or franchise operation
Bankruptcy or insolvency proceedings.

Any recipient will be required to process the information in accordance with applicable legal obligations.

10.7 With Your Consent

We may disclose personal data for another purpose where you have specifically requested or authorised the disclosure.

11. Cross-Border Transfers

Best Brains and its approved service providers may process personal data outside India.

Where personal data is transferred outside India, we will comply with applicable legal requirements, including any restrictions, contractual safeguards, government notifications, or other obligations that apply under Indian law.

We may also apply additional contractual, technical, and organisational safeguards designed to protect personal data during international processing.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to comply with legal, educational, accounting, taxation, contractual, security, and regulatory requirements.

Typical retention periods include:

General enquiries: Normally up to 24 months after the last meaningful interaction unless enrolment occurs.
Parent and student educational records: For the duration of the educational relationship and an appropriate period afterwards, subject to legal and operational requirements.
Payment, accounting, and tax records: For the period required under applicable tax, accounting, and corporate laws.
Marketing records: Until consent is withdrawn or the information is no longer required, together with limited suppression records.
Recruitment records: Normally for the recruitment process and an appropriate period afterwards unless another lawful basis applies.
Franchise enquiries: For the application period and an appropriate business and legal retention period.
Security logs: For a limited operational and security period.
Legal claims: Until applicable limitation periods and related proceedings have concluded.

When personal data is no longer required, we will securely delete, anonymise, de-identify, destroy, or otherwise dispose of it using appropriate methods.

13. Security Measures

We implement reasonable administrative, organisational, physical, and technical safeguards designed to protect personal data against unauthorised access, disclosure, misuse, alteration, loss, or destruction.

Security measures may include:

Role-based access controls
Authentication and password controls
Encryption where appropriate
Secure hosting environments
Firewalls and network monitoring
Security logging
Employee confidentiality obligations
Vendor due diligence
Incident-response procedures
Regular backups
Data-minimisation practices.

No internet transmission or electronic storage system can be guaranteed to be completely secure. Users should protect account credentials and promptly notify us if they suspect unauthorised account activity.

14. Data Breach Response

We maintain procedures to identify, investigate, contain, document, and respond to suspected personal-data breaches.

Where required by applicable law, we will notify the appropriate government authority, affected individuals, data fiduciaries, franchise centers, or other relevant parties within the prescribed period.

Notifications will include the information required by law and may be updated as further facts become available.

15. Automated Processing

We may use automated systems to support:

Spam filtering
Security monitoring
Website analytics
Lead routing
Appointment scheduling
Customer-support workflows
Educational recommendations
Administrative reporting.

We do not intend to make decisions having significant legal or similar effects solely through automated processing unless authorised by applicable law and accompanied by appropriate safeguards.

16. Your Rights

Subject to applicable law, you may have the right to:

Receive information about how your personal data is processed
Request access to your personal data
Obtain a copy of your personal data
Request correction, completion, or updating of inaccurate information
Request erasure of personal data where applicable
Withdraw consent
Object to certain processing
Request grievance redressal
Nominate another person to exercise rights where permitted by law
Exercise any additional rights available under applicable law.

These rights are subject to legal limitations, exemptions, verification requirements, and circumstances where continued processing is required by law.

16.1 Access Requests

You may request confirmation regarding whether we process your personal data and request a copy of the personal data available to you, subject to applicable legal limitations.

16.2 Correction and Updating

You may ask us to correct inaccurate information or update incomplete information.

You are responsible for informing us when your contact details or other relevant information change.

16.3 Erasure

You may request deletion of personal data where retention is no longer necessary or where another applicable legal basis exists.

We may continue retaining information where required for educational, legal, contractual, taxation, accounting, fraud-prevention, security, or regulatory purposes.

16.4 Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing already completed before the withdrawal became effective.

16.5 Nomination

Where applicable law permits, an individual may nominate another person to exercise privacy rights in the event of death or incapacity.

17. Exercising Your Rights

Privacy requests may be submitted to:

Email: info@bestbrains.com

Please provide:

Your full name
Contact information
The Best Brains center or service involved
A description of your request
Information sufficient to identify the relevant records.

We may request reasonable identity verification before responding.

Requests will be handled within the period required by applicable law. Where permitted, we may request clarification or extend the response period for particularly complex requests.

We generally do not charge a fee unless permitted by applicable law for excessive, repetitive, or manifestly unfounded requests.

18. Grievance Redressal

If you have concerns about our processing of personal data, please contact us first.

We will investigate your concern and attempt to resolve it promptly.

Grievance Contact: info@bestbrains.com

Where required by applicable law, we will appoint a Grievance Officer and publish the required contact information.

If you remain dissatisfied, you may have the right to seek remedies before the Data Protection Board of India or another competent authority established under applicable law.

19. Third-Party Websites and Services

Our website may contain links to:

Franchise-center websites
Payment-service providers
Educational platforms
Government websites
Social-media platforms
Recruitment portals
Other third-party websites.

Those websites operate under their own privacy policies and practices. We encourage you to review those privacy notices before providing personal information.

20. Social Media

If you interact with Best Brains through Facebook, Instagram, LinkedIn, YouTube, WhatsApp, X, or another social-media platform, that platform may independently collect and process personal data according to its own privacy practices.

We may receive information that you choose to make available through your profile settings or interactions with our official pages.

Please avoid posting sensitive student information or confidential personal information through public social-media channels.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

Applicable law
Regulatory guidance
Technology
Educational services
Business operations
Security practices
Processing activities.

The latest version will be published on our website together with the revised effective or last-updated date.

Where required, we will provide additional notice or obtain fresh consent before material changes become effective.

22. Contact Us

Questions, requests, complaints, or privacy enquiries may be directed to:

Best Brains Education Academy Pvt Ltd