Privacy Policy | Indian Talent Olympiad (ITO)
Privacy Policy
How we collect, use and protect personal data — for students registering directly with us, students registered through their school, parents, school staff and coordinators, and visitors to our website and applications.
Effective from 01-June-2026 Last updated 15-September-2026
01
About this Policy
1.1Indian Talent Olympiad ("ITO", "we", "us" or "our"), conducts Olympiad examinations for school students across India through its website www.indiantalent.org and its mobile applications. The Indian Talent Olympiad programme is operated by Indian Talent and ITO Olympiad Education Private Limited, referred to together in this Policy as “ITO”.
1.2For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), ITO is the Data Fiduciary in respect of the personal data described in this Policy.
1.3This Policy explains what personal data we collect, how we collect it, why we use it, who we share it with, how long we keep it, and the rights available to you. It applies to students registering directly with us, to students registered through their school, to parents, to school staff and coordinators, and to visitors to our website and applications.
1.4This Policy should be read together with the General Terms and Conditions, the Terms and Conditions for Online Olympiad Examinations, the Terms and Conditions for Offline Olympiad Examinations, the Refund and Cancellation Policy and the Shipping and Delivery Policy published on our website.
1.5We process personal data in accordance with the DPDP Act, the Information Technology Act, 2000, the rules made under them, and other applicable Indian law.
02
Definitions
2.1In this Policy:
a."Personal data" means any data about an individual who is identifiable by or in relation to that data;
b."Data Principal" means the individual to whom the personal data relates. Where that individual is a child, it includes the parent or lawful guardian;
c."Data Fiduciary" means the person who determines the purpose and means of processing personal data — in this Policy, ITO;
d."Data Processor" means a person who processes personal data on behalf of a Data Fiduciary;
e."Child" means an individual who has not completed eighteen (18) years of age;
f."Student", "Parent", "School", "Student Login" and "School Login" carry the meanings given to them in our Terms and Conditions; and
g."processing" means any operation performed on personal data, including collection, recording, storage, use, sharing, retention and erasure.
03
Personal Data We Collect and How We Collect It
3.1 Data you or the school give us
3.1.1When a Parent registers a Student directly with us, or a School submits a student list, we collect:
a.the Student’s name, class, section, school name and school code, and the subjects registered for;
b.the Parent’s mobile number and email address, and the delivery address where printed material is ordered;
c.the Student’s date of birth or age, where collected for eligibility; and
d.for schools and coordinators: the institution’s name and address, and the name, designation, mobile number and email address of the coordinator and authorised staff.
3.1.2Where a School registers Students, the personal data reaches us from the School rather than from the Parent directly. The School is required under our Terms to obtain the verifiable consent of the Parent before submitting a student list, and to record that consent.
3.2 Data recorded on examination material
3.2.1In offline examinations, a Student may write a contact number or email address on an OMR answer sheet, attendance sheet or other examination material. Any such field is optional and is to carry the Parent’s contact details.
3.2.2Contact details collected in this way are used for service communications only — about the Student’s participation, results, and dispatch of certificates and awards. They are not used for promotional communications unless the corresponding parental consent has been obtained by the School and recorded.
3.3 Data generated when the service is used
3.3.1We collect examination and account data generated through use of our services, including login and session records, slot selections, answers submitted, attempt records, scores, ranks and results, certificates issued, practice test activity, orders placed, and dispatch and delivery records.
3.3.2We collect limited technical data when our website or applications are used, including device type, operating system, browser, IP address, and pages or screens visited. This data is used to operate and secure the service and to diagnose faults.
3.4 Payment data
3.4.1Payments are processed by third-party payment gateways. We receive confirmation of payment, the transaction reference and the amount. We do not collect or store card numbers, CVV, bank account credentials or wallet credentials.
3.5 Student work
3.5.1Where a Student takes part in the Drawing Olympiad, the Essay Olympiad or a similar activity, we collect the drawing, essay or other work submitted, whether uploaded through the Student Login or submitted on paper through the School and later scanned.
04
Children’s Personal Data
4.1Where the Student is a Child, we process the Student’s personal data only on the basis of the verifiable consent of the Parent.
4.2For direct registrations, that consent is obtained at the time of registration, when the Parent creates the Student Login and accepts our Terms. For registrations made through a School, our Terms require the School to obtain and record the Parent’s consent before submitting the student list, and to produce that record to us on request.
4.3In accordance with section 9 of the DPDP Act, we do not:
a.undertake tracking or behavioural monitoring of children;
b.direct advertising at children;
c.profile children for advertising or commercial purposes; or
d.process a child’s personal data in a way that is likely to cause any detrimental effect on the well-being of the child.
4.4We do not send promotional communications to a contact number or email address belonging to a Student who is a Child. Registered contact details must be those of the Parent. This is also a term of our examination Terms and Conditions.
4.5A Parent may exercise all of the rights in Clause 17 on the Child’s behalf, and may withdraw consent at any time.
05
Why We Use Personal Data
5.1We use personal data for the following purposes:
a.Registration and administration — creating and maintaining the Student Login or School Login, verifying eligibility and class, and administering subscriptions and plans;
b.Conducting examinations — allotting slots, delivering question papers, recording answers and attempts, and maintaining the integrity of the examination;
c.Evaluation and results — marking, ranking, tie-breaking, declaring results, and issuing certificates, reports, medals and awards;
d.Fulfilment — printing and dispatching study material, certificates and awards, and tracking delivery;
e.Payments — processing fees, issuing invoices, and meeting tax and accounting obligations;
f.Service communications — sending schedules, slot details, opt-in windows, results, dispatch tracking and payment confirmations;
g.Support and grievances — answering queries and handling complaints;
h.Publication of results and achievements — as described in Clause 7;
i.Security and fraud prevention — protecting accounts, detecting malpractice, and investigating misuse; and
j.Legal and regulatory compliance — meeting obligations under applicable law and responding to lawful requests.
5.2Promotional communications about our programmes, plans, events and offers are sent only where the Parent has given separate consent for that purpose, as described in Clause 6.
5.3We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.
06
Consent and Communications
Service communications
6.1Communications necessary to deliver our services — registration confirmations, examination schedules, slot details, opt-in windows, results, dispatch tracking and payment confirmations — are sent as a necessary part of providing the service and cannot be opted out of while a registration or subscription remains active.
Promotional communications
6.2We send information about our programmes, plans, events and offers by email, SMS or voice call only where the Parent has given a separate, affirmative opt-in for that purpose. This consent is optional and is not a condition of registration or of participation in any examination.
6.3Where registration is made through a School, we send promotional communications only where the School has obtained and recorded the Parent’s separate consent for that purpose and has passed that to us.
6.4We record the fact and the date of each consent given.
Withdrawing consent
6.5Consent may be withdrawn at any time through the Student Login, by using the opt-out facility in any message, or by writing to our Grievance Officer at the address in Clause 21. Withdrawal takes effect within a reasonable period.
6.6Withdrawing consent to promotional communications does not affect service communications, and does not affect the lawfulness of processing carried out before the withdrawal.
6.7Where consent is withdrawn for processing that is necessary to deliver a service, we may be unable to continue providing that service, and we will tell you where that is the case.
6.8Promotional communications are sent in accordance with applicable telecom regulations, including the regulations of the Telecom Regulatory Authority of India governing commercial communications and customer preferences.
07
Publication of Results, Photographs and Student Work
7.1We publish the name, class and school of award winners and rank holders in results, rankings, winner galleries, award functions, our social media channels, media coverage and promotional material. We may publish a photograph of the Student taken at an award function or school function.
7.2Where a Student submits a drawing, essay or other work, we may use, reproduce and display that work for evaluation and in results, winner galleries, award functions, our social media channels, and print and digital promotional material. This is a permission for those purposes only. It is not a transfer of ownership in the work, and we do not sell the work or license it to any third party for that third party’s own commercial use.
7.3A Parent who does not wish their child’s name, photograph or work to be published may tell us, in the Student Login or by writing to our Grievance Officer. We will give effect to that request for future publication, and will remove existing material from channels under our control as soon as reasonably practicable.
7.4Material already shared with or republished by third parties, including news media, may not be within our control to remove.
08
Examination Monitoring
8.1Where an examination is monitored, we collect the following during the examination session, and only during it:
a.Screen activities — tab / app change; and
b.Front camera — face detection.
8.2This data is collected for the sole purpose of maintaining the integrity of the examination and detecting malpractice. It is not used for any other purpose, is not used to identify a Student outside the examination, and is not used to train any automated system.
8.3Monitoring data is retained for 18 months and is then deleted. It is accessible only to authorised ITO personnel, and is not provided to any Student, Parent, School or third party.
8.4The Parent is informed of this monitoring before the examination and consents to it as part of the registration. Where consent is not given, the Student is not allowed to appear for the examination.
09
Who We Share Personal Data With
9.1We share personal data only as set out below, and only to the extent necessary:
a.Schools — where a Student is registered through a School, we share that Student’s results, certificates and participation records with the School;
b.Service providers — printing and courier partners for certificates, awards and study material; data entry and digitisation providers for converting physical registration forms and student lists; hosting, infrastructure and IT support providers; communication providers for email, SMS and voice; payment gateways; and analytics providers;
c.Professional advisers — auditors, accountants and lawyers, where required;
d.Authorities — where disclosure is required by law, by a court, or by a lawful request from a government authority; and
e.On a business transfer — where ITO or any part of its business is merged, acquired or reorganised, subject to the transferee being bound by obligations no less protective than those in this Policy.
9.2Every service provider processing personal data on our behalf does so under a written contract, is permitted to use the data only for the purposes we specify, and is required to maintain appropriate security. Our contracts with these providers prohibit the use of ITO’s student data to train, test or fine-tune any artificial intelligence or machine learning model.
9.3We remain responsible for personal data processed on our behalf by a Data Processor.
9.4We do not sell personal data, and we do not disclose it to third parties for their own independent marketing.
10
Where Personal Data Is Stored
10.1Personal data is stored on servers located in India, and our operational systems are hosted in India.
10.2Where a service provider processes personal data outside India, we do so only to a country not restricted by the Central Government under the DPDP Act, and under contractual safeguards requiring protection consistent with this Policy.
10.3Where a Student is registered from outside India, the personal data is transferred to and processed in India.
11
How Long We Keep Personal Data
11.1We keep personal data only for as long as it is needed for the purposes set out in this Policy, or for as long as required by law.
11.2In particular:
a.account and registration data is kept while the account remains active;
b.examination records, results and certificate data are kept for eighteen (18) to twenty-four (24) months;
c.payment and invoice records are kept for the period required under tax and company law, currently eight (8) years;
d.consent records are kept for as long as the consent is relied on, and for a reasonable period afterwards, to evidence that it was given; and
e.physical registration forms and OMR answer sheets are kept for eighteen (18) to twenty-four (24) months and are then securely destroyed.
11.3Where personal data is no longer needed and we are not required to keep it, we erase it or anonymise it.
12
How We Protect Personal Data
12.1We maintain reasonable security safeguards appropriate to the nature of the data, including access controls and role-based permissions, password protection of accounts, encryption of data in transit, restriction of access to authorised personnel on a need-to-know basis, secure transfer arrangements with service providers, and backup and recovery measures.
12.2We require our service providers to maintain equivalent safeguards, and to process data only within India unless Clause 10.2 applies.
12.3No method of transmission or storage is completely secure. While we take the measures described above, we cannot guarantee absolute security.
12.4You are responsible for keeping login credentials confidential and for not sharing them. Sharing of credentials may result in withdrawal of access under our Terms.
13
Personal Data Breach
13.1If a personal data breach occurs, we will take immediate steps to contain and remedy it.
13.2We will notify the Data Protection Board of India and each affected Data Principal in the manner and within the timelines required under the DPDP Act and the rules made under it.
13.3A notification will describe the nature and extent of the breach, its likely consequences, the measures taken, and what the affected person can do to protect themselves.
14
Cookies and Similar Technologies
14.1Cookies are small files placed on a device when a website is used. We use cookies that are necessary to operate the website and keep a session secure, and cookies that help us understand how the website is used so that we can improve it.
14.2We do not use cookies or similar technologies for behavioural advertising, remarketing, or building advertising profiles, and we do not permit third parties to do so through our website or applications. This applies to all users, and is required in the case of children under section 9 of the DPDP Act.
14.3Most browsers allow cookies to be blocked or deleted. Blocking necessary cookies may prevent parts of the website from working.
15
Third-Party Links
15.1Our website and applications may link to third-party websites, including our social media channels and app store listings. Those websites are governed by their own privacy policies, and we are not responsible for their content or practices.
16
Accuracy of Personal Data
16.1Certificates, results and communications are generated from the details recorded in the Student Login or School Login. Please check the spelling of the Student’s name, the class, the school and the delivery address, and keep the contact details current.
16.2You can correct most details yourself in the Student Login, or ask us to correct them under Clause 17.
17
Your Rights
17.1As a Data Principal — or as the Parent of a Child Data Principal — you have the following rights under the DPDP Act:
a.Right to access — to obtain a summary of the personal data we hold about you, how it is processed, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared;
b.Right to correction and completion — to have inaccurate or misleading data corrected, incomplete data completed, and data updated;
c.Right to erasure — to have personal data erased where it is no longer needed for the purpose it was collected for, unless we are required by law to keep it;
d.Right to withdraw consent — as described in Clause 6.5;
e.Right of grievance redressal — to have a complaint about our handling of personal data addressed, as described in Clause 21; and
f.Right to nominate — to nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
17.2To exercise any of these rights, write to our Grievance Officer at grievance@indiantalent.org from the email address registered with the account, stating the Student’s name, class and school so that we can identify the record.
17.3We will respond within the period prescribed under the DPDP Act. There is no charge for making a request. We may ask for information to verify identity before acting on a request.
17.4If you are not satisfied with our response, you may complain to the Data Protection Board of India.
18
Your Responsibilities
18.1Please provide accurate and complete information, and do not impersonate another person or register a Student in a class other than the class the Student genuinely studies in.
18.2Please do not suppress material information when providing personal data, and do not make a false or frivolous complaint or request.
19
Automated Decision-Making
19.1Evaluation of answer sheets and calculation of scores and ranks are carried out by automated processing against our answer key and published methodology. Results are subject to internal checks, and our determination of a result is final under our examination Terms.
19.2We do not use automated processing to build behavioural or advertising profiles of Students.
20
Changes to this Policy
20.1We may update this Policy from time to time. The updated Policy takes effect when published on this page, and the "Last updated" date at the top is revised.
20.2Where a change materially affects how we process personal data, we will notify registered users by email or through the Student Login, and where the change requires fresh consent, we will ask for it.
20.3Please review this page from time to time.
21
Grievance Redressal and Contact
21.1For any question about this Policy, to exercise a right under Clause 17, or to make a complaint about how we have handled personal data, please contact:
| Name: | Vedank |
|---|---|
| Designation: | Customer Support — Grievance Officer |
| Email: | grievance@indiantalent.org |
| Telephone: | 1800 266 9192 (toll-free) | +91 8657513066 |
| Address: | No. 1005, Kailas Corporate Lounge, Veer Savarkar Marg, Jogeshwari–Vikhroli Link Road, Vikhroli West, Mumbai, Maharashtra – 400079 |
21.2We acknowledge a grievance within forty-eight (48) hours of receipt and ordinarily resolve it within one (1) month.
21.3If you remain dissatisfied, you may complain to the Data Protection Board of India.
© 2026 Indian Talent Olympiad. All rights reserved. | www.indiantalent.org | grievance@indiantalent.org | 1800 266 9192