Privacy Policy

1. Introduction

This Privacy Policy explains how My School for Earth (“Platform”, “we”, “us”, or “our”) collects, uses, stores, and protects your personal data when you use our website and services. By accessing or using the Platform, you agree to the practices described in this Policy. If you do not agree, please do not use the Platform.

The Platform is owned, managed, and operated solely by iSTEP Mentors. The programme concept is co-created with The University of Melbourne, which acts only as an academic mentor. iSTEP Mentors is the entity responsible for all data collection and processing described in this Policy.

2. Applicable Laws

This Privacy Policy is framed in accordance with the following Indian laws, as the Platform currently operates in India:

• Digital Personal Data Protection Act, 2023 (DPDPA)
• Digital Personal Data Protection Rules, 2025 (DPDP Rules)
• Information Technology Act, 2000 (IT Act)
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)

If the Platform expands to other regions in future, this Policy will be updated to reflect the data protection laws applicable in those regions.

3. Data We Collect

We collect only the minimum personal data necessary to operate the Platform. The data collected depends on the user’s role.

3.1 Teachers / School Administrators

Teachers or school administrators register and create the school account. We collect the following:

• Name
• Email address
• Phone number
• Designation / role
• School name and school address (city, state, country)

3.2 Students

Students are added to the Platform by their teacher or school administrator. Students cannot register themselves. For each student we collect only:

• Name
• Email address
• Class / grade

3.3 Information We Do Not Collect

We do not collect any of the following from any user:

• Personal home addresses of students or teachers
• Financial information (bank, card, or payment details)
• Government identification numbers (Aadhaar, PAN, passport, etc.)
• Biometric data
• Health, physiological, or mental health information
• Religious, caste, or political information

As we do not collect any Sensitive Personal Data or Information (SPDI) as defined under the SPDI Rules 2011, the additional obligations specific to SPDI do not apply to the Platform.

4. How We Use Your Data

We use the personal data we collect only for the following purposes:

• To create and manage school and user accounts
• To enable participation in sustainability activities, challenges, and recognition programmes
• To communicate programme-related updates to registered users
• To display school-level participation and achievements on the Platform (e.g., the Impact Wall)
• To generate anonymised, aggregated analytics for improving the programme

We do not use any data for advertising, marketing to third parties, behavioural tracking, or profiling of any user.

5. Data Sharing and Disclosure

We do not sell, rent, trade, or share personal data with any third party for marketing, advertising, or commercial purposes. There is no exchange of any personal or private information of students or teachers with external parties on the Platform.

Personal data may only be disclosed in the following limited situations:

• To comply with applicable laws, regulations, or valid legal processes
• To protect the rights, property, or safety of the Platform, its users, or the public

6. Data Security

We implement reasonable security practices and procedures to protect personal data against unauthorised access, alteration, disclosure, or destruction, in line with Section 43A of the IT Act and the SPDI Rules 2011. These include:

• Encryption of data in transit (SSL/TLS)
• Access controls restricting data access to authorised personnel only
• Secure authentication mechanisms
• Periodic security reviews

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law. When a school account is deactivated or a deletion request is received, the associated personal data will be deleted within a reasonable period.

8. Your Rights

As a Data Principal under the DPDPA 2023, you have the right to:

• Access – request a summary of the personal data we hold about you and how it is processed;
• Correction – request correction or updating of inaccurate or incomplete data;
• Erasure – request deletion of your personal data, subject to legal obligations;
• Grievance redressal – raise a complaint with our Grievance Officer or the Data Protection Board of India;
• Nomination – nominate another person to exercise these rights on your behalf.

To exercise any of these rights, please contact our Grievance Officer (Section 10).

9. Grievance Officer

In accordance with the SPDI Rules 2011 and the DPDPA 2023, iSTEP Mentors has appointed a Grievance Officer to address any questions, concerns, or complaints regarding personal data:

The Grievance Officer will acknowledge and address any grievance within one (1) month from the date of receipt.

10. Cookies

The Platform may use essential cookies for authentication and session management only. We do not use cookies for advertising, behavioural tracking, or third-party analytics.

11. Third-Party Links

The Platform may contain links to third-party websites that we do not control. We are not responsible for the content or privacy practices of such websites and encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. Material changes will be communicated through the Platform or by email. Continued use of the Platform after such changes constitutes acceptance of the updated Policy.

13. Contact Us

For any questions about this Privacy Policy, please contact:

Email: connect@myschoolforearth.org

Website: www.myschoolforearth.org

Operated by: iSTEP Mentors