This notice explains what personal data GenAIstartups collects when you enquire about our programme, why we collect it, and what you can do about it. It is written to meet our obligations under India's Digital Personal Data Protection Act, 2023.
1. Who we are
GenAIstartups is operated by [LEGAL ENTITY] (CIN [CIN]), registered at [REGISTERED ADDR]. Under the DPDP Act we are the Data Fiduciary for the personal data described here — meaning we decide why and how it is processed, and we are accountable for it.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Full name | Enquiry form | To address you correctly and match your enquiry to your application |
| WhatsApp number | Enquiry form | To call and message you about admissions |
| Email address | Enquiry form | To send programme information and application updates |
| Current stage of education | Enquiry form | To route you to the right counsellor and check eligibility |
| Consent record | Generated on submission | Proof of what you agreed to, when, and from which page |
| Messages you send us | WhatsApp, email, phone | To answer your questions and keep a record of what was discussed |
We do not collect financial information, identity documents, or academic records at the enquiry stage. If you go on to apply, we will tell you separately what the application requires.
3. Our lawful basis
We process your data on the basis of your consent, which you give by ticking the box on the enquiry form. That box is never pre-ticked. We store the exact wording you agreed to alongside the time and the page it was given on.
Marketing messages on WhatsApp are sent only to people who ticked that box. Consent to be contacted about admissions is not bundled with anything else, and declining it does not affect your ability to apply by other means.
4. If you are under 18
This section matters — most of our applicants are school students.
The DPDP Act requires verifiable consent from a parent or legal guardian before we process the data of anyone under 18. If you tell us you are under 18, or if your stated stage of education indicates you may be, we will not contact you for marketing purposes until a parent or guardian has confirmed their consent through [PARENTAL CONSENT METHOD].
We do not run behavioural advertising or tracking directed at children, and we do not profile applicants under 18.
5. Who we share it with
We do not sell your personal data, and we do not share it with other institutions, agents, or advertisers. We use the following processors, who act only on our instructions:
- Wati (Clare.AI / WATI.io) — WhatsApp Business messaging platform
- Meta Platforms — WhatsApp message delivery, and advertising where you contact us via a click-to-WhatsApp advertisement
- [HOSTING PROVIDER] — website hosting and form submission storage
Some of these process data outside India. Where that happens we rely on the transfer mechanisms permitted under the DPDP Act and the provider's own contractual commitments.
6. How long we keep it
We keep enquiry data for [RETENTION] from your last contact with us, after which it is deleted. If you withdraw consent or ask for erasure, we delete it sooner — see section 7. We keep a minimal suppression record (your number, and the fact you opted out) for as long as necessary to make sure we do not contact you again by mistake.
7. Your rights
Under the DPDP Act you can ask us to:
- Access — tell you what data we hold about you and who we have shared it with
- Correct — fix anything inaccurate, incomplete, or out of date
- Erase — delete your data where we no longer need it for the purpose you gave it for
- Withdraw consent — at any time, and as easily as you gave it
- Nominate — name someone to exercise these rights on your behalf if you die or become incapacitated
- Complain — raise a grievance with us, and escalate to the Data Protection Board of India if we do not resolve it
The quickest ways to act on this
- Stop WhatsApp messages: reply STOP to any message from us. This takes effect immediately and needs no explanation.
- Everything else: email [DPO EMAIL]. We respond within 30 days.
8. Grievance officer
[GRIEVANCE NAME]
Grievance Officer, [LEGAL ENTITY]
[DPO EMAIL]
[REGISTERED ADDR]
If you are not satisfied with our response, you may complain directly to the Data Protection Board of India.
9. Security
We apply reasonable security safeguards to prevent personal data breaches, including access controls on the systems holding enquiry data and encryption in transit. If a breach occurs that affects you, we will notify you and the Data Protection Board as the Act requires.
10. Changes to this notice
If we change how we use your data we will update this page and change the date at the top. Where a change materially affects what you consented to, we will ask for your consent again rather than rely on the old one.