This Privacy Policy explains how AF Academy collects, uses, shares and protects your personal data when you visit afacademy.org, create an account, enrol in a course or attend an event. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the EU and UK General Data Protection Regulation (GDPR).
1. Who we are
AF Academy is the training unit of Aqua Foundation, a society registered under the Societies Act. For the purposes of the DPDP Act, Aqua Foundation is the Data Fiduciary; under the GDPR it is the data controller.
- Registered address: 707, Eros Apartments, 56-Nehru Place, New Delhi ( INDIA) 110019
- Society registration number: 34087
- Privacy contact: privacy@afacademy.org
2. Personal data we collect
- Account data: name, email address, mobile number and password (stored only as a secure hash).
- Enrolment and billing data: billing name and address, GST number (if provided), the courses and participants you register, and order history. Payments are handled by Razorpay; we never see or store your full card, UPI or bank details.
- Participant data: when you enrol colleagues, the names and email addresses you give us for them. Please let them know you are sharing their details.
- Learning data: course progress, assessments, attendance at live sessions and certificates issued.
- Communications: messages you send through contact, instructor-application and resource-download forms, course reviews and testimonials, and newsletter sign-ups.
- Technical data: IP address, approximate country (used to show prices in INR or USD), browser and device type, and pages visited.
- Analytics data: only if you allow analytics cookies (see section 7).
We do not knowingly collect sensitive personal data such as health, religious or biometric information.
3. Why we use it and our legal basis
Purpose | Legal basis (GDPR) |
|---|---|
Create and manage your account; deliver courses, events and certificates; customer support | Performance of a contract |
Take payments, issue GST-compliant invoices and keep accounting records | Contract and legal obligation |
Course updates, schedule changes and service emails | Contract |
Newsletter (The Subsurface Brief) and marketing emails | Consent, which you can withdraw at any time |
Analytics cookies | Consent |
Security, fraud prevention and showing prices in your local currency | Legitimate interests |
Publishing a review or testimonial with your name | Consent |
Under the DPDP Act we process your data on the basis of your consent, given through a clear action such as creating an account, placing an order or ticking a box, or for legitimate uses permitted by the Act (for example, a purchase you asked us to complete or a legal obligation). We use your data only for the purpose it was collected for.
4. Who we share it with
We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and only as much as they need:
- Hummz - our course, commerce and learning-management platform.
- Razorpay - payment processing.
- Amazon Web Services - website hosting.
- Google Analytics and PostHog - website analytics, only with your consent.
- Instructors of a course you take - your name and course activity, so they can teach and assess you.
- Your employer or sponsoring organisation - enrolment and completion status, when they booked or paid for your seat.
- Authorities - where the law requires it.
5. International transfers
We are based in India and most data is stored in India. Some providers, such as Google and PostHog, may process data in the United States or other countries. Where we transfer data of people in the EU or UK outside those regions, we rely on safeguards such as the European Commission's Standard Contractual Clauses. Transfers from India follow any restrictions notified by the Government of India under the DPDP Act.
6. How long we keep it
- Account and learning records: while your account is active, and for up to 3 years after your last activity.
- Certificate records: for as long as the certificate may need to be verified, so employers can confirm it is genuine. You may ask us to remove a certificate record.
- Invoices and payment records: as long as Indian tax and accounting law requires (currently up to 8 years).
- Marketing preferences: until you unsubscribe or withdraw consent.
- Analytics data: up to 14 months.
When data is no longer needed, we delete or anonymise it.
7. Cookies
We use two kinds of cookies:
- Strictly necessary - keep you signed in, hold your cart, secure checkout and remember your cookie choice. These do not need consent.
- Analytics (Google Analytics, PostHog) - help us understand how the site is used. They are off until you choose “Accept all” or turn them on in Cookie settings.
You can change or withdraw your choice at any time from “Cookie settings” in the site footer. Withdrawing is as easy as giving consent.
8. Your rights
Depending on where you live, you have the right to:
- get a summary of the personal data we hold about you and how it is processed, and a copy of it;
- correct, complete or update inaccurate data;
- have your data erased when it is no longer needed or you withdraw consent, unless the law requires us to keep it;
- withdraw consent at any time, without affecting processing already done;
- restrict or object to processing based on legitimate interests, and object to direct marketing (GDPR);
- receive your data in a portable format (GDPR);
- nominate another person to exercise your rights if you die or become incapacitated (DPDP Act);
- have your grievance addressed, and complain to a regulator.
You can update most account details yourself from your account profile. For anything else, email privacy@afacademy.org. We may need to confirm your identity first. We reply within 30 days.
9. Grievance Officer and complaints
If you have a concern about how we handle your data, contact our Grievance Officer:
- Name: Praggya Sharmaa
- Email: privacy@afacademy.org
- Address: 707, Eros Apartments, 56-Nehru Place, New Delhi ( INDIA) 110019
We acknowledge grievances within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. If you are in the EU or UK, you may also complain to your local data protection authority.
10. Children
Our courses are meant for adults and working professionals. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or legal guardian. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
We protect your data with encryption in transit (HTTPS), access controls, sign-in tokens held in secure cookies that page scripts cannot read, and contracts with our service providers. If a personal data breach occurs that affects you, we will inform you and the relevant authorities as the law requires.
12. Changes to this policy
We may update this policy. The “Last updated” date at the top shows when it last changed. If we make a material change, we will tell you by email or on the site, and ask for fresh consent where needed.