Zerqo Privacy Policy

1About this Policy and scope

Escalara Private Limited, a company incorporated under the Companies Act, 2013 having Corporate Identity Number U62012MH2026PTC471885 and its registered office at Flat No. 2001, Tower No. C, Runwal Bliss, Mumbai 400 042 ("Escalara", "we", "us" or "our"), owns and operates Zerqo. Zerqo provides recorded curriculum-based educational videos, topic-wise and chapter-wise learning, assessments, tests and related Academic Analytics through its mobile application, website and mobile-web features (the "Platform").

This Policy applies to students, including Children, adult students, Parents and lawful guardians who choose to use the optional Parent Account, visitors and other individuals who interact with the Platform. It does not cover employee or recruitment information. A separate notice may be shown for a feature that is not fully described here.

2Key definitions

3Escalara's role and sources of information

Escalara decides why and how the information covered by this Policy is processed. In the terminology of the Digital Personal Data Protection Act, 2023, Escalara is the Data Fiduciary for this processing. Escalara performs processing itself and engages Service Providers to perform limited processing for it. Under Zerqo's current model, no school or educational institution provides access to Zerqo or determines the purpose and means of this processing.

We may obtain information from:

• a student, adult student or Parent when an account is created, a subscription is purchased, support is contacted or information is entered on the Platform;
• use of Zerqo, including lessons accessed, assessment answers, attempts, scores and progress;
• Razorpay, from which Escalara receives limited payment and transaction confirmations needed to activate and administer the requested service; and
• technical systems automatically, such as server logs, IP address, device and browser type, operating system, app version, timestamps, crash information and diagnostic data.

We do not obtain Personal Information from data brokers and do not combine a Child's Zerqo information with third-party advertising profiles.

4Notices and consent under current law

At or before collection, we provide information that is reasonably sufficient to explain what is being collected, why it is needed, the intended recipients, and the identity and address of the entity collecting and retaining it. This Policy is intended to be read with any concise notice shown at the relevant screen or feature.

Where the SPDI Rules require consent for Sensitive Personal Data or Information, we obtain it in writing or by an appropriate electronic method before collection. We also request a clear affirmative choice for optional marketing, optional device permissions and other processing for which consent is required. Accessing Zerqo, silence, a pre-ticked box or continued use is not treated as consent to a new and unrelated purpose.

A person may decline optional information or withdraw consent as described in Section 13. If information is necessary for a requested feature, declining or withdrawing it may mean that the feature cannot be provided, but unrelated features will not be withdrawn solely because optional processing was refused.

5Children and the optional Parent Account

Zerqo is an educational service used by students, including Children. The Parent Account is optional. A Child's Student Account is not presently conditional on the Parent maintaining a separate Parent Account. A Parent who chooses the feature may use a web or mobile-web dashboard to view the linked student's progress, scores, performance and Academic Analytics. There is no separate Parent Android application or Parent iOS application.

Before linking a Parent Account to a Student Account or disclosing student information through the Parent dashboard, Escalara may request reasonable information or account confirmation to protect the student and verify that the linkage is authorised. Escalara does not currently require Aadhaar or a copy of a government identity document as a standard condition for creating a Student Account or optional Parent Account.

Escalara does not use a Child's Personal Information or Academic Analytics for targeted advertising, does not track a Child across unrelated third-party services for advertising, and does not sell or rent a Child's Personal Information. Before 13 May 2027, Escalara will implement and document the verifiable parental-consent and adult-verification process then required for processing covered by the relevant provisions of the DPDP Act and Rules, and will update this Policy accordingly.

6Information we collect

7How and why we use information

8Academic Analytics and advertising controls

Academic Analytics is limited to activity within Zerqo that is needed to provide and improve the educational service. It is not used to follow a Child across unrelated services, infer unrelated commercial interests, sell or broker data, or select advertising.

Escalara currently:

• uses in-house analytics for educational, reliability and operational purposes;
• does not use third-party advertising or marketing SDKs in Zerqo;
• does not sell or rent Personal Information;
• does not serve personalised or interest-based advertising to Children; and
• does not use a Child's AAID, IDFA or other advertising identifier for tracking or advertising.

9Cookies, SDKs and device permissions

The website may use strictly necessary cookies or local storage for login, security, session continuity and preferences. Zerqo may use first-party technical logs and in-house analytics for reliability and educational usage. Zerqo does not use advertising cookies, third-party behavioural analytics or session-replay tools on Child-facing parts of the Platform.

We request a device permission only when relevant to a described feature. Where a collection or permission may not reasonably be expected, a prominent in-app disclosure will explain the data and purpose before the request. Refusing an optional permission will not block unrelated core functions. Push notifications may be disabled in device settings and, where available, Platform preferences.

10Sharing and service providers

We disclose information only to provide the service, complete a requested transaction, secure the Platform, comply with law, obtain professional advice, complete a genuine business transfer, or for another purpose for which a valid permission has been obtained. Service Providers are contractually restricted as appropriate to their role and are expected to use suitable confidentiality and security safeguards.

We may also disclose information:

• to courts, regulators, law-enforcement or governmental authorities where required or authorised by applicable law or binding process;
• to professional advisers bound by duties of confidentiality, where needed for legal, audit, accounting, security or insurance advice; and
• in a genuine merger, acquisition, reorganisation or transfer of business, subject to applicable law and continued protection of the information.

We do not authorise a Service Provider to use a Child's information for its own advertising, data brokerage, profiling or unrelated product development. We will update this Policy when a material change to the categories of recipients or information disclosed affects users.

11Processing and transfers outside India

Information may be processed in India and in the verified hosting or support locations used by the Service Providers identified in Section 10.

Where the SPDI Rules apply to a transfer of Sensitive Personal Data or Information, Escalara will transfer it only to a recipient that ensures the same level of data protection required under those Rules, and only where the transfer is necessary for performance of a lawful contract or the individual has consented to the transfer. Escalara will update this section before the cross-border provisions of the DPDP framework become applicable.

12Retention and deletion

We keep information only for as long as it is reasonably required for the purpose for which it was collected, to provide the requested service, to secure the Platform, to resolve a dispute, or to comply with tax, accounting, company, cybersecurity or other applicable law. Retention depends on the category and context.

When retention is no longer justified, we delete or irreversibly de-identify the information and instruct relevant Service Providers to do the same, subject to their documented backup cycles. Aggregated or irreversibly de-identified information may be retained because it no longer identifies an individual.

13Your current rights and choices

Subject to applicable law and proportionate account verification, an individual may:

• ask to review Personal Information or Sensitive Personal Data or Information that the individual provided;
• ask us to correct or amend information that is inaccurate or deficient, where feasible;
• withdraw a consent in writing or through an available account control;
• request deletion of an account and associated information, subject to lawful retention;
• opt out of optional marketing without losing the core educational service; and
• raise a privacy grievance with the Grievance Officer in Section 19.

Withdrawal operates prospectively. If the withdrawn information is necessary for a requested feature, Escalara may be unable to continue that feature after explaining the practical effect. A Parent may make a request for a Child where the Parent's authority and the relevant account linkage can be reasonably verified. The additional rights created by the operational provisions of the DPDP Act will be addressed in the version issued before those provisions become applicable.

14Account deletion

15Security

Escalara uses reasonable administrative, technical, operational and physical safeguards designed for the nature of its information and business. Depending on the risk and system, these may include encryption in transit, protective transformation or masking, role-based access controls, least-privilege permissions, authentication controls, access logging and review, backups, vulnerability and incident management, personnel confidentiality and contractual safeguards for Service Providers.

No system can be guaranteed completely secure. Users should protect account credentials and promptly notify us of suspected unauthorised access. This does not transfer Escalara's responsibility to maintain reasonable security.

16Security incidents

If Escalara becomes aware of an information-security incident affecting information covered by this Policy, it will investigate, contain, remediate and document the incident and will make notifications to affected individuals, CERT-In or another competent authority where and within the time required by applicable law. The separate breach notification process required under the operational DPDP provisions will be implemented before those provisions become applicable.

17External links

The Platform may link to a third-party site or service. The third party's privacy notice governs its independent processing. A link does not authorise the third party to use Zerqo information for unrelated purposes. Where required for a Child-facing experience, external links and similar actions will be placed behind an appropriate Parent-controlled mechanism.

18Changes to this Policy

We may update this Policy to reflect changes in law, the Platform, our Service Providers or our processing. We will update the Effective Date and keep the current version at the same public URL. If a change materially affects how information is collected, used or disclosed, we will provide notice through the Platform or an effective communication channel and obtain fresh consent where applicable. Continued use alone is not treated as consent to a new and unrelated purpose.

19Contact and grievance redressal

The following Grievance Officer is authorised to answer questions, receive requests and address grievances about Escalara's handling of information. We will address a grievance expeditiously and, where the SPDI Rules apply, within one month from receipt.