Higgs Educators

Privacy Policy

Effective Date: 6 June 2026 · Last Updated: 5 July 2026 · Version: 1.2

1. Introduction

1.1 This Privacy Policy ("Policy") describes how Higgs Educators Private Limited, a company incorporated in India and having its registered office at House No. 30, Krishnanagar, Orai, Uttar Pradesh, India — 285001 ("Higgs Educators", "we", "us", or "our") collects, uses, discloses, retains, transfers, and otherwise processes Personal Information about visitors to our website, parents, legal guardians, students, mentors, contractors, and other individuals who interact with our services (together, the "Services").

1.2 Higgs Educators provides online educational mentorship in Mathematics, Physics, Science, and Astronomy for students in Grades 1 through 12, delivered to families in multiple countries.

1.3 We are committed to handling Personal Information lawfully, fairly, transparently, and in accordance with applicable data protection laws, including the laws referenced in Section 22 of this Policy.

1.4 Because we work with children and young people, we treat parental consent, child safeguarding, and the principle of data minimisation as central obligations under this Policy.

1.5 By accessing or using the Services, you confirm that you have read this Policy. If you do not agree with this Policy, you should not use the Services or submit any Personal Information to us.

2. Definitions and Interpretation

2.1 In this Policy, capitalised terms shall have the following meanings, unless the context requires otherwise:

"Applicable Data Protection Law" means any law, regulation, or binding code relating to the processing of personal data that applies to Higgs Educators or to the relevant Data Subject, including those listed in Section 22.
"Child" or "Minor" means a natural person under the age of majority, or under the age of digital consent prescribed by the law of their jurisdiction.
"Data Controller" means the natural or legal person who determines the purposes and means of the processing of Personal Information.
"Data Processor" means a natural or legal person who processes Personal Information on behalf of the Data Controller.
"Data Subject" means any identified or identifiable natural person whose Personal Information is processed.
"Parent" means a parent or other person with parental responsibility for a Student under applicable law.
"Personal Information" (or, where the law uses the term, "Personal Data") means any information relating to an identified or identifiable natural person.
"Processing" means any operation performed on Personal Information, whether or not by automated means, including collection, storage, use, disclosure, transmission, and deletion.
"Services" has the meaning given in Section 1.1.
"Student" means a child or young person on whose behalf a Parent engages the Services, or in respect of whom the Services are otherwise provided.
"Sub-Processor" means a third party engaged by Higgs Educators to process Personal Information on its behalf.
"Terms of Service" means the Higgs Educators Terms of Service published at higgseducators.com/legal/terms-of-service, as amended from time to time.
"Website" means the Higgs Educators website at higgseducators.com and any sub-domains operated by Higgs Educators.

2.2 Capitalised terms used in this Policy but not otherwise defined herein shall have the meanings ascribed to them in the Higgs Educators Terms of Service.

2.3 Headings in this Policy are inserted for convenience only and shall not affect interpretation. References to a Section or Sub-Section are references to a section or sub-section of this Policy. The singular includes the plural and vice versa.

3. Identity of the Data Controller

3.1 For the purposes of the EU General Data Protection Regulation ("GDPR"), the United Kingdom GDPR ("UK GDPR"), and equivalent laws worldwide, the Data Controller of Personal Information processed in connection with the Services is:

Legal entity name: Higgs Educators Private Limited
Country of incorporation / primary place of business: India
Registered office address: House No. 30, Krishnanagar, Orai, Uttar Pradesh, India — 285001
Corporate Identification Number (CIN): U85499UP2026PTC248228
General contact email: contact@higgseducators.com
Privacy contact email: contact@higgseducators.com
WhatsApp: +91 6006385570
Data Protection Officer (DPO): Not currently appointed. Higgs Educators is not, at the date of this Policy, of a scale or nature that triggers a mandatory DPO appointment under GDPR Art. 37 or UK GDPR Art. 37. The position will be reviewed as the business grows.
EU Representative (GDPR Art. 27): Not currently appointed. Higgs Educators keeps this requirement under review and will appoint an EU Representative as the regularity and scale of its offering to EU/EEA residents so requires, at which point this Policy will be updated with the representative's details.
UK Representative (UK GDPR Art. 27): Not currently appointed. Higgs Educators keeps this requirement under review and will appoint a UK Representative as the regularity and scale of its offering to UK residents so requires, at which point this Policy will be updated with the representative's details.

4. Scope of This Policy

4.1 This Policy applies to:

all visitors to the Website;
Parents who enquire about, book, or engage the Services;
Students who participate in the Services, subject to verifiable parental consent where required by Applicable Data Protection Law;
mentors, instructors, contractors, and other personnel engaged by Higgs Educators in the performance of the Services;
any individual who communicates with us by email, telephone, WhatsApp, or any other channel.

4.2 This Policy does not apply to third-party websites, platforms, or services that we link to or rely upon to deliver the Services (such as, by way of example, Gmail, WhatsApp, and the video-conferencing platform used to deliver classes). Each such third party is responsible for its own privacy practices, which are governed by its own privacy policy.

5. Information We Collect

5.1 Information You Provide Directly

5.1.1 When you complete our contact form on the Website ("Tell us about your child"), we collect the following categories of Personal Information:

Name of the parent or student (mandatory);
Email address (mandatory);
Telephone number with country code, captured via the open-source intl-tel-input library (mandatory);
Child's grade or curriculum, in free-text form (optional);
Free-text message setting out your enquiry (optional).

5.1.2 When you contact us by email (including via the Email link on the Website, which opens a pre-filled Gmail compose window in your browser) or by WhatsApp, we receive whatever information you choose to send through that channel.

5.1.3 Where you and your child engage the Services, we may additionally collect:

the Student's age (collected as an optional field on the contact form, and from time to time as required for the safe delivery of the Services);
the Student's school, examination board, curriculum, and learning history, to the extent disclosed;
lesson notes, homework, written work, progress reports, and assessment outputs generated during the engagement;
scheduling preferences, time zone, and availability;
any safeguarding-relevant information voluntarily shared (such as learning needs or allergies).

5.2 Information Collected Automatically

5.2.1 When the Website is loaded in your browser, the following technical information is transmitted to us and, in limited circumstances, to third parties as part of the standard operation of the Website:

ipapi.co (lazy and consent-gated). The country-detection lookup against ipapi.co does not fire on page load. It is invoked only after both of the following conditions are satisfied: (a) the contact form scrolls into the visitor's viewport; and (b) the visitor has given prior consent under the "Functional" purpose in the cookie consent banner. Where either condition is not satisfied, no request is made to ipapi.co and no IP address is transmitted to it. The phone-number field defaults to India until consent and viewport conditions are met.
jsDelivr CDN. Your IP address and User-Agent string are transmitted to the jsDelivr content delivery network (cdn.jsdelivr.net) when the Website loads the intl-tel-input JavaScript library used to render the international phone-number field. This transfer is necessary for the operation of the contact form.
Anti-spam honeypot. A hidden field is included in the contact form. It does not collect Personal Information; it serves only to identify and discard automated submissions.
Self-hosted typeface. The Website typeface (Plus Jakarta Sans) is hosted directly by Higgs Educators and is not loaded from a third-party font service. No request is made to Google Fonts on page load.

5.2.2 At the date of this Policy, the Website does not set first-party cookies for analytics, advertising, profiling, or behavioural tracking. A cookie consent banner is in place to manage consent for any third-party services that are activated in the future (see Section 10).

5.3 Information Received from Third Parties

5.3.1 We may receive Personal Information about you from third parties, including from Wise Leap Technologies Ltd. and the integrated Zoom service (in the form of attendance, session metadata, and, where applicable, recording metadata), from payment processors (in the form of transaction confirmations), and, from time to time as Higgs Educators may operate a referral, ambassador, or affiliate programme (see Section 18.6), from referring individuals.

5.4 Special Categories / Sensitive Data

5.4.1 Higgs Educators does not intentionally collect special categories of personal data within the meaning of GDPR Article 9 (such as racial or ethnic origin, religious beliefs, or health data). Where a Parent voluntarily discloses such information (for example, when describing a learning need or medical consideration), we will process that information only for the safeguarding or service purpose for which it was provided, and only where we have a lawful basis under Applicable Data Protection Law.

6. How We Use Personal Information

6.1 We process Personal Information for the following purposes:

to respond to enquiries and arrange free demonstration classes;
to deliver the Services, including the provision of live tuition, scheduling, progress tracking, and parental communications;
to process payments and to issue refunds, invoices, and receipts;
to manage our relationship with you and your child, including the resolution of complaints;
to safeguard children participating in the Services and to respond to any safeguarding incident;
to improve and develop the Services, including by reviewing aggregate or anonymised information;
to send marketing communications to Parents who have opted in (see Section 18);
to comply with our legal, regulatory, accounting, and tax obligations;
to establish, exercise, or defend legal claims, and to prevent fraud or abuse.

7. Legal Bases for Processing

7.1 Where GDPR or UK GDPR applies, we rely on one or more of the following lawful bases for processing Personal Information:

Purpose of processing	Lawful basis	Article
Responding to a contact-form enquiry	Consent	Art. 6(1)(a)
Delivering paid classes to an enrolled Student	Performance of a contract	Art. 6(1)(b)
Sending opt-in marketing communications	Consent	Art. 6(1)(a); PECR (UK)
Sending operational and service communications to current clients	Performance of a contract	Art. 6(1)(b)
Maintaining accounting, tax, and statutory records	Legal obligation	Art. 6(1)(c)
Security, fraud prevention, and service improvement	Legitimate interests	Art. 6(1)(f)
Responding to an emergency affecting a Student	Vital interests	Art. 6(1)(d)

7.2 Where the processing concerns a Child, we additionally rely on verifiable parental consent under GDPR Article 8 and equivalent provisions of Applicable Data Protection Law.

7.3 You may withdraw any consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

8. Children's Privacy and Parental Consent

8.1 The Services are designed for Parents to engage Higgs Educators on behalf of their children. Higgs Educators complies with applicable child-protection and child-privacy laws, including without limitation:

the Children's Online Privacy Protection Act, 15 U.S.C. § 6501 et seq. ("COPPA"), in respect of children under 13 in the United States;
GDPR Article 8 and the equivalent UK GDPR provisions, in respect of children aged between 13 and 16 (depending on member-state law);
Section 9 of the Digital Personal Data Protection Act, 2023 (India);
the Australian Privacy Act 1988 and Australian Privacy Principles, the New Zealand Privacy Act 2020, the UAE PDPL, and other equivalent laws.

8.2 No knowing collection from Children. Higgs Educators does not direct the Services to Children for self-enrolment and does not knowingly collect Personal Information from a Child under the relevant age of digital consent without verifiable parental consent. If we become aware that we have collected such information without consent, we will delete it promptly.

8.3 Parental confirmation. The contact form on the Website requires the individual submitting the form to confirm, by means of a required check-box, that they are the Parent or legal guardian of the Student in respect of whom the enquiry is made (or that the Student is over the age of majority in their country). The form additionally requests the age of the Student so that Higgs Educators can identify whether COPPA, GDPR Article 8, the DPDP Act, or other child-protection provisions apply to the engagement.

8.4 Categories of information about a Child. Personal Information collected about a Child shall be limited to that which is necessary for the provision of the Services, including the Child's name, age or grade, curriculum, learning goals, and notes or written work generated during sessions.

8.5 Use of Children's Personal Information. Personal Information of Children shall be used solely for the purposes of delivering the Services and communicating with the Parent. Higgs Educators does not profile Children for advertising, does not sell or rent Children's Personal Information to any third party, and does not use it for any purpose unrelated to the educational service.

8.6 Live sessions involving Children. Live sessions are delivered by named mentors selected by Higgs Educators. The current mentor-vetting standard is described in Section 20. Parents may attend or observe any session involving their Child without prior notice. The recording of sessions involving Children, if any, is addressed in Section 19.

8.7 Parental right of review and deletion. A Parent may at any time review the Personal Information held about their Child, request its correction or deletion, refuse further collection, and withdraw consent, by contacting us at the addresses set out in Section 23. Deletion may be subject to retention obligations imposed by Applicable Data Protection Law or tax law.

9. Parent and Guardian Rights

9.1 In addition to the rights set out in Section 16, Parents and legal guardians have the following rights in respect of their Child's Personal Information:

the right to be informed of the categories of Personal Information collected, the purposes of processing, and the recipients;
the right of access to a copy of the Child's Personal Information;
the right to correct or update inaccurate or incomplete information;
the right to request deletion, subject to retention obligations under Applicable Data Protection Law;
the right to refuse further collection, by withdrawing consent;
the right to opt out of marketing communications addressed to the Parent;
the right to lodge a complaint with a competent supervisory authority.

9.2 We aim to respond to verified parental requests within 30 days, or such shorter period as is required by Applicable Data Protection Law.

10. Cookies and Tracking Technologies

10.1 First-Party Cookies

10.1.1 At the date of this Policy, the Website does not set first-party cookies for analytics, advertising, profiling, or behavioural tracking.

10.2 Third-Party Resources Loaded by the Website

10.2.1 The following third-party resources are loaded by the Website. None of them sets cookies under the higgseducators.com domain.

Third party	Purpose	Data transmitted	When
jsDelivr (`cdn.jsdelivr.net`)	Delivery of the intl-tel-input JavaScript library used for the international phone-number field	IP address, User-Agent	On page load (necessary for the contact form to render)
ipapi.co	IP-based country detection so the phone-number field defaults to the visitor's country	IP address	Only after (i) the contact form scrolls into view, AND (ii) the visitor has consented under the "Functional" purpose in the cookie consent banner. If either condition is not met, no request is made.

10.2.2 The Website typeface (Plus Jakarta Sans) is self-hosted by Higgs Educators. No request is made to Google Fonts.

10.3 Third-Party Cookies on Outbound Links

10.3.1 If you click an outbound link to a third-party service (for example, Gmail or WhatsApp), that service will place its own cookies under its own privacy policy. Higgs Educators has no control over those cookies.

10.4 Analytics and Advertising Technologies

10.4.1 Higgs Educators uses, or is in the course of activating, the following analytics, performance-measurement, advertising-attribution, and remarketing technologies on the Website:

Google Analytics 4 (GA4);
Google Tag Manager;
Google Ads conversion tracking and remarketing tags;
Meta Pixel and Meta Conversions API (in respect of advertising on Facebook and Instagram).

10.4.2 Several of the technologies listed above set non-essential cookies, transmit online identifiers to advertising partners, or both. Before any such technology is activated for visitors in any jurisdiction in which prior consent is required (including, without limitation, the European Economic Area, the United Kingdom, and Switzerland under the ePrivacy framework and the GDPR or UK GDPR), Higgs Educators shall implement an appropriate cookie consent management mechanism that:

provides clear information about each category of cookie and similar technology, and the identity of the parties placing them;
obtains prior opt-in consent for non-essential cookies before they are set;
permits the Data Subject to withdraw consent at any time with the same ease as it was given;
honours the Global Privacy Control (GPC) signal and equivalent opt-out signals as an opt-out of "sharing" within the meaning of the California Privacy Rights Act.

10.4.3 This Policy and any cookie notice shall be updated to reflect the actual technologies deployed at any given time. The categories of advertising and analytics processing for which Personal Information is shared with Google and Meta are described in Section 13.2.

10.5 How to Manage Cookies and Consent

10.5.1 The Website displays a consent banner (powered by the open-source Klaro consent management tool, self-hosted by Higgs Educators) that allows you to grant or refuse consent for each non-essential category of service. You may revisit your choices at any time by clicking the "Manage cookies" link in the footer of the Website.

10.5.2 The default state for every non-essential service is "off" (privacy-by-default). Where Applicable Data Protection Law requires prior consent, no such service will be loaded until consent has been given.

10.5.3 You may additionally control or delete cookies via your browser settings. Disabling cookies set by third-party services accessed through outbound links may affect the functionality of those services.

11. Payment Information

11.1 Payments for the Services are processed through the Wise Live platform (operated by Wise Leap Technologies Ltd., as identified in Section 12) and by direct transfer to Indian banking providers as nominated by Higgs Educators from time to time. Where an additional payment processor is engaged in the future, this Policy and the table at Section 12 shall be updated accordingly. Wise Leap Technologies Ltd. and any banking provider act as independent Data Controllers in respect of the payment-instrument data they collect.

11.2 Higgs Educators does not store full card numbers, card verification values, or banking credentials on its systems. We retain only transaction confirmation data (invoice number, amount, currency, date, and method), billing name and address (where required for tax invoicing), and payment status.

11.3 Higgs Educators accepts payment in such currencies, and from clients in such jurisdictions, as are supported by the Wise Live platform and by the Indian banking providers identified in Section 12 from time to time, subject in each case to applicable sanctions, regulatory, and operational restrictions.

11.4 Refunds. Higgs Educators offers a 100% money-back guarantee on a pro-rata basis. Where a Parent has paid for a package of classes and wishes to discontinue the engagement, Higgs Educators shall refund the price paid for the classes that have not been delivered as at the date of the refund request (for example, where 10 of 20 paid classes have been delivered, 10 classes' worth of fees will be refunded). The full procedural terms — including the parent-engagement step, the approval timeframe, and the bank-settlement window — are set out in the separate Refund and Cancellation Policy.

11.5 Transaction records shall be retained for the period required by Applicable Data Protection Law and applicable tax and accounting law, typically seven (7) years.

12. Third-Party Service Providers and Sub-Processors

12.1 In the course of providing the Services, we engage the following categories of third-party service providers and Sub-Processors:

Provider	Purpose	Personal Information shared	Corporate / processing location
Netlify, Inc.	Hosting of the Website	Server logs (IP address, request metadata)	United States (San Francisco, California); global edge CDN
Hostinger International Ltd.	Domain registrar for the Website	Domain administrative and WHOIS data	Lithuania (Kaunas) — EEA
Google LLC — Google Apps Script and Google Sheets (provisioned under the Higgs Educators Google Workspace account and covered by the Google Workspace Data Processing Addendum)	Receipt and storage of contact-form submissions and email notification to Higgs Educators	Name, email, telephone, grade or curriculum, student age, message, consent confirmations; IP address and User-Agent are transmitted to Google in transit as part of the request	United States; global data centres
Wise Live (operated by Wise Leap Technologies Ltd.), accessible at https://www.wise.live/in/	Integrated tutor-management platform for the Premium track (LMS, course management, scheduling, calendar, student management, parent and tutor logins, mobile application, communications, payouts, and a white-labelled Zoom integration through which Premium-track live classes are delivered and recorded)	Personal Information of Parents, Students, and tutors; login credentials issued by Wise Live; class schedule, attendance, and metadata; payout-related contact data; session audio, video, and chat; recordings of live sessions stored in Zoom cloud	Wise Leap Technologies Ltd. maintains offices in London (United Kingdom), San Francisco (United States), and Bangalore (India); the Ltd. corporate suffix indicates UK incorporation
Zoom Video Communications, Inc. — provisioned via the Wise platform	Delivery and cloud recording of live video classes through the Wise-managed Zoom integration	Name, audio, video, attendance, chat; cloud recordings of sessions	United States (San Jose, California); global data centres
Google LLC — Google Meet	Delivery of live video classes	Name, audio, video, chat	United States (Mountain View, California); global data centres
Google LLC — Gmail / Google Workspace	Email and collaboration platform; current sender platform for marketing communications	Email content, contact and engagement metadata	United States; global data centres
Meta Platforms, Inc. — WhatsApp	Inbound and outbound messaging via the WhatsApp link on the Website	Telephone number, message content	United States (Menlo Park, California); EEA/UK data handled by WhatsApp Ireland Limited (Dublin)
jsDelivr (operated by Prospect One sp. z o.o.)	Content delivery network for the intl-tel-input JavaScript library	IP address, User-Agent	Operated from Poland (EEA); served via global CDN edges (including Cloudflare, Fastly, and Bunny.net)
ipapi.co (operated by Kloudend, Inc.)	IP-based country lookup for the telephone-number field — invoked only after the contact form is in view and the visitor has consented under "Functional" in the cookie banner	IP address	United States
Klaro consent manager (self-hosted, open-source)	Records and enforces the visitor's cookie and service-consent choices	A single first-party cookie (`higgs_klaro`) storing the visitor's choices for up to 365 days	Hosted directly by Higgs Educators
Indian banking providers as nominated by Higgs Educators from time to time	Receipt of bank-transfer payments	Account-holder name, bank account details, transaction reference	India
Google LLC — Google Ads	Online advertising, conversion tracking, and remarketing	Online identifiers, advertising IDs, hashed contact data (where uploaded), conversion events	United States; global data centres
Meta Platforms, Inc. — Meta Ads (Facebook and Instagram)	Online advertising, conversion tracking, custom audience creation, and remarketing	Online identifiers, advertising IDs, hashed contact data (where uploaded), conversion events	United States; EEA/UK data handled by Meta Platforms Ireland Limited (Dublin)
Google LLC — Google Analytics 4 and Google Tag Manager	Website analytics, advertising attribution, and tag management	Online identifiers, browsing data, derived event data	United States; global data centres

12.2 We require each Sub-Processor to implement appropriate technical and organisational measures to protect Personal Information and to act in accordance with Applicable Data Protection Law and with our written instructions.

12.3 We will update this Section 12 from time to time to reflect changes in our Sub-Processors. The list at any given time represents the position of Higgs Educators at the date set out at the head of this Policy.

13. Disclosure and Sharing of Personal Information

13.1 We do not sell Personal Information. Higgs Educators does not sell, rent, lease, or otherwise transfer Personal Information to any third party in exchange for monetary or other valuable consideration.

13.2 Sharing of Personal Information for cross-context behavioural advertising. For the purpose of promoting the Services and generating enquiries and demo-class bookings, Higgs Educators shares (or, in respect of the advertising and analytics technologies presently being activated, plans to share) Personal Information and online identifiers — including without limitation hashed email addresses, telephone numbers, IP addresses, cookies, advertising identifiers, device identifiers, and conversion events — with advertising platforms operated by Google LLC ("Google Ads") and Meta Platforms, Inc. ("Meta Ads") for the following purposes:

advertising measurement and attribution;
creation of custom and lookalike audiences;
conversion tracking;
retargeting and remarketing;
related marketing analytics.

13.2.1 The activities described in Section 13.2 constitute "sharing" within the meaning of the California Privacy Rights Act and trigger the consent and opt-out requirements of the GDPR, the UK GDPR, PECR, and equivalent Applicable Data Protection Law. Higgs Educators shall implement an appropriate consent-management mechanism (including a cookie consent banner where required) before any such advertising or remarketing technology that sets non-essential cookies or transmits identifiers to advertising partners is activated for visitors in jurisdictions in which prior consent is required.

13.2.2 You may exercise your right to opt out of such sharing as set out in Section 16, in Section 22.4 (in respect of California residents), or through the cookie consent controls made available on the Website once implemented. Higgs Educators shall honour the Global Privacy Control signal where transmitted by a Data Subject's browser.

13.3 Disclosures we may make. Higgs Educators may disclose Personal Information in the following limited circumstances:

to Sub-Processors engaged on our behalf, as set out in Section 12;
to professional advisers (legal, accounting, audit, tax) who are bound by duties of confidentiality;
to public authorities, courts, or regulators where required by law, regulation, or legal process, or where reasonably necessary to protect our rights, the safety of a Student, or the rights of others;
to a successor entity in connection with a corporate transaction (such as a merger, acquisition, or sale of assets), subject to appropriate confidentiality undertakings;
with your specific consent.

13.4 No disclosure of Personal Information will be made except as expressly permitted or required by this Policy or Applicable Data Protection Law.

14. International Data Transfers

14.1 Higgs Educators is based and operated from India. The team currently engaged by Higgs Educators is located in India. In the course of providing the Services, Personal Information is transferred to and processed in jurisdictions other than that in which the Data Subject is resident, including (without limitation) the United States, the United Kingdom, Ireland, Lithuania, Poland, and India, in each case in accordance with the role of the Sub-Processor identified in the table at Section 12.

14.2 Where Personal Information is transferred from the European Economic Area, the United Kingdom, or Switzerland to a third country that is not the subject of an adequacy decision under Applicable Data Protection Law, Higgs Educators relies on appropriate safeguards including:

the Standard Contractual Clauses approved by the European Commission;
the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable;
supplementary technical measures, including encryption in transit and restricted access controls.

14.3 A copy of the safeguards relied upon for any particular transfer may be requested by contacting us at the addresses set out in Section 23.

15. Data Retention

15.1 Higgs Educators retains Personal Information for no longer than is necessary for the purposes for which it was collected, including for the purposes of satisfying applicable legal, accounting, regulatory, or safeguarding requirements.

Category of data	Retention period
Contact-form enquiries that do not result in engagement	24 months from the date of last contact
Active Student and Parent records	Duration of engagement, plus 3 years
Financial and transaction records	7 years (statutory minimum in most jurisdictions)
Marketing-consent records	Until consent is withdrawn, plus a reasonable suppression period
Recordings of live sessions (see Section 19.2 for full terms)	Up to 60 days following the relevant session or active enrolment period
Mentor and contractor records	Duration of engagement, plus 6 years
Server and hosting logs	Up to 90 days
Backups	Overwritten on a rolling cycle of up to 30 days

15.2 At the expiry of the applicable retention period, Personal Information shall be securely deleted or anonymised in a manner that prevents re-identification.

16. Rights of Data Subjects

16.1 Subject to Applicable Data Protection Law, Data Subjects have the following rights in respect of their Personal Information:

the right of access to a copy of the Personal Information we hold;
the right to rectification of inaccurate or incomplete Personal Information;
the right to erasure (the "right to be forgotten"), subject to applicable exceptions;
the right to restrict processing, in specific circumstances;
the right to data portability, where technically feasible;
the right to object to processing on the basis of legitimate interests and the right to object to direct marketing;
the right to withdraw any consent given, without affecting the lawfulness of past processing;
the right to lodge a complaint with a competent supervisory authority.

16.2 How to Exercise Your Rights

16.2.1 To exercise any of the rights set out in Section 16.1, please contact us using the details in Section 23 with the subject line "Privacy Request" and a description of the right you wish to exercise. We may require verification of your identity before responding.

16.2.2 We will respond within 30 days of receipt of a verified request, or such shorter period as is required by Applicable Data Protection Law. We do not normally charge a fee, but we reserve the right to charge a reasonable fee or to refuse a request that is manifestly unfounded or excessive, in each case as permitted by law.

17. Security Measures

17.1 Higgs Educators implements appropriate technical and organisational measures designed to protect Personal Information against unauthorised access, alteration, disclosure, loss, and destruction. Such measures include:

encryption of Personal Information in transit using TLS/HTTPS;
restricted access to Personal Information on a need-to-know basis;
multi-factor authentication on administrative accounts where the underlying service supports it;
selection of Sub-Processors that maintain documented information-security programmes;
periodic review of our processors and our own practices;
a documented incident-response process designed to identify, contain, investigate, and remediate any data security incident, and to notify affected Data Subjects and competent authorities as required by Applicable Data Protection Law (including within 72 hours of awareness under the GDPR).

17.2 In particular, Higgs Educators implements reasonable technical and organisational measures designed to protect Personal Information against unauthorised access, disclosure, alteration, loss, misuse, or destruction. Such measures may include access controls, two-factor authentication, secure password practices, contractual confidentiality obligations, device security measures, and restricted access to Personal Information on a need-to-know basis.

17.3 At the date of this Policy, the concrete measures in operation include the following:

two-factor authentication on relevant business accounts;
restriction of access to Student and Parent information to personnel who require such access for legitimate business purposes;
password protection and use of built-in device security features on devices used to access business information;
incorporation of confidentiality and data-protection obligations into tutor and contractor engagement agreements;
use, where appropriate, of cloud-based backup and storage services to protect business records and operational information.

17.4 No security measure can guarantee absolute security. In the event of a personal-data breach materially affecting your rights, we shall notify you in accordance with Applicable Data Protection Law.

18. Marketing Communications

18.1 At the date of this Policy, Higgs Educators does not send marketing or promotional emails. We communicate with you only in response to your enquiry or in connection with the Services you have engaged (for example, demo-class arrangements, schedules, progress updates, and billing). Should Higgs Educators introduce marketing communications in the future, they will be sent only to recipients who have given prior opt-in consent (or where an equivalent lawful basis exists under the recipient's local law), and every such message will contain a clear unsubscribe mechanism. This Policy will be updated before any such programme begins.

18.2 Marketing communications shall be sent only where (i) the recipient has given prior opt-in consent, or (ii) the soft opt-in provisions of the recipient's jurisdiction permit (for example, the Privacy and Electronic Communications Regulations 2003 in the United Kingdom in respect of marketing similar services to existing clients).

18.3 Every marketing communication shall contain a clear and accessible unsubscribe mechanism. You may withdraw consent at any time by emailing us at the address set out in Section 23.

18.4 Operational and service communications (including class confirmations, schedule changes, progress reports, billing, and safeguarding notices) are not marketing communications and shall continue to be sent while you are an active client.

18.5 Higgs Educators does not sell, rent, or share your contact details with any third party for that third party's own independent marketing purposes. The sharing of online identifiers and conversion data with Google Ads and Meta Ads for the purpose of advertising the Services is addressed separately in Section 13.2.

18.6 Referral, Ambassador, and Affiliate Programs

18.6.1 Higgs Educators may from time to time operate referral, ambassador, affiliate, or similar incentive programs through which existing Parents, Students, mentors, or other third parties may receive rewards or incentives for successful referrals of new clients.

18.6.2 Where any such program is in operation, the referring individual is responsible for ensuring that any Personal Information of a prospective client shared with Higgs Educators has been obtained lawfully and that the prospective client is aware that their details have been shared. Higgs Educators may, upon contacting a referred prospect, identify the referring individual where reasonably appropriate.

18.6.3 Higgs Educators shall use referral-source information only to administer the program, to contact the referred prospect, and to credit the referring individual with any applicable reward. The specific terms and any further data-handling commitments shall be set out in the program's own terms, available at the time of participation.

19. Live Online Classes and Recordings

19.1 Live classes are delivered through one of two arrangements, confirmed with the Parent at enrolment: (a) the Premium track, delivered through the Wise Live tutor-management platform and its integrated Zoom service (see Section 12); or (b) the Standard track, delivered through Google Meet (operated by Google LLC, headquartered in the United States). The video-conferencing platform used for any given session processes audio, video, name, attendance, and chat metadata in accordance with its own privacy policy, a copy of which shall be provided upon request.

19.2 Recording of Live Classes

19.2.1 Premium-track classes are recorded as a standard feature of the Services, using the cloud-recording functionality of Zoom as integrated with the Wise tutor-management platform. Standard-track classes delivered through Google Meet are not recorded by default; a recording of a Standard-track class may be arranged upon request where technically feasible, in which case this Section 19.2 applies to that recording.

19.2.2 The purposes of recording are limited to the following:

to allow the Student (and the Parent on the Student's behalf) to re-watch the session, in support of learning;
to allow the assigned mentor to review the session for the purposes of preparing follow-up material;
to permit Higgs Educators to investigate any complaint or safeguarding concern arising in relation to the session.

19.2.3 Recordings of Premium-track classes are stored within Zoom's cloud-recording infrastructure and are accessible to the Parent and Student through their login on the Wise platform; any recording of a Standard-track class is stored in Higgs Educators' Google Workspace storage with equivalent access restrictions. In each case, access is restricted to the relevant Parent, Student, and assigned mentor, together with such Higgs Educators personnel as require access for the purposes set out in Section 19.2.2.

19.2.4 By engaging the Services on behalf of a Student, the Parent is deemed to consent to the recording of live classes for the purposes set out in this Section 19.2. A Parent who does not wish a session involving their Child to be recorded should notify Higgs Educators in advance of the session at contact@higgseducators.com, and Higgs Educators shall use reasonable endeavours to accommodate the request. The categories of Personal Information processed in connection with recordings shall continue to be the subject of the rights described in Sections 8, 9, and 16.

19.2.5 Class recordings may be retained for up to sixty (60) days following the relevant class session or the Student's active enrolment period, after which they may be deleted, archived, anonymised, or made inaccessible at Higgs Educators' discretion. Higgs Educators does not guarantee permanent availability of class recordings and reserves the right to modify recording retention periods at any time. Students and Parents should not rely upon recordings being available beyond the stated retention period. The foregoing is without prejudice to the right of a Parent to request earlier deletion under Section 19.2.6, or to any longer retention period required to investigate a complaint or safeguarding matter or required by Applicable Data Protection Law.

19.2.6 A Parent may at any time request the deletion of any specific recording involving their Child by contacting Higgs Educators using the details in Section 23.

19.3 Use of Student Work in Marketing

19.3.1 Higgs Educators shall not use the image, voice, work, or likeness of any Child in any marketing materials without the prior specific written consent of the Parent.

20. Mentor and Staff Confidentiality

20.1 All mentors, contractors, and other personnel engaged by Higgs Educators are bound by confidentiality and data-protection obligations in their engagement agreements, are trained in safeguarding and child-data protection, and are required not to retain Student Personal Information after the end of the engagement.

20.2 At the date of this Policy, Higgs Educators does not engage a formal third-party background-check provider for mentors. Mentor selection is conducted through internal interview, qualification verification, and reference checks. Higgs Educators continues to evaluate the introduction of a formal background-check process consistent with the legal requirements of the jurisdictions in which Students reside.

21. Automated Decision-Making and Profiling

21.1 Higgs Educators does not subject Data Subjects to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

22. Region-Specific Notices

22.1 The following region-specific notices supplement this Policy for Data Subjects resident in the relevant jurisdictions. In the event of any conflict between this Section 22 and any other provision of this Policy, this Section 22 shall prevail in respect of Data Subjects resident in the relevant jurisdiction.

22.2 European Union and European Economic Area (GDPR)

22.2.1 At the Effective Date, Higgs Educators does not maintain an establishment in the European Union and is not therefore subject to the "one-stop-shop" mechanism of the GDPR. EU/EEA Data Subjects may lodge a complaint with the supervisory authority of their country of residence. Where required under Article 27 of the GDPR by reason of the regularity or scale of Higgs Educators' offering of Services to EU/EEA residents, an EU Representative shall be appointed and this Section 22.2 shall be updated accordingly. No EU Representative has been appointed at the date of this Policy.

22.3 United Kingdom (UK GDPR and Data Protection Act 2018)

22.3.1 The supervisory authority is the Information Commissioner's Office (ICO), https://ico.org.uk. Where required under Article 27 of the UK GDPR by reason of the regularity or scale of Higgs Educators' offering of Services to UK residents, a UK Representative shall be appointed and this Section 22.3 shall be updated accordingly. No UK Representative has been appointed at the date of this Policy.

22.4 California, United States (CCPA and CPRA)

22.4.1 California residents have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

the right to know what Personal Information is collected, used, disclosed, sold, or shared;
the right to delete Personal Information;
the right to correct inaccurate Personal Information;
the right to opt out of the "sale" of Personal Information — Higgs Educators does not "sell" Personal Information as that term is defined under the California Privacy Rights Act;
the right to opt out of the "sharing" of Personal Information for cross-context behavioural advertising — as described in Section 13.2, Higgs Educators does share Personal Information with Google and Meta for the purpose of cross-context behavioural advertising. California residents may exercise their right to opt out of such sharing by (a) submitting a request to contact@higgseducators.com with the subject line "California Privacy Request — Do Not Sell or Share My Personal Information"; (b) where available, using the opt-out controls in the Website's cookie consent banner once implemented; or (c) transmitting the Global Privacy Control signal, which Higgs Educators shall honour as an opt-out;
the right to non-discrimination for exercising these rights.

22.4.2 Verifiable consumer requests should be submitted to contact@higgseducators.com with the subject line "California Privacy Request".

22.5 United States — Children Under 13 (COPPA)

22.5.1 Higgs Educators complies with COPPA and does not knowingly collect Personal Information from a child under 13 in the United States without verifiable parental consent.

22.6 Australia (Privacy Act 1988 and Australian Privacy Principles)

22.6.1 Complaints about the handling of Personal Information may be lodged with the Office of the Australian Information Commissioner (OAIC), https://www.oaic.gov.au.

22.7 New Zealand (Privacy Act 2020)

22.7.1 Complaints may be lodged with the Office of the Privacy Commissioner, https://www.privacy.org.nz.

22.8 United Arab Emirates (PDPL — Federal Decree-Law No. 45 of 2021)

22.8.1 Higgs Educators processes Personal Information of UAE residents in accordance with the UAE Personal Data Protection Law.

22.9 India (Digital Personal Data Protection Act 2023)

22.9.1 Higgs Educators Private Limited is incorporated in India and adheres to the principles of notice, consent, purpose limitation, storage limitation, and data principal rights set out in the Digital Personal Data Protection Act 2023.

22.9.2 The Grievance Officer for the purposes of Section 8(10) of the said Act is:

Name: Muqeet Fazal, Director
Email: contact@higgseducators.com
Address: Higgs Educators Private Limited, House No. 30, Krishnanagar, Orai, Uttar Pradesh, India — 285001

22.9.3 A Data Principal who wishes to file a grievance under the Digital Personal Data Protection Act 2023 may write to the Grievance Officer at the email address above. Higgs Educators shall respond within the period prescribed under the Act and its rules.

22.10 Canada (PIPEDA)

22.10.1 Higgs Educators complies with the Personal Information Protection and Electronic Documents Act for Canadian residents.

22.10.2 For the purposes of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the person in charge of the protection of personal information at Higgs Educators is Muqeet Fazal, Director, who may be contacted at contact@higgseducators.com or at the postal address set out in Section 23.

22.11 Singapore (PDPA)

22.11.1 Higgs Educators complies with the Personal Data Protection Act 2012 for Singapore residents.

22.12 Other Jurisdictions

22.12.1 Higgs Educators complies with such other Applicable Data Protection Law as may apply in any jurisdiction in which it provides the Services.

23. Contact Information

23.1 Any question, request, or complaint relating to this Policy or to the handling of Personal Information by Higgs Educators may be addressed to:

General email: contact@higgseducators.com
Privacy email: contact@higgseducators.com
WhatsApp: +91 6006385570
Postal address: Higgs Educators Private Limited, House No. 30, Krishnanagar, Orai, Uttar Pradesh, India — 285001

23.2 We aim to respond to any such communication within 30 days of receipt, or such shorter period as is required by Applicable Data Protection Law.

24. Changes to This Privacy Policy

24.1 Higgs Educators may amend this Policy from time to time. Where the amendment is material, we shall (a) update the "Last Updated" date at the head of this Policy, (b) post the amended Policy at the Website, and (c) where we hold a Data Subject's email address, notify the Data Subject by email.

24.2 Continued use of the Services following the publication of an amended Policy shall constitute acceptance of the amended Policy.

25. Acknowledgement

25.1 By submitting any Personal Information through the Website, by engaging the Services, or by otherwise interacting with Higgs Educators, you acknowledge that you have read and understood this Policy.