Last updated: [TO CONFIRM: effective date]
This policy explains how the Centre for Occupational Skills ("COS", "we") processes personal data on self-skill.com, in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it. COS is the Data Fiduciary for the data described here.
Centre for Occupational Skills
GSTIN: 27AAQFC5205P1ZY · Email: cos@self-skill.com
1. Data we collect
- Account: name, email address, password (stored only as a one-way hash), and your Google account identifier if you choose "Continue with Google".
- Billing: Indian state (to decide the GST place of supply), country for international buyers, order amounts, coupon used and invoice details. Card, UPI and bank details are entered on Razorpay's checkout and are not received or stored by us.
- Security and anti-sharing: device type and browser (user agent), IP address, approximate country, login times, session records and one-time login codes. These enforce the limit of one phone and one computer/tablet per account and help detect account sharing.
- Learning: lesson progress, quiz scores and certificates issued.
- Contact form: your name, email and message.
2. Why we use it (purpose and basis)
We process personal data on the basis of your consent, given when you create an account, buy a course or send a message, and for legitimate uses permitted by Section 7 of the DPDP Act, such as complying with tax law. We use it to:
- create and secure your account, send login codes and enforce the device and session limits;
- process payments and issue GST or export invoices, credit notes and refund receipts;
- provide course access, track progress and issue verifiable certificates;
- send service emails (receipts, access reminders, expiry notices);
- answer your questions; and
- meet legal obligations, including GST record-keeping.
We do not sell personal data and we do not use it for third-party advertising. [TO CONFIRM: confirm no marketing emails are sent; if newsletters are planned, add a separate opt-in]
3. Watermark and certificate verification
Course pages show your name and email as a watermark to discourage sharing. The public certificate check page at /verify shows only the learner's name, course title, completion date and whether the certificate is valid.
4. Who we share data with
- Razorpay (payment processing).
- Google Workspace (our email provider) and, if you use it, Google sign-in.
- Hostinger (web hosting and database).
- Zoho Books (accounting records of invoices) [TO CONFIRM: only once Zoho sync is switched on].
- Government authorities where the law requires it.
These Data Processors act on our instructions. Some of them may process data outside India, as the DPDP Act permits unless the Government restricts a country.
5. How long we keep it
- Invoices and the billing data on them: as long as GST law requires (at least 72 months after the annual return due date).
- Account and learning records: while your account is active and for [TO CONFIRM: e.g. 3 years] afterwards, unless you ask us to erase them sooner.
- Login codes expire in 10 minutes and are deleted regularly. Security logs: [TO CONFIRM: e.g. 12 months].
- Contact messages: [TO CONFIRM: e.g. 2 years].
6. Your rights
Under the DPDP Act you may: get a summary of your personal data and how we process it; correct, complete or update it; ask us to erase it (we keep only what the law requires us to keep, such as invoices); withdraw consent at any time (this does not affect processing already done, and we may then be unable to provide the course); nominate another person to exercise your rights in the event of death or incapacity; and get your grievance addressed. Write to cos@self-skill.com.
7. Grievance officer
Name: [TO CONFIRM: name of the grievance officer]
Email: cos@self-skill.com
Phone: +91 90042 56435
We will respond within [TO CONFIRM: e.g. 7 days; the DPDP Rules may set a maximum]. If you are not satisfied, you may complain to the Data Protection Board of India.
8. Children
Our courses are for working professionals. We do not knowingly process the data of anyone under 18 without verifiable consent from a parent or lawful guardian, as the DPDP Act requires. If you are under 18, do not create an account.
9. Security
We use HTTPS, hashed passwords, emailed one-time login codes, CSRF protection, rate limits and per-device session controls. We will notify affected users and the Data Protection Board of a personal data breach as the DPDP Act requires.
10. Cookies
We use only essential cookies: a session cookie, a device cookie (for the device limit) and a short-lived security cookie. We do not use advertising or analytics cookies. [TO CONFIRM: update this if analytics are added]
11. Changes
We will post any change here and update the date above. For significant changes we will notify you by email.