Data Protection Policy

Our Privacy Policy tells parents what we collect and why. This policy is the other half: how Joydo actually handles that information day to day, and what we hold ourselves to.

It applies to everyone who works at Joydo, whether employed, freelance or volunteering.

Joydo is a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023. Parents and children are Data Principals.

The Act places specific duties on anyone handling children’s data. We treat those as a floor, not a target.

Under the DPDP Act, a child is anyone under 18, and their personal data may only be processed with the verifiable consent of a parent or lawful guardian.

In practice that means:

• Enrolment consent is given by the parent or guardian, not the child.
• Consent is recorded with the date and time it was given.
• Consent is specific. Agreeing to your child attending sessions is not agreement to their photograph being used.
• Consent can be withdrawn at any time, and withdrawing it is made no harder than giving it.

These are absolute, not subject to a business case:

• We will never track or behaviourally monitor a child.
• We will never direct advertising at a child.
• We will never sell personal data, of a child or a parent, to anyone.
• We will never publish a child’s photograph, full name or class details without specific written parental consent.
• We will never share a child’s information with another parent.

Photographs of children are treated as a separate matter requiring their own consent, given in writing and recorded against the child’s record. A parent may refuse, or allow photographs internally but not publicly, and that choice is respected without discussion.

Withdrawing photo consent stops future use immediately, and we remove existing images from material we control.

To be confirmed by Joydo. Joydo to confirm the actual practice: are photographs taken during sessions, are they shared with parents, and are any used publicly (website, Instagram, Google Business Profile)? This section should then be narrowed to describe exactly what happens.

The website is served only over an encrypted connection. Enquiries are stored in the website database on a server located in India, reachable only over an authenticated connection, and each administrator has their own account rather than a shared login.

The enquiry form is rate-limited to resist automated abuse.

To be confirmed by Joydo. Joydo to confirm how records kept at the centre itself are secured — whether paper records exist, where they are stored, and who holds the key. Also whether CCTV operates on the premises, because recorded footage of children is personal data and needs its own entry here.

Access follows need. Someone who does not need a piece of information to do their job does not get it.

• Contact details are available to the people who arrange visits and communicate with parents.
• Any medical or dietary information a parent gives us is available only to staff supervising that child.
• Administrator access to the website is limited to those who maintain it.

Anyone leaving Joydo has their access removed on their last day.

Where a supplier handles personal data on our behalf, they act on our instructions and may not use it for their own purposes.

Our website is hosted on infrastructure located in India. Typefaces are currently served by Google Fonts, which receives visitors’ IP addresses; we intend to remove that dependency by serving the fonts ourselves.

To be confirmed by Joydo. Joydo to confirm the email provider once outbound mail is configured, and to list any other tool that holds parent or child data.

We do not keep personal data indefinitely. Enquiries that do not lead to anything are deleted. Records for children who attend are kept while they attend and for a defined period afterwards, then deleted.

To be confirmed by Joydo. Joydo to set specific retention periods. These need to match the periods stated in the Privacy Policy.

If personal data is lost, exposed or accessed by someone who should not have it, we will:

1. contain it and establish what was affected;
2. notify the Data Protection Board of India as the DPDP Act requires;
3. tell the affected parents directly, plainly, and without waiting to have a complete picture;
4. fix the cause and record what changed.

We would rather tell you about a breach early and look disorganised than tell you late and look dishonest.

If you think we have mishandled your information, or your child’s, tell us. Email joydo.officials@gmail.com or speak to someone at the centre.

We will acknowledge it, look into it properly, and tell you what we found — including if we got it wrong.

If you are not satisfied, you may complain to the Data Protection Board of India.

To be confirmed by Joydo. Joydo to name the person responsible for answering data protection questions, with a direct contact. The DPDP Act requires that a Data Fiduciary publish the contact details of whoever can answer questions about data processing, so a named role here is not optional.

We review this policy at least once a year, and whenever we change how we handle information. The date at the top shows when it last changed.