Privacy Policy
1. Introduction and Scope
This Privacy Policy ("Policy") is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 read with the Digital Personal Data Protection Rules, 2025, as amended, supplemented, or re-enacted from time to time (collectively, "Applicable Data Protection Laws"). It sets out the manner in which OREAL LLP, a limited liability partnership constituted and registered under the Limited Liability Partnership Act, 2008 (LLPIN: ACZ 4869), having its registered office at 5th Floor, Plot No. A-35, Sector-136, Noida, Uttar Pradesh - 201304 ("Company", "we", "us", or "our"), collects, uses, processes, discloses, stores, transfers, and protects Personal Information/Personal Data of visitors to and users of the website located at www.orealworld.com, its sub domains, and any allied mobile applications, learning platforms, or offline enrolment touchpoints operated by the Company (collectively, the "Platform"), in connection with its education, training, and allied services in the fields of Animation, Visual Effects, Gaming, Comics, and Extended Reality ("AVGC-XR") and related creative technology disciplines ("Services").
This Policy applies to every individual who accesses the Platform, enquires about, registers for, enrols in, or otherwise avails the Services, whether as a prospective student, enrolled student, parent or guardian of a minor student, alumnus, faculty, vendor, or general visitor (each, a "User", "you", or "your"). The Company's Platform and Services are open to individuals of all age groups, including minors, and there is no restriction limiting enquiry, access, or enrolment to persons who have attained the age of majority. Where a User is a minor, this Policy is read together with, and additional consent requirements apply as set out in Clause 10 below. By accessing the Platform or availing the Services, you signify that you have read, understood, and consented to the collection, use, and processing of your Personal Data/Personal Information as described herein. If you do not agree with the terms of this Policy, you are requested not to access or use the Platform or avail the Services.
This Policy is a legally binding electronic record in terms of the Information Technology Act, 2000 and the rules made thereunder, and does not require any physical or digital signature to be enforceable.
2. Definitions
"Personal Data" or "Personal Information" means data or information about an individual who is identifiable by or in relation to such data or information, including but not restricted to name, contact details, date of birth, government-issued identification, academic records, financial information, and any online identifiers.
"Sensitive Personal Data or Information" ("SPDI") shall have the meaning ascribed to it under the SPDI Rules, and includes, without limitation, financial information such as bank account or payment instrument details, biometric information, and any detail relating to the above categories as provided to the Company for processing.
"Data Fiduciary" means the Company, being the entity which determines the purpose and means of processing Personal Data.
"Data Principal" means the individual to whom the Personal Data relates, i.e., the User.
"Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction.
"Consent Manager", "Data Protection Board", "Data Processor" shall carry the meanings assigned to them under the Digital Personal Data Protection Act, 2023.
3. Information We Collect
In the course of providing the Services, the Company may collect the following categories of information:
3.1 Information Provided Directly by You
- Identity and contact information, including full name, gender, date of birth, postal address, e-mail address, and mobile/telephone number;
- Academic and professional information, including prior educational qualifications, mark sheets, certificates, portfolio work, and career objectives, submitted for admission, counselling, or placement assistance purposes;
- Government-issued identification such as Aadhaar (last four digits only, where permitted), PAN, passport, or other identity/address proof furnished for verification, invoicing, or statutory compliance;
- Financial and payment information, including bank account details, UPI identifiers, or payment instrument details, collected solely to the extent necessary to process course fee payments, refunds, or scholarships;
- Photographs, specimen work, video testimonials, or biometric attendance data (where the Company's centre uses biometric attendance systems), collected with your specific consent;
- Any other information voluntarily submitted through enquiry forms, counselling sessions, feedback forms, surveys, or correspondence with the Company.
3.2 Information Collected Automatically
- Technical data such as IP address, browser type and version, device identifiers, operating system, and referral source;
- Usage data such as pages visited, time spent on the Platform, click-stream data, and course modules accessed on any learning management system;
- Location data at a city/region level, derived from IP address, where relevant to counselling centre allocation.
3.3 Information from Third Parties
5. PURPOSE OF COLLECTION AND USE OF PERSONAL DATA
The Company collects and processes Personal Data for the following specified, explicit, and legitimate purposes:
- To process enquiries, provide course counselling, and facilitate admission and enrolment into AVGC-XR programmes;
- To verify identity, eligibility, and academic credentials of applicants;
- To process payment of course fees, issue receipts/invoices, and administer refunds, instalments, or scholarships;
- To deliver academic content, conduct assessments, issue certificates, mark-sheets, and maintain academic records;
- To provide placement assistance, including sharing your resume/portfolio with prospective employers or industry partners, strictly with your prior consent;
- To communicate administrative, academic, and promotional information, including through e-mail, SMS, WhatsApp, and telephone, subject to your consent and applicable opt-out mechanisms;
- To maintain security of Platform infrastructure, prevent fraud, and comply with applicable law, regulatory requests, or court orders;
- To conduct internal research, analytics, and quality-improvement of course content and teaching methodology, generally in aggregated or anonymised form;
- Any other purpose for which specific consent is separately obtained from you at the point of collection.
6. CONSENT AND LEGAL BASIS FOR PROCESSING
The Company processes Personal Data on the basis of free, specific, informed, unconditional, and unambiguous consent provided by the Data Principal, or, where applicable, on the basis of "legitimate uses" recognised under the Digital Personal Data Protection Act, 2023, including for the performance of a contract to which you are a party (such as enrolment agreements), compliance with a legal obligation, and voluntary provision of data by you for a specified purpose. Where processing relates to SPDI as defined under the SPDI Rules (such as financial information), the Company obtains your consent, in writing or through electronic means, prior to collection. You may withdraw consent at any time in the manner described in Clause 11 below, without affecting the lawfulness of processing carried out prior to such withdrawal, provided that withdrawal of consent necessary for the performance of your enrolment agreement may result in the Company being unable to continue providing the Services.
7. DISCLOSURE AND SHARING OF INFORMATION
The Company does not sell, rent, or trade Personal Data. Personal Data may, however, be shared in the following limited circumstances:
- With group entities, franchise/authorised training centres, and faculty strictly on a need-to-know basis for delivery of the Services;
- With third-party service providers engaged for payment processing, cloud hosting, learning management systems, SMS/e-mail communication, and analytics, who are contractually bound to maintain confidentiality and use Personal Data solely for the purpose for which it was disclosed;
- With prospective employers, industry recruiters, or internship partners, solely for placement assistance and solely with your specific consent;
- With government authorities, regulators, law enforcement agencies, or courts, where required under Applicable Data Protection Laws or any other law for the time being in force, or in response to a valid legal process;
- In connection with a merger, acquisition, restructuring, or sale of business/assets of the Company, provided the transferee agrees to be bound by terms no less protective than this Policy;
- With your explicit consent, for any other purpose not listed above.
8. DATA SECURITY
The Company implements reasonable security practices and procedures, including administrative, technical, and physical safeguards, commensurate with the sensitivity of the Personal Data collected, in accordance with the SPDI Rules and the Digital Personal Data Protection Act, 2023. These measures include access controls, encryption of data in transit where applicable, restricted employee access on a need-to-know basis, and periodic security review of third-party service providers. Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure, and the Company cannot guarantee absolute security. In the event of a personal data breach, the Company shall notify the Data Protection Board of India and the affected Data Principals in the manner and within the timelines prescribed under Applicable Data Protection Laws.
9. DATA RETENTION
The Company retains Personal Data only for so long as is necessary to fulfil the purposes outlined in this Policy, or as required to comply with statutory, regulatory, academic record-keeping, or tax/accounting obligations under applicable law, whichever is later. Academic records and certification data may be retained for extended periods to enable issuance of duplicate certificates or verification requests from employers. Upon expiry of the applicable retention period, or upon a valid request for erasure where the Company is not obligated to retain the data, Personal Data shall be securely deleted or anonymised.
10. PROCESSING OF PERSONAL DATA OF MINORS
The Company welcomes enquiries, enrolment, and participation of prospective students who are minors (individuals below eighteen (18) years of age) as part of its ordinary course offerings, and the Services are not restricted to adult Users. In such cases, the Company collects verifiable consent from the parent or lawful guardian of the minor prior to processing the minor's Personal Data, in accordance with the Digital Personal Data Protection Act, 2023. Verifiable parental/guardian consent is obtained through the parent or guardian counter-signing the physical or electronic Enrolment Agreement, supported by identity verification of the parent/guardian at the time of admission, and such other manner as may be prescribed under Applicable Data Protection Laws from time to time. The Company does not knowingly undertake tracking, behavioural monitoring, or targeted advertising directed at minors, and does not process Personal Data in a manner likely to cause any detrimental effect on the well-being of a minor. Parents/guardians may contact the Grievance Officer named in Clause 15 to review, correct, or request deletion of their ward's Personal Data.
11. RIGHTS OF THE DATA PRINCIPAL
Subject to the provisions of Applicable Data Protection Laws, you have the right to:
- Obtain a summary of the Personal Data being processed and the processing activities undertaken by the Company;
- Request correction, completion, or updating of inaccurate or incomplete Personal Data;
- Request erasure of Personal Data that is no longer necessary for the purpose for which it was collected, subject to any legal retention requirement;
- Withdraw consent at any time, in a manner as easy as the manner in which consent was originally given;
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity;
- Register a grievance with the Company's Grievance Officer, and thereafter, if unresolved, with the Data Protection Board of India.
To exercise any of the above rights, you may submit a written request to the Grievance Officer using the contact details provided in Clause 15. The Company shall endeavour to respond to and redress such requests within a reasonable time and in any event within the timelines prescribed under Applicable Data Protection Laws.
12. THIRD-PARTY LINKS AND SERVICES
The Platform may contain links to third-party websites, payment gateways, social media pages, or learning tools not owned or controlled by the Company. This Policy does not extend to such third-party platforms, and the Company is not responsible for the privacy practices of any third party. Users are advised to review the privacy policies of such third-party platforms independently before sharing any Personal Data with them.
13. CROSS-BORDER TRANSFER OF PERSONAL DATA
Certain service providers engaged by the Company, including cloud hosting and analytics providers, may process Personal Data on servers located outside India. The Company shall ensure that any such transfer is undertaken in compliance with Applicable Data Protection Laws, including any restrictions on transfer to countries or territories notified by the Central Government from time to time, and subject to appropriate contractual safeguards with the recipient entity.
14. MARKETING COMMUNICATIONS AND STUDENT CONSENT
14.1 Express Consent to Promotional Communications
By enrolling in any Course, registering on the Platform, or checking the consent box provided for this purpose (whether on a physical or an electronic form), the Student/User grants his/her explicit, unambiguous, and express consent to the Company, and to service providers acting on its behalf, to send promotional messages, updates, new batch announcements, event invitations, and marketing content relating to the Company's Courses and Services, through each of the following channels:
- WhatsApp;
- Web Push Notifications;
- Phone Calls;
- SMS; and
- E-mail.
The Student/User acknowledges that this consent is limited to the specified purpose of receiving promotional communications, may be withdrawn at any time as set out in Clause 14.2, and that such withdrawal shall not affect the Student's enrolment, access to the Services, or eligibility for any Course. Where the Student/User is a minor, such consent shall be given by, and shall be deemed to have been given by, the parent or lawful guardian who executes the Enrolment Agreement or checks the consent box on the minor's behalf, in accordance with Clause 10.
14.2 Right to Opt Out
The Student/User may withdraw consent and opt out of receiving promotional communications at any time, free of charge and without assigning any reason, by: (a) clicking the "unsubscribe" link provided in promotional emails and other electronic communications; (b) replying "STOP" to promotional SMS or WhatsApp messages; or (c) writing to the Company at grievance@orealworld.com. Web Push Notifications may additionally be disabled at any time through the settings of your browser or device. The Company shall give effect to a valid optout request within a reasonable time and in any event within the timelines prescribed under Applicable Data Protection Laws, and such withdrawal shall not affect the lawfulness of communications sent prior to it.
14.3 Essential Service and Transactional Communications
The opt-out described in Clause 14.2 applies only to promotional and marketing communications. Essential service and transactional notices that are necessary for the delivery of the Services, such as class schedules, examination alerts, and fee reminders, are not promotional in nature, remain unaffected by any opt-out, and will continue to be sent for the duration of your enrolment.
15. GRIEVANCE OFFICER
In accordance with the Information Technology Act, 2000, the SPDI Rules, and the Digital Personal Data Protection Act, 2023, the Company has appointed a Grievance Officer to address any discrepancies, grievances, or queries with respect to the processing of your Personal Data. The details of the Grievance Officer are as follows:
- Designation: Grievance Officer / Data Protection Officer
- Address: OREAL LLP, 5th Floor, Plot No. A-35, Sector-136, Noida, Uttar Pradesh - 201304
- E-mail: grievance@orealworld.com
Grievances shall be acknowledged and redressed within the timelines prescribed under Applicable Data Protection Laws. If you remain dissatisfied with the resolution provided, you may approach the Data Protection Board of India constituted under the Digital Personal Data Protection Act, 2023, without prejudice to your right to seek any other remedy available in law.
16. EXPANSION OF OPERATIONS AND NEW BRANCHES
The Company may, in the ordinary course of its business, expand its operations by opening new branches, centres, or offices operating under the OREAL LLP brand across India. No new branch, centre, or office of the Company shall be opened, established, or commenced without the prior written approval and consent of both Designated Partners (Directors) of the Company. Any Personal Data collected, processed, or stored at or through any such new branch, centre, or office shall continue to be governed by, and processed strictly in accordance with, the terms of this Policy.
17. AMENDMENTS TO THIS POLICY
The Company reserves the right to amend, modify, or update this Policy at any time to reflect changes in its data processing practices or in Applicable Data Protection Laws. Any material changes shall be notified to Users through the Platform or via registered e-mail/contact details, and shall take effect from the date of such notification unless otherwise stated. Continued use of the Platform or Services following such notification shall constitute acceptance of the revised Policy. Users are encouraged to review this Policy periodically.
18. GOVERNING LAW AND JURISDICTION
This Policy shall be governed by and construed in accordance with the laws of India. Subject to Clause 15 above regarding grievance redressal, the courts at Noida, Gautam Buddh Nagar, Uttar Pradesh, India shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy, to the exclusion of all other courts.
19. CONTACT US
For any questions, clarifications, or requests relating to this Policy or the processing of your Personal Data, you may write to us at:
- OREAL LLP
- 5th Floor, Plot No. A-35, Sector-136, Noida, Uttar Pradesh - 201304, Gautam Buddh Nagar, Uttar Pradesh, India
- LLPIN: ACZ-4869
- E-mail: privacy@orealworld.com
- Website: www.orealworld.com