Privacy policy

Operated by Wabya Eduventures Private Limited

Effective Date: 1 June 2025

Last Updated: 1 September 2026

At Sakha, we believe that education requires trust.

This Privacy Policy explains how Wabya Eduventures Private Limited, operating as Sakha – Your Study Buddy (“Sakha”, “we”, “us” or “our”), collects, uses, stores, shares and protects personal data when you interact with us.

We have tried to keep this Policy clear and easy to understand, while explaining the important ways in which we handle personal data.

Because our services may involve children, we take particular care with information relating to students and children’s personal data.

This Privacy Policy should be read together with the Sakha Student & Parent/Guardian Terms of Service and the Sakha Refund & Cancellation Policy, where applicable.

1. WHO THIS POLICY APPLIES TO

This Privacy Policy applies to personal data relating to: Parents and Guardians; students; prospective students and families; educators and tutors; coordinators and other service personnel; visitors to the Sakha website; people who submit enquiries; people who participate in trials; people who communicate with Sakha; people who make payments; people who provide feedback, reviews or testimonials; and other individuals who interact with Sakha.

It applies when you visit or use the Sakha website; submit an enquiry; contact us; register for a trial; enrol a student; participate in classes or programmes; communicate with Sakha; make payments; provide feedback or testimonials; or otherwise interact with Sakha.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

For purposes of applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”), where applicable, Wabya Eduventures Private Limited, operating as Sakha – Your Study Buddy, acts as the “Data Fiduciary” for personal data processed by Sakha in connection with its services.

Our Details

Wabya Eduventures Private Limited Sakha – Your Study Buddy

First Floor, No. 547/14, “Srikanta Nilaya,” Nagar 15th Main, Rajendra Infotech Road, A Block, Sahakar Nagar, Bengaluru – 560092

Phone: +91 99800 28118
Email: info@yoursakha.me
Website: www.yoursakha.me

Privacy Contact

Designated Privacy & Grievance Officer: Meeth Malani, Grievance Officer
Email/Phone: info@yoursakha.me

3. KEY DEFINITIONS

For the purposes of this Policy and in accordance with the DPDP Act, 2023:

“Data Fiduciary” means Wabya Eduventures Private Limited, which determines the purpose and means of processing personal data in connection with Sakha’s services.
“Data Principal” means the individual to whom the personal data relates – this may be a Parent/Guardian, a student, an educator, or any other individual whose personal data Sakha processes. Where the Data Principal is a child, the Parent/Guardian exercises rights on their behalf as described in this Policy.
“Child” means an individual who has not completed the age of 18 years.
“Processing” means any operation performed on personal data, including collection, storage, use, sharing, and erasure.

4. OUR APPROACH TO PERSONAL DATA

Sakha aims to handle personal data in accordance with the following principles:

Purpose Limitation – We seek to collect and use personal data for clear, relevant and legitimate purposes connected with our services and operations.
Data Minimisation – We seek to collect only the information that is reasonably necessary for the relevant purpose.
Accuracy – We aim to keep personal data accurate and encourage Parents/Guardians to notify us when important information changes.
Access Control – Access to personal data is limited to authorised personnel and service providers who reasonably require it for legitimate purposes.
Retention – We retain information only for as long as reasonably necessary for the relevant purpose or as required or permitted by applicable law.
Security – We take reasonable technical and organisational measures to protect personal data against unauthorised access, misuse, loss or disclosure.
Transparency – We aim to explain clearly how personal data is collected and used and provide applicable rights and choices to Data Principals and Parents/Guardians.

5. WHAT PERSONAL DATA DO WE COLLECT?

Depending on how you interact with Sakha, we may collect different categories of personal data. We do not seek to collect personal information that is unrelated to the purposes for which we provide our services.

5.1 Parent/Guardian Information – name; mobile number; email address; residential or billing address; relationship to the student; communication preferences; payment and transaction information; information provided during enrolment or enquiry; and correspondence with Sakha.

5.2 Student Information – student’s name; age or date of birth where required; grade/class; school; curriculum or education board; subjects; academic requirements; attendance; assessments; academic performance; learning requirements; teacher observations; homework or submitted academic work; progress reports; and other information reasonably necessary to provide appropriate educational support.

5.3 Safety, Accessibility & Relevant Health Information – Where reasonably necessary for participation, safeguarding or safety, a Parent/Guardian may provide information relating to allergies; accessibility requirements; physical limitations; emergency contacts; relevant medical information; or other information that may reasonably affect safe participation. Sakha seeks to limit collection and access to such information to what is reasonably necessary for the relevant purpose. Parents/Guardians should provide only information that is relevant to the student’s participation, safety or support.

5.4 Communication Information – We may retain communications sent through email, WhatsApp or other designated messaging channels, telephone calls, website forms, digital forms, feedback forms, support requests, and other official Sakha communication channels, to respond to requests, coordinate services, maintain appropriate records and address complaints or disputes.

5.5 Payment Information – transaction amount; transaction date; payment status; invoice information; payment reference; payment method; and relevant billing information. Where payment is processed through a third-party payment provider, that provider may independently process payment-related information under its own privacy terms. Sakha does not ordinarily require or store complete card, banking or authentication credentials where those credentials are processed directly by a third-party payment provider.

5.6 Website & Technical Information – IP address; browser type; device type; operating system; pages visited; approximate usage information; referring pages; and technical logs, depending on the technologies and tools enabled on the website.

6. HOW DO WE COLLECT PERSONAL DATA?

We may collect personal data directly from Parents/Guardians; directly from students where appropriate; through website enquiry or registration forms; during telephone or WhatsApp communication; during enrolment; through assessments; through class participation; through payments; through feedback; from educators and coordinators in connection with academic services; through authorised service providers; and from other sources where permitted by applicable law.
We aim to collect information directly from the relevant Parent/Guardian or Data Principal wherever reasonably practicable.

7. WHY DO WE COLLECT AND USE PERSONAL DATA?

Enrolment & Service Delivery – to register students; determine appropriate academic services; allocate educators; schedule classes; maintain attendance; conduct assessments; provide academic support; communicate progress; and manage student enrolment.
Communication – to respond to enquiries; communicate schedules; provide reminders; send service updates; respond to complaints; communicate fee information; and provide relevant academic or administrative information. Service-related communications may continue even if a person has opted out of promotional communications.
Payments & Administration – to issue invoices; process and reconcile payments; maintain financial records; manage outstanding fees; administer enrolments; and comply with applicable accounting, tax and legal requirements.
Safety & Safeguarding – to maintain a safe learning environment; respond to emergencies; manage safeguarding concerns; contact Parents/Guardians or emergency contacts; protect students and educators; and comply with legal obligations concerning student safety.
Service Improvement – to monitor service quality; understand operational issues; improve academic programmes; train educators; assess service performance; and improve the student and Parent/Guardian experience. Where possible, Sakha may use aggregated or de-identified information for analysis and service improvement.
Legal & Compliance Purposes – to comply with applicable law; respond to lawful requests; maintain required records; protect Sakha’s legal rights; prevent fraud or misuse; investigate complaints or misconduct; and establish, exercise or defend legal claims.
Marketing & Communications – Where permitted by applicable law and where the required consent or other lawful basis exists, Sakha may use relevant contact information to communicate new programmes; workshops; events; relevant educational services; offers; and Sakha updates. Marketing communications will be distinguishable from essential service communications. Parents and other recipients may opt out of promotional communications at any time using the mechanism provided in the communication or by contacting Sakha.

8. CHILDREN’S PERSONAL DATA

Sakha recognises the additional responsibility involved in providing educational services to children. Where personal data relates to a child, Sakha will apply the safeguards required by applicable law.
Where applicable law requires verifiable parental consent, Sakha will obtain such consent through an appropriate process before undertaking the relevant processing.
The Parent/Guardian represents that they are authorised to act on behalf of the student and to provide information and any consent required under applicable law.
Sakha will process children’s personal data only for legitimate and relevant purposes connected with education; academic support; enrolment; administration; safety and safeguarding; communication; service improvement; legal compliance; or other purposes permitted by applicable law.
Sakha does not intentionally use children’s personal data for targeted advertising directed at children.
Sakha does not intentionally engage in behavioural tracking or monitoring of children for advertising or unrelated commercial purposes.

9. PARENTAL CONSENT & VERIFICATION

Where verifiable parental consent is legally required, Sakha will use an appropriate mechanism to verify the identity or authority of the Parent/Guardian in accordance with applicable law.
Depending on the enrolment or service process, verification may involve appropriate information or authentication mechanisms.
Sakha will seek to maintain reasonable records demonstrating that required consent or authorisation was obtained.
The exact verification method may change as Sakha’s systems develop and as applicable legal requirements evolve, including as rules under the DPDP Act, 2023 are notified and clarified.
Sakha will not claim to use a particular verification technology or recordkeeping mechanism unless that mechanism is actually implemented.

10. ACADEMIC INFORMATION

Academic information is collected and processed to provide educational services, including assessment results; teacher feedback; attendance; academic strengths and areas for improvement; learning goals; homework; worksheets; progress reports; and communications relating to academic development.
Such information may be accessed by authorised Sakha personnel and educators where reasonably necessary to provide the service.
Academic information will not ordinarily be disclosed publicly without appropriate consent or another lawful basis.

11. RECORDING OF ONLINE OR PHYSICAL SESSIONS

Where Sakha records or monitors classes or activities for legitimate purposes such as quality assurance; educator training; safeguarding; security; compliance; service improvement; or dispute investigation, the relevant recordings or information may be processed in accordance with applicable law.
Sakha will take reasonable steps to inform relevant participants where recording is applicable.
Access to recordings will be limited to authorised personnel or service providers where reasonably necessary for the relevant purpose.
Recordings will not ordinarily be retained indefinitely.

12. MARKETING USE OF PHOTOGRAPHS, VIDEOS & TESTIMONIALS

Sakha may conduct workshops, events, celebrations and academic activities where photographs or videos may be taken.
Sakha will not use an identifiable child’s photograph; video; voice; class recording; academic performance; or testimonial for public advertising, marketing or promotional purposes without appropriate parental consent where required.
Consent for public marketing use is separate from consent or processing necessary to provide educational services.
A Parent/Guardian may withdraw marketing consent, subject to applicable law and any lawful processing already carried out before withdrawal.

13. PHOTOGRAPHS & EVENTS

Sakha may take photographs or videos during workshops, events, celebrations, academic activities or other legitimate activities.
Internal documentation, safeguarding-related photography and operational records will be handled in accordance with applicable law and legitimate purposes.
Where Sakha wishes to use an identifiable child’s image, video, voice or testimonial publicly for marketing, appropriate parental consent will be obtained where required.

14. SHARING OF PERSONAL DATA

Sakha may share personal data with authorised persons or organisations where reasonably necessary for the purposes described in this Privacy Policy or where otherwise permitted or required by applicable law.

Sakha Personnel – Employees, educators, coordinators, management and authorised personnel who reasonably need information to provide services. Access will be limited according to role and legitimate need.
Service Providers – Third-party providers supporting functions such as payment processing; communication; scheduling; video conferencing; website hosting; cloud storage; information technology; security; accounting; and other legitimate business functions.
Professional Advisers – lawyers; accountants; auditors; insurers; or other professional advisers, where reasonably necessary.
Government & Authorities – where required or permitted by applicable law; court order; lawful government request; safeguarding requirement; or other legal obligation.
Business Transactions – If Sakha or its business assets are involved in a merger, acquisition, restructuring, sale or other corporate transaction, personal data may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

Sakha does not sell children’s personal data. Sakha does not sell personal data to third parties for their independent marketing purposes.

15. THIRD-PARTY PLATFORMS & SERVICE PROVIDERS

Sakha may use third-party technology and service providers to operate and deliver its services, including providers of cloud hosting; payment processing; video conferencing; messaging; email; scheduling; website hosting; analytics; security; and other operational services.
Examples may include platforms such as Zoom, Google Meet or WhatsApp where used by Sakha.
These third-party providers may process personal data in accordance with their own terms and privacy practices.
Sakha seeks to limit third-party access to information reasonably necessary for the relevant service, and where appropriate seeks to impose contractual confidentiality, security and data-processing obligations on service providers consistent with the nature of the services and applicable law.
Parents and users are encouraged to review the privacy practices of third-party platforms used during classes or communications.

16. INTERNATIONAL DATA PROCESSING

Some third-party technology providers may process or store information outside India.
Where personal data is transferred outside India, Sakha will comply with applicable legal requirements and any restrictions or safeguards applicable to such transfers.
The location of processing may change as technology providers, infrastructure and service arrangements change.

17. DATA RETENTION

Sakha retains personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by applicable law. Different categories of information may be retained for different periods:

Enrolment and service records – during the relationship and for an appropriate period afterwards;
Financial and tax records – for the period required by applicable accounting, tax or legal requirements;
Complaint and dispute records – as long as reasonably necessary to establish, exercise or defend legal claims;
Consent records – as long as reasonably necessary to demonstrate compliance;
Academic records – for an appropriate period connected with academic administration and service delivery; and
Recordings – only for the applicable legitimate purpose and for an appropriate period.

Where a Parent/Guardian’s or student’s account or relationship with Sakha has been inactive for an extended period, Sakha may provide notice before erasing the associated personal data, except where retention is otherwise required by law.

When personal data is no longer required and there is no legal or legitimate reason to retain it, Sakha will take reasonable steps to delete, destroy or anonymise it.

18. DATA SECURITY

Sakha takes reasonable technical and organisational measures to protect personal data against unauthorised access; unauthorised disclosure; accidental loss; destruction; alteration; misuse; and other reasonably foreseeable security risks, through measures such as access controls; restricted staff access; password protection; secure systems; confidentiality obligations; appropriate backup procedures; system and access monitoring; and other reasonable security measures.
No electronic system or method of transmission can be guaranteed to be completely secure. Accordingly, while Sakha takes reasonable precautions, it cannot guarantee absolute security of information transmitted over the internet or stored electronically.

19. DATA BREACHES & SECURITY INCIDENTS

If Sakha becomes aware of a personal data breach, Sakha will take reasonable steps to:

assess and contain the incident;
investigate its nature and scope;
mitigate potential harm;
preserve relevant information and records where appropriate;
notify the Data Protection Board of India and affected Data Principals in the manner and timeline required under the DPDP Act, 2023, regardless of the perceived severity of the breach; and
take reasonable corrective and preventive measures.

Sakha may also review and improve its security processes following a significant incident.

20. YOUR RIGHTS

Subject to applicable law, Data Principals may have rights relating to their personal data, including rights to:

obtain information about processing;
request correction of inaccurate or incomplete personal data;
request erasure where applicable;
withdraw consent where processing is based on consent;
nominate another individual to exercise these rights on the Data Principal’s behalf in the event of death or incapacity, in accordance with the DPDP Act, 2023;
exercise other rights provided under applicable law; and
raise a grievance regarding the processing of personal data.

Where the request relates to a child’s personal data, Sakha may require the request to be made or authorised by the Parent/Guardian or another person legally entitled to act on behalf of the child.

Some requests may be subject to legal limitations, exceptions or retention requirements.

21. WITHDRAWAL OF CONSENT

Where processing is based on consent, a Data Principal or Parent/Guardian may withdraw that consent in accordance with applicable law. Withdrawing consent will be at least as easy as giving consent, in accordance with the DPDP Act, 2023.
A request to withdraw consent may be submitted to: info@yoursakha.me
Withdrawal of consent does not invalidate processing that was lawfully carried out before the withdrawal.
Where certain personal data is necessary to provide a requested service, withdrawal of consent or a request for deletion may affect Sakha’s ability to continue providing that service. In such circumstances, Sakha will explain the relevant impact where reasonably practicable.
Sakha may continue to retain or process information where required or permitted by applicable law, including for legal, accounting, safeguarding, dispute-resolution or compliance purposes.

22. HOW TO MAKE A PRIVACY REQUEST

A Parent/Guardian or other authorised Data Principal may contact:
Wabya Eduventures Private Limited / Sakha – Your Study Buddy Email: info@yoursakha.me Phone: +91 99800 28118
A request should include sufficient information for Sakha to identify the relevant person; understand the request; identify the relevant account or student record; and verify the identity or authority of the person making the request.
Where necessary, Sakha may request reasonable additional information to prevent unauthorised disclosure of personal data.
Sakha will acknowledge a privacy request within 7 days and endeavour to respond substantively within 30 days, except where a longer period is reasonably necessary due to the complexity of the request.

23. GRIEVANCE REDRESSAL

Privacy-related complaints or concerns should first be submitted to Sakha’s Privacy & Grievance Officer:
Grievance Officer: Meeth Malani, Grievance Officer Email/Phone: info@yoursakha.me
Sakha will acknowledge a grievance within 7 days and endeavour to respond substantively within 30 days, in accordance with applicable law and its internal grievance process.
If a Data Principal is not satisfied with Sakha’s response, they may file a complaint with the Data Protection Board of India in accordance with the DPDP Act, 2023, once the relevant complaint mechanism is operational, or exercise any further statutory rights or remedies available under applicable law.

24. COOKIES & SIMILAR TECHNOLOGIES

Sakha’s website may use cookies or similar technologies to enable essential website functionality; remember preferences; understand website usage; improve website performance; maintain security; and support analytics or other legitimate website functions.
The specific cookies and technologies used may change over time. Where required by law, Sakha will provide appropriate notice and obtain consent before using non-essential cookies or similar technologies.
Users may manage cookie settings through their browser or through any cookie-management mechanism provided on the website. Disabling certain cookies may affect website functionality.

25. MARKETING COMMUNICATIONS

Sakha may communicate information about academic programmes; workshops; events; new services; educational initiatives; and relevant offers.
Where required by applicable law, marketing communications will be sent only where the appropriate consent or other lawful basis exists.
You may opt out of marketing communications at any time by using the unsubscribe mechanism provided; contacting Sakha; or following the instructions contained in the relevant communication.
Opting out of marketing communications does not necessarily stop essential service-related communications concerning an existing enrolment or transaction.

26. TESTIMONIALS & REVIEWS

Parents or students may voluntarily provide testimonials; feedback; reviews; photographs; academic experiences; or other comments.
Sakha may use feedback internally for service improvement.
Identifiable testimonials, photographs, videos or other student media will be used for public promotional purposes only with appropriate consent where required.
Sakha will not knowingly publish materially misleading or materially altered statements attributed to a Parent/Guardian or student.

27. LINKS TO OTHER WEBSITES

The Sakha website may contain links to third-party websites or services. Sakha is not responsible for the privacy practices, content or security of third-party websites. Users should review the privacy policies of those websites before providing personal information.

28. CHILDREN’S WEBSITE & ONLINE ACCESS

Sakha’s services may involve children, but the Parent/Guardian remains responsible for ensuring that the child uses the website and online services appropriately and in accordance with Sakha’s Terms.
Where personal data of a child is collected or processed, Sakha will apply the safeguards required by applicable law.
Sakha does not knowingly permit children to independently enter into contractual enrolment arrangements without appropriate Parent/Guardian involvement.
Where required by applicable law, Sakha will obtain appropriate parental or lawful guardian consent.

29. ACCURACY OF INFORMATION

Parents/Guardians should ensure that information provided to Sakha is accurate, complete and current. If information changes, the Parent/Guardian should notify Sakha so that relevant records can be updated.
Sakha is not responsible for consequences arising directly from inaccurate or outdated information supplied by the Parent/Guardian, except to the extent otherwise required by applicable law.

30. CONFIDENTIALITY & INTERNAL ACCESS

Sakha will treat personal information as confidential and will seek to limit access to authorised personnel and service providers who reasonably require it for legitimate purposes.
This does not prevent disclosure where required by law; necessary for safeguarding; necessary to provide services; necessary to protect Sakha’s legal rights; necessary to prevent fraud or misuse; or otherwise permitted by applicable law.
Educators and personnel who receive access to student information as part of their role are expected to handle that information appropriately and only for legitimate work-related purposes.

31. DATA MINIMISATION & INFORMATION WE DO NOT ORDINARILY REQUIRE

Sakha seeks to minimise the personal information it collects. We do not ordinarily require information such as Aadhaar numbers; complete card numbers or banking credentials; biometric information; precise location information; or unrelated sensitive personal information for ordinary educational services.
If particular information is required for a specific lawful purpose, Sakha will seek to explain the relevant purpose where reasonably practicable.

32. SIGNIFICANT DATA FIDUCIARY STATUS

Sakha does not presently qualify as a “Significant Data Fiduciary” under the DPDP Act, 2023.

If this status changes, Sakha will adopt the additional obligations applicable under the Act, including appointment of a Data Protection Officer based in India and periodic data protection impact assessments, as required by law.

33. CHANGES TO THIS PRIVACY POLICY

Sakha may update this Privacy Policy from time to time to reflect changes in law; changes in technology; changes to our services; changes to our data practices; or improvements to our privacy processes.
The latest version will be published on the Sakha website together with the applicable Last Updated date.
Where a change materially affects rights or requires additional consent under applicable law, Sakha will provide appropriate notice and obtain consent where required.

34. GOVERNING LAW

This Privacy Policy is governed by the laws of India. Nothing in this Policy excludes or limits any statutory right or remedy that cannot legally be excluded.

35. CONTACT INFORMATION