Children's Privacy Notice

Pathshala OS is sold to schools, coaching centres, and other Institutes for institute-administered educational programmes. When children are on the platform, they are there because their school or learning institute (the “Institute”) has put them there. The Institute is the data controller for those children; we are the processor. This Notice supplements our Privacy Policy with rules that apply specifically to minors.

This Notice applies to children who are:

• under 13 in the United States (COPPA);
• under the applicable age of digital consent (13–16) in the European Economic Area (GDPR);
• under 13 in the United Kingdom (UK GDPR, Age-Appropriate Design Code);
• under 18 in India (DPDP Act 2023 §9, which classifies anyone under 18 as a “child” for digital-consent purposes);
• covered by any other comparable jurisdictional rule that applies to the Institute's users.

Pathshala does not knowingly accept direct self-registration from anyone under 13. The signup wizard on pathshala.co asks for date of birth and refuses the account if the date implies the visitor is under 13. If we discover that an account was nevertheless created by an under-13 user without proper Institute mediation, we will delete it.

Children may access Pathshala only when an Institute has provisioned an account for them and has obtained any required parental or guardian consent. The Institute is responsible for:

• verifying the age of its enrolled students;
• obtaining verifiable parental consent where required by COPPA, GDPR-K, DPDP, or other applicable law (e.g., signed enrolment form with parental signature, school-board policy authorising EdTech use);
• posting its own privacy notice to parents and students;
• using Pathshala only for the educational purpose the consent covers.

The MSA requires the Institute to make these representations at signup (see MSA §8 & §11).

When an Institute adds a child to Pathshala, we collect only the minimum information needed to deliver the educational service:

• name (often a first name or roll-number nickname is enough);
• school-issued email or parent email;
• class / grade / cohort;
• course-level progress, assignments, attendance, and live-class participation;
• account password (hashed);
• standard server logs (IP, browser, timestamps) for security and abuse prevention.

• We do not sell children's personal data.
• We do not show third-party advertising to children.
• We do not use children's content to train Pathshala's or any third party's generic AI models.
• We do not behaviourally profile children for marketing.
• We do not allow children's data to be transferred outside of the educational purpose without further consent.
• We do not require children to provide more information than is reasonably necessary to use the Service.

A parent or legal guardian of a child on Pathshala may:

• request a copy of the personal information we hold about the child;
• ask the Institute or Pathshala to correct inaccurate information;
• ask the Institute or Pathshala to delete the child's information;
• refuse to allow further collection or use of the child's information.

The fastest route is usually through the school or Institute, which controls the account. You may also email privacy@pathshala.co. We will verify your relationship to the child and respond within the time required by applicable law (30 days under DPDP, 45 days under CPRA, 30 days under GDPR extendable to 90, 45 days under COPPA).

U.S. schools and school districts subject to FERPA (20 USC §1232g) may designate Pathshala as a “school official with a legitimate educational interest” under 34 CFR §99.31(a)(1) and the direct-control exception. Pathshala will:

• act under the school's direct control;
• not redisclose education records except as the school directs;
• not use education records for any purpose other than the educational service;
• destroy or return education records when the school instructs.

We will counter-sign a Student Data Privacy Addendum on request — see our FERPA School-Official Addendum.

Older minors may have their own rights under applicable law to access, correct, or delete their personal information. Pathshala recommends that minors first ask their Institute to action a request, because the Institute administers their account. If that is not possible, the minor may email privacy@pathshala.co and we will work with the Institute to verify and respond.

India (DPDP Act 2023). Pathshala will obtain verifiable parental consent before processing the personal data of any data principal under 18, in the form and manner specified by the Data Protection Board. Until the Board prescribes a specific method, the Institute's documented school-enrolment consent is treated as the authorising channel for school-administered access. Pathshala will not undertake tracking or behavioural monitoring of a child or serve advertising directed at a child.

European Economic Area & United Kingdom. Pathshala relies on Article 6(1)(b) (contractual necessity) for the educational service the Institute commissions, and on Article 8 (children's consent) where direct processing of a child's data is required. The Institute is responsible for verifying parental consent where the local age of digital consent is higher than 13.

United States. COPPA, FERPA, and a patchwork of state laws (e.g., California SOPIPA, New York §2-d, Illinois SOPPA) apply. Pathshala's privacy and security practices are designed to meet the strictest of these.

Parents, schools, regulators, or anyone else with a children's-privacy concern: email privacy@pathshala.co or write to Pathshala Inc., 1240 Barksdale Dr NE, Leesburg, VA 20176, USA. Our designated DPDP Grievance Officer for India is reachable at dpo@pathshala.co.