Privacy Policy

Effective Date: March 2022
Last Updated: July 2026

1. Introduction

iSTEP Mentors is a venture of AB Educational Avenues Pvt. Ltd. References in this Privacy Policy to “iSTEP Mentors”, “iSTEP”, “we”, “us” or “our” refer to AB Educational Avenues Pvt. Ltd. and the iSTEP Mentors platform operated by it.

This Privacy Policy explains how we collect, use, store, share and protect personal data when schools, teachers, students, parents, guardians and other visitors use:

  • the iSTEP Mentors website;
  • the iSTEP masterclass portal;
  • masterclass registration and participation links;
  • assessment and certificate services; and
  • related services operated by iSTEP Mentors.

iSTEP Mentors provides educational masterclasses to participating schools. Authorised teachers use the platform to schedule masterclasses for their students. Students do not create individual platform accounts. Instead, the school or teacher shares a private masterclass participation link with eligible students.

By providing personal data to us, you acknowledge that it will be handled as described in this Privacy Policy. Where consent is required by applicable law, we will request it through an appropriate notice, checkbox, form or other clear affirmative action.

2. How the iSTEP Masterclass Platform Works

Authorised schools and teachers may create or access accounts and schedule masterclasses for their students.

A school or teacher shares a private participation link with students for a masterclass scheduled for a particular date and time.

Students use the link to:

  • provide limited registration details;
  • access the scheduled masterclass;
  • participate in the educational session;
  • complete a short assessment, normally consisting of approximately ten questions; and
  • receive a certificate of completion where the applicable requirements are met.

Students do not need to create an account, username or password.

A digital certificate or completion record may be provided after successful completion. A student, parent, guardian, teacher or school may also request an optional printed hard-copy certificate. A fee may apply to the printing, administration, packaging and delivery of a hard-copy certificate.

3. Personal Data We Collect

We collect only the personal data reasonably required to operate the platform, provide masterclasses, conduct assessments and issue certificates.

3.1 School and teacher information

When a teacher or school registers for or uses the platform, we may collect:

  • teacher’s name;
  • official or other provided email address;
  • telephone number;
  • designation or role;
  • school name;
  • school location and contact details;
  • teacher account login credentials;
  • masterclass selections;
  • scheduled date and time;
  • expected number or class of participating students;
  • messages and communications with iSTEP Mentors;
  • platform activity and administrative records; and
  • support requests.

3.2 Student information

Students do not create individual accounts. When a student accesses a masterclass participation link, we may collect:

  • student’s name;
  • email address;
  • current class or grade;
  • expected or actual year of Class 12 completion;
  • school or masterclass identification;
  • date and time of participation;
  • attendance or participation status;
  • assessment answers;
  • assessment score;
  • pass, completion or eligibility status;
  • certificate name and details;
  • certificate number or verification identifier, where applicable; and
  • communications concerning the masterclass, assessment or certificate.

We do not ask students to provide account passwords because students do not have platform accounts.

3.3 Hard-copy certificate information

Where an optional printed certificate is requested, we may collect:

  • recipient’s name;
  • student’s certificate details;
  • postal or delivery address;
  • telephone number for delivery;
  • email address;
  • order details;
  • amount payable;
  • payment status;
  • payment transaction reference;
  • courier or shipment details; and
  • communications concerning payment, printing or delivery.

3.4 Payment information

Payments for optional hard-copy certificates may be processed through an authorised third-party payment service provider.

The payment provider may collect information such as card, bank, UPI, wallet or other payment details directly through its secure payment interface.

iSTEP Mentors does not normally receive or store complete payment-card numbers, card security codes, UPI PINs, online banking passwords or other complete financial authentication credentials.

We may receive and retain limited transaction information, including:

  • payer’s name;
  • amount;
  • payment method category;
  • transaction reference;
  • payment date;
  • payment status; and
  • refund or dispute status, where applicable.

3.5 Website and technical information

When someone visits or uses our website or platform, certain technical information may be collected automatically, including:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • date and time of access;
  • pages or platform functions accessed;
  • referring website;
  • login and session information;
  • cookie identifiers;
  • error, security and diagnostic logs; and
  • general website usage information.

We do not use this information to conduct behavioural profiling of children or to serve targeted advertising to children.

3.6 Communications and enquiries

When a teacher, school, student, parent, guardian or other person contacts us, we may collect:

  • name;
  • email address;
  • telephone number;
  • school details;
  • enquiry or message;
  • attached documents, where voluntarily provided; and
  • our response and communication history.

4. How We Collect Personal Data

We may collect personal data:

  • directly from teachers or school representatives;
  • directly from students using a masterclass participation link;
  • from parents or guardians requesting assistance or a certificate;
  • from a school or authorised teacher administering a masterclass;
  • through assessment submissions;
  • through hard-copy certificate request forms;
  • through payment service providers;
  • through courier or postal providers;
  • through cookies and technical logs;
  • through emails, telephone calls or support enquiries; and
  • from service providers acting on our behalf.

Schools and teachers should provide personal data to us only where they are authorised to do so.

5. How We Use Personal Data

We may use personal data to:

  • create and manage school and teacher accounts;
  • verify authorised teacher or school access;
  • schedule and administer masterclasses;
  • provide students with access to a scheduled masterclass;
  • confirm attendance and participation;
  • conduct educational assessments;
  • record assessment answers and calculate results;
  • determine completion or certificate eligibility;
  • generate, issue and verify certificates;
  • send masterclass, assessment or certificate-related communications;
  • provide relevant information to the participating school or authorised teacher;
  • process requests for printed certificates;
  • process and confirm payments;
  • print, package and deliver hard-copy certificates;
  • respond to enquiries and support requests;
  • diagnose technical issues;
  • maintain platform security;
  • detect or prevent misuse, fraud or unauthorised access;
  • maintain appropriate administrative and financial records;
  • comply with applicable legal requirements;
  • establish, exercise or defend legal claims; and
  • improve the reliability and educational operation of the platform.

Student assessment information is used only for masterclass completion, educational evaluation and certificate purposes. It is not used to make decisions concerning school admission, employment, credit, insurance, migration or other matters that have a similarly significant effect on the student.

6. Children’s Personal Data

Our masterclasses may be attended by school students, including students under 18 years of age. Student participation is arranged through a participating school or authorised teacher. Students do not create individual platform accounts.

We collect only limited student information needed to:

  • register participation;
  • provide access to a scheduled masterclass;
  • record attendance;
  • conduct the educational assessment;
  • calculate assessment results;
  • determine completion;
  • issue and verify certificates; and
  • respond to certificate or participation enquiries.

Participating schools and teachers must:

  • share masterclass links only with authorised students;
  • protect links against unauthorised distribution;
  • provide students and parents or guardians with appropriate information about the activity;
  • obtain school approvals and parent or guardian permissions required under applicable law; and
  • avoid submitting personal data that is not required for the masterclass.

Where applicable law requires iSTEP Mentors to obtain or verify parent or guardian consent directly, we may request additional information or confirmation before processing a child’s personal data.

We may also ask a school, teacher, parent or guardian to provide reasonable evidence of their authority to act for a student.

We do not knowingly:

  • use children’s personal data for targeted advertising;
  • conduct behavioural monitoring or profiling of children;
  • sell children’s personal data;
  • collect unnecessary financial information directly from children; or
  • process children’s personal data in a manner likely to cause harm to their well-being.

A parent or lawful guardian may contact us to request access to, correction of or deletion of a child’s personal data, subject to applicable legal requirements and necessary certificate or transaction records.

7. Schools and Authorised Teachers

Teachers and schools may have access to information relating to students participating through their school, where such access is required to administer the masterclass.

Depending on the platform functions available, an authorised teacher or school may be able to view:

  • registered student names;
  • participation or attendance status;
  • assessment completion status;
  • assessment score or result;
  • certificate eligibility;
  • issued certificate details; and
  • hard-copy certificate request status.

Schools and teachers must use student information only for legitimate educational and administrative purposes connected with the relevant masterclass.

They must not:

  • share student information with unauthorised persons;
  • use student information for unrelated marketing;
  • publicly disclose assessment results without appropriate authority;
  • share masterclass links outside the intended school group; or
  • attempt to access information relating to another school.

Schools and teachers are responsible for keeping their account credentials confidential and notifying us promptly of any suspected unauthorised access.

8. Assessments and Certificates

Assessment responses are reviewed or processed to determine whether a student has completed the applicable masterclass requirements.

A certificate may include:

  • student’s name;
  • masterclass title;
  • date of participation or completion;
  • certificate number;
  • issuing organisation;
  • completion status; and
  • authorised signature or verification information.

Certificates may be:

  • made available through the platform;
  • sent to the student’s provided email address;
  • provided to the participating school or authorised teacher;
  • printed and delivered where a hard copy is requested; or
  • made verifiable through a certificate reference system.

A public certificate-verification function, where provided, will display only limited information reasonably necessary to verify the certificate. We will not intentionally display the student’s complete email address, delivery address, payment details or full assessment answers on a public verification page.

9. Optional Hard-Copy Certificate Payments

Attendance at a masterclass and completion of the educational assessment are separate from a request for an optional printed certificate.

Where a hard-copy certificate is offered:

  • a separate fee may be charged;
  • the fee may cover printing, administration, packaging and delivery;
  • payment may be made by a student, parent, guardian, teacher or school;
  • payment will be processed through an authorised payment provider; and
  • relevant delivery information may be shared with printing and courier providers.

Payment is not used to change or improve a student’s assessment score or completion result.

Payment and delivery information is used only for:

  • processing the certificate request;
  • confirming payment;
  • preventing duplicate or fraudulent transactions;
  • printing the correct certificate;
  • arranging shipment;
  • responding to payment or delivery enquiries;
  • processing permitted refunds or replacements; and
  • meeting applicable accounting, tax and legal requirements.

10. When We Share Personal Data

We do not sell or rent personal data.

We may share personal data only where reasonably necessary with the following categories of recipients.

10.1 Participating schools and teachers

Student registration, attendance, assessment completion and certificate information may be shared with the participating school and authorised teachers for masterclass administration.

10.2 Technology and hosting providers

We may use service providers for:

  • website and application hosting;
  • cloud storage;
  • database management;
  • security;
  • email delivery;
  • OTP or authentication services;
  • analytics;
  • technical support; and
  • backup and disaster recovery.

10.3 Payment providers

Payment and transaction information may be processed by payment gateways, banks, UPI providers or other authorised payment service providers.

10.4 Certificate printing and delivery providers

Where a hard-copy certificate is requested, relevant information may be shared with:

  • certificate printing providers;
  • packaging providers;
  • courier companies;
  • postal services; and
  • delivery support providers.

Only information required to print and deliver the certificate should be shared.

10.5 Professional advisers

Information may be shared with authorised accountants, auditors, lawyers or other professional advisers where reasonably necessary.

10.6 Legal and safety requirements

We may disclose personal data where reasonably necessary to:

  • comply with applicable law;
  • respond to a valid court, government or regulatory request;
  • investigate fraud or security incidents;
  • protect students, teachers, schools or other users;
  • enforce our legal rights; or
  • prevent unlawful or unauthorised use of the platform.

Our service providers are expected to process personal data only for the services they provide and to apply appropriate confidentiality and security measures.

11. Cookies and Similar Technologies

Our website and platform may use cookies and similar technologies.

11.1 Essential cookies

Essential cookies may be used to:

  • maintain secure teacher login sessions;
  • keep the platform functioning;
  • remember basic preferences;
  • protect forms from misuse;
  • support masterclass participation; and
  • maintain platform security.

Disabling essential cookies may prevent some parts of the platform from working correctly.

11.2 Analytics cookies

We may use analytics tools to understand general website and platform performance, such as:

  • number of visitors;
  • pages viewed;
  • browser and device categories;
  • errors;
  • general geographic region; and
  • platform performance.

Where required, optional analytics cookies will be used only after appropriate consent.

11.3 Advertising

We do not use student personal data for targeted advertising or behavioural advertising.

Where the public website uses advertising or campaign measurement technologies for general adult or school outreach, those technologies will not be intentionally used to profile participating children.

Users may manage cookies through their browser settings or through any cookie-preference tool made available on the website.

12. Communications

We may send teachers and schools:

  • account-related notices;
  • masterclass confirmations;
  • schedule changes;
  • platform updates;
  • support responses;
  • student participation information;
  • certificate information; and
  • relevant educational programme information.

We may send students:

  • masterclass access or timing information;
  • assessment-related information;
  • completion information;
  • digital certificate information;
  • hard-copy certificate payment confirmations;
  • delivery updates; and
  • responses to enquiries.

We do not send unrelated commercial marketing messages directly to students unless an appropriate legal basis, notice and consent exist.

Administrative, security, payment, certificate and delivery communications may continue even where a person has opted out of optional promotional messages.

13. Data Security

We use reasonable administrative, technical and organisational safeguards designed to protect personal data against:

  • unauthorised access;
  • accidental loss;
  • misuse;
  • alteration;
  • unauthorised disclosure; and
  • destruction.

These safeguards may include:

  • access controls;
  • password protection;
  • role-based permissions;
  • encryption during transmission;
  • secure hosting;
  • logging and monitoring;
  • backups;
  • software updates;
  • restricted staff access; and
  • service-provider confidentiality requirements.

No online system can be guaranteed to be completely secure. Teachers, schools and other users should protect their login credentials and notify us promptly if they suspect unauthorised access.

Masterclass links should not be posted publicly or shared with people outside the intended school group.

14. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required by applicable law.

Retention depends on the type of information and why it was collected.

Teacher and school accounts

Teacher and school account information may be retained while the account remains active and for a reasonable period afterwards for administration, security, support and record-keeping.

Student registration and participation records

Student registration and participation information may be retained for as long as necessary to:

  • administer the masterclass;
  • confirm attendance;
  • respond to queries;
  • maintain educational records; and
  • manage certificate issuance.

Assessment and certificate records

Assessment completion and certificate records may be retained where necessary to:

  • confirm completion;
  • reissue a certificate;
  • verify certificate authenticity;
  • investigate errors or misuse; and
  • resolve enquiries or disputes.

Where long-term certificate verification does not require all original student information, information may be minimised or separated from the verification record.

Payment and delivery records

Payment, invoice, order and delivery records may be retained for the period required for:

  • payment reconciliation;
  • refunds or disputes;
  • accounting;
  • taxation;
  • fraud prevention; and
  • legal compliance.

Technical and security records

Technical logs may be retained for a reasonable period for security, troubleshooting, fraud prevention and system integrity.

When information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it, unless continued retention is required or permitted by law.

15. International Processing and Storage

Some technology or service providers may process or store information in India or in other countries.

Where personal data is processed outside India, we will take reasonable steps to ensure that:

  • the transfer is permitted under applicable law;
  • the provider uses appropriate security measures;
  • the information is used only for authorised purposes; and
  • contractual or other appropriate protections are applied where required.

16. Your Privacy Rights

Subject to applicable law, a person whose personal data we process may request:

  • confirmation of whether we hold their personal data;
  • access to information about how their data is being processed;
  • correction of inaccurate or misleading data;
  • completion of incomplete data;
  • updating of outdated data;
  • deletion of data that is no longer required;
  • withdrawal of consent where processing is based on consent;
  • information about relevant data-sharing recipients;
  • restriction of optional communications; and
  • grievance redressal.

A parent or lawful guardian may exercise appropriate rights on behalf of a child.

A school or teacher may also contact us concerning student information submitted through that school, but we may require confirmation of authority before disclosing or changing student records.

We may ask for information needed to verify the identity and authority of the person making the request.

A deletion request may not result in immediate deletion where the information must be retained for:

  • certificate verification;
  • an incomplete hard-copy certificate order;
  • payment or delivery disputes;
  • prevention of fraud;
  • legal claims;
  • accounting or tax obligations; or
  • another applicable legal requirement.

Withdrawal of consent does not affect processing that occurred lawfully before the consent was withdrawn.

To exercise a privacy right, contact us using the details in Section 21.

17. Grievances and Complaints

Privacy-related questions or complaints may be submitted to our Privacy Contact.

We will:

  • acknowledge the complaint within a reasonable period;
  • review the circumstances;
  • request further information where required;
  • take reasonable corrective action where appropriate; and
  • communicate the outcome.

Where applicable law gives a person the right to complain to a regulatory authority or the Data Protection Board of India, they may do so after using the grievance process available through iSTEP Mentors, subject to applicable procedures.

18. External Links and Third-Party Services

Our website or masterclass content may contain links to external websites, video platforms, educational resources, payment providers or other third-party services.

Those third parties operate under their own privacy policies and terms. We do not control their independent data-handling practices.

Users should review the privacy information provided by a third-party service before submitting personal data directly to it.

19. Photographs, Videos and Testimonials

We will not publish an identifiable student’s photograph, video, testimonial, school details or achievement for promotional purposes without appropriate permission.

Where the student is under 18, we may require permission from a parent, lawful guardian, participating school or another person authorised to provide that permission, depending on applicable law and the circumstances.

Participation in a masterclass or assessment does not automatically constitute permission for promotional publication.

A person may contact us to request removal of published content, subject to applicable legal considerations and records already lawfully distributed.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

  • changes to the platform;
  • new educational functions;
  • changes to service providers;
  • legal or regulatory developments; or
  • changes to our data-handling practices.

The updated policy will be published on our website with a revised “Last Updated” date.

Where a change materially affects how personal data is processed, we may provide an additional notice through the website, teacher portal, email or another appropriate method.

21. Contact Us

Questions, privacy requests or grievances may be directed to:

Privacy Contact
iSTEP Mentors
A venture of AB Educational Avenues Pvt. Ltd.
Email: info@istepmentors.com
Telephone: +91 99998 05884

Postal Address:
Flat No. 103, Building No. 43
Chiranjeev Towers
Nehru Place
New Delhi – 110019
India

Please include “Privacy Request” or “Privacy Complaint” in the subject line and provide sufficient information for us to identify and respond to the request.

We may request reasonable identity or authority verification before providing access to, correcting or deleting personal data.