THIS PRIVACY POLICY (hereinafter the “Policy”) sets out the manner in which Unknown IITians (hereinafter “the Company”, “We”, “Us” or “Our”), the proprietor and operator of Quiz Space, collects, uses, discloses, retains and safeguards the personal data of persons who access or use the Service. It is published in compliance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023 together with the rules made under that Act (hereinafter collectively the “Data Protection Law”), and it forms part of the Terms of Use. Access to or use of the Service shall be deemed conclusive evidence that the User has read and understood this Policy.
1. Definitions and Interpretation
1.1In this Policy, “Personal Data”, “Data Fiduciary”, “Data Principal”, “Data Processor” and “Personal Data Breach” bear the meanings assigned to them by the Data Protection Law; “Service” means Quiz Space, an online platform for the practice of previous year question papers of the official examination-conducting body, together with its website, practice and mock test facilities and every related service; and “User” or “You” means every person who accesses or uses the Service and who is the Data Principal in respect of the Personal Data concerned. Headings are for convenience only, the word “including” shall be read without limitation, and a reference to a statute includes that statute as amended or replaced from time to time.
2. Scope and Capacity of the Company
2.1In respect of the Personal Data described in this Policy, the Company determines the purpose and means of processing and accordingly acts as the Data Fiduciary. This Policy governs all Personal Data processed by the Company through the Service. It does not extend to the practices of any third party to whose content or services the Service may refer or link, each of which is governed by its own policies and for which the Company accepts no responsibility.
3. Personal Data Collected
3.1The Company collects such Personal Data as the User furnishes. Upon the creation of an account by means of the sign-in procedure provided, the Company receives the User’s name, electronic mail address and profile picture from the sign-in service which the User elects to use, and employs them to establish and identify the account; the electronic mail address is never displayed to other Users. The Company further receives any discussion post, reply or report of error which the User submits, any explanation, board drawing or recording which an educator furnishes, and any correspondence which the User addresses to the Company. Discussion posts and published educator contributions are displayed publicly together with the name and picture of the person who submitted them.
3.2The Company also collects Personal Data generated by the User’s use of the Service, namely the papers attempted, the responses given, the scores obtained, the time expended, the questions flagged or revisited and the progress recorded, for the purpose of presenting results and analysis to the User; technical data, including the internet protocol address, the type of browser and device, the operating system, the pages visited, the referring page and the date and time of access, which is recorded in order to operate, secure and maintain the Service and to detect misuse; and information on the manner in which the Service is used, including the pages visited, the manner of arrival, the type of device and browser, the approximate location and the frequency of search terms, which is employed in aggregate to understand and improve the Service and not to identify any individual.
3.3The Company receives the Personal Data referred to in clause 3.1 from the sign-in service elected by the User, and does not acquire Personal Data concerning the User from data brokers or from any other source.
4. Purposes and Lawful Basis of Processing
4.1The Company processes Personal Data only for lawful purposes, namely: (a) to create and maintain the account and to render the Service to the User; (b) to record attempts and to present results, analysis and progress; (c) to enable discussion and to publish contributions of educators; (d) to respond to the requests, reports and complaints of the User; (e) to protect the security and integrity of the Service and to prevent fraud, abuse and unauthorised access; (f) to understand, in aggregate, the manner in which the Service is used and to improve it; and (g) to comply with Applicable Law and with the orders of any court or competent authority, and to establish, exercise or defend legal claims.
4.2The Company relies upon the consent of the User, which is given by the creation of an account and the use of the Service after notice of the purposes stated in this Policy, and upon such other grounds for processing without consent as the Data Protection Law expressly permits, including compliance with law and the establishment, exercise or defence of legal claims. The Company processes only such Personal Data as is necessary for those purposes. It does not process Personal Data for advertising, does not engage in targeted advertising, and does not sell or let on hire any Personal Data.
5. Consent and Withdrawal
5.1The consent of the User is free, specific, informed, unconditional and unambiguous. The User may withdraw it at any time, with the same ease with which it was given, by written notice to [email protected] or by requesting the deletion of the account in the manner described in section 8. Withdrawal of consent shall not affect the lawfulness of any processing undertaken before its withdrawal, and the User acknowledges that it may render the Company unable to continue to provide those facilities of the Service which depend upon the Personal Data concerned.
6. Disclosure of Personal Data
6.1The Company engages third-party providers to host the Service, to store data, to enable sign-in, to deliver content, to process payments and to measure usage. Each such provider acts as a Data Processor, processes Personal Data solely on behalf of the Company and upon its instructions, and is bound by a contract requiring confidentiality and reasonable security safeguards. The Company remains responsible under the Data Protection Law for Personal Data entrusted to a Data Processor.
6.2Discussion posts and published contributions of educators, together with the name and picture attached to them, are visible to every person who uses the Service. The Company may further disclose Personal Data where it is required to do so by Applicable Law, regulation or lawful process, or where such disclosure is reasonably necessary to protect the rights, property or safety of its Users, the public or the Company, or to prevent, detect or investigate an offence; and, in the event of a transfer, merger or reorganisation of the Service or of its operations, Personal Data may be transferred to the successor, subject to this Policy.
7. Cookies and Similar Technologies
7.1The Service employs cookies which are essential to keep the User signed in and to keep the Service secure, and without which it cannot function properly. It further employs storage upon the User’s own device, which holds such matters as the answers to a paper not yet completed and the User’s recent searches, which remains upon that device, and which the User may clear through the settings of the browser. Cookies may also be set in order to count visits and to understand, in aggregate, the manner in which the Service is used, and the User may block them through the settings of the browser.
7.2Where the Service displays content supplied by a third party, such as a video, that party may collect information and set cookies when the User interacts with that content, in accordance with its own policy and beyond the control of the Company. The Company does not employ advertising cookies.
8. Retention and Erasure
8.1The Company retains Personal Data only for so long as the account remains active, or so long as is necessary to render the Service, to fulfil the purposes stated in this Policy and to discharge its obligations under Applicable Law, whereupon it shall erase the Personal Data or render it anonymous. Where the User requests the deletion of the account, the Company shall delete it, together with the attempts, posts and other associated Personal Data, within thirty days of the request, save for any Personal Data which the Company is required by law to retain, including records of payment which are retained for the period prescribed by tax and accounting law. Published contributions shall be removed upon request in the same manner.
9. Security Safeguards and Breach Notification
9.1The Company maintains reasonable security practices and procedures appropriate to the nature of the Personal Data which it holds, including the encryption of data in transit, access controls, the separation of environments and secure storage. In the event of a Personal Data Breach, the Company shall give intimation to the Data Protection Board of India and to each affected Data Principal in the form and within the time prescribed by the Data Protection Law. The User acknowledges that no method of transmission or of storage is wholly secure, and that the Company cannot warrant absolute security.
10. Transfer Outside India
10.1The Data Processors engaged by the Company may process Personal Data within India and in other countries. The Company transfers Personal Data outside India only to the extent that the Data Protection Law permits, and requires that Personal Data be protected, wherever processed, in a manner consistent with this Policy and with Applicable Law.
11. Rights and Duties of the Data Principal
11.1Subject to the Data Protection Law, the User is entitled: (a) to obtain a summary of the Personal Data processed by the Company and of the processing activities undertaken in respect of it; (b) to obtain the identities of all other Data Fiduciaries and Data Processors with whom the Personal Data has been shared, together with a description of the Personal Data so shared; (c) to request the correction, completion and updating of the Personal Data; (d) to request its erasure, unless its retention is necessary for the purpose for which it was collected or for compliance with law; (e) to withdraw consent at any time, with prospective effect; (f) to have any grievance readily redressed in accordance with section 13; and (g) to nominate another individual to exercise these rights on the User’s behalf in the event of the User’s death or incapacity.
11.2A request under this section shall be made in writing to [email protected] from the electronic mail address associated with the account. The Company may require such information as is reasonably necessary to verify the identity of the requester, and shall respond within the time prescribed by the Data Protection Law. In exercising these rights the User shall comply with Applicable Law, shall not impersonate any other person, shall not suppress any material information when furnishing Personal Data, and shall not lodge any false or frivolous complaint.
12. Children
12.1The Service is intended for persons who have attained the age of eighteen years. A person below that age may use the Service only upon the verifiable consent of a parent or lawful guardian. The Company does not undertake the tracking or behavioural monitoring of children, nor any targeted advertising directed at them, and shall delete forthwith any Personal Data of a child which it discovers it holds without such consent.
13. Grievance Officer
13.1Every question, request and complaint concerning this Policy or the processing of Personal Data shall be addressed to the Grievance Officer of the Company at [email protected], and shall be acknowledged promptly and disposed of within the time prescribed by the Data Protection Law and the Information Technology Act, 2000. A User who is dissatisfied with the response may approach the Data Protection Board of India to the extent that the Data Protection Law makes that remedy available. Every other communication may be addressed to [email protected].
14. Amendment
14.1The Company may revise this Policy from time to time in order to reflect any change in the Service or in Applicable Law. The date stated at the head of this page records the date of the latest revision, and any material revision shall be brought to the User’s notice upon the Service. Continued use of the Service after a revision takes effect shall constitute acceptance of this Policy as revised, and the Company shall seek fresh consent wherever the Data Protection Law so requires.