Privacy Policy
Effective Date: August 3, 2026 | Last Updated: August 3, 2026
1. Introduction & Scope
Om’s Martial Arts & Fitness Studio (“Om’s Academy,” “we,” “us,” or “our”) is the Data Fiduciary (as defined under the Digital Personal Data Protection Act, 2023) for the personal data collected through our website omsacademy.org and our offline services at C6/1, Sandhya Marg, Akruti Apartments, Chitrakoot, Jaipur, Rajasthan 302021, India.
Established in 2009, Om’s Academy offers Taekwondo, Kickboxing, Mixed Martial Arts (MMA), Power Yoga, Self-Defense, and Weight Management programs through offline group classes, personal training, and online live sessions for students aged 5 years and above.
This Privacy Policy (“Policy”) explains how we collect, use, store, share, and protect your personal data — whether you are a website visitor, an enquiring parent, a registered student, or a guardian. This Policy is issued in compliance with:
- The Digital Personal Data Protection Act, 2023 (“DPDP Act”)
- The Digital Personal Data Protection Rules, 2025 (“DPDP Rules”)
- The Information Technology Act, 2000 and the SPDI Rules, 2011 (to the extent applicable)
Important: Under the DPDP Act, you are referred to as the “Data Principal.” This Policy, together with our Terms & Conditions, constitutes the notice required under Section 5 of the DPDP Act.
2. Consent — How and Why We Ask
In accordance with Section 6 of the DPDP Act, we process your personal data only with your consent that is:
- Free — not coerced or bundled as a condition for unrelated services
- Specific — given for clearly identified and stated purposes
- Informed — you know exactly what data we collect and why
- Unconditional — not dependent on acceptance of unrelated terms
- Unambiguous — demonstrated through a clear affirmative action (e.g., ticking a checkbox, signing a form, clicking “I Agree”)
How we obtain consent:
- Online: Through explicit opt-in checkboxes on enquiry forms, registration pages, and cookie banners. Pre-ticked boxes are not used.
- Offline: Through signed physical enrollment forms, waiver documents, and media consent forms at the academy.
- For Minors (under 18): We obtain verifiable parental/guardian consent as required under Section 9 of the DPDP Act. This includes verifying the identity and relationship of the parent/guardian through government-issued ID at the time of enrollment.
Withdrawal of Consent: You may withdraw your consent at any time. The ease of withdrawal is comparable to the ease with which consent was given (Section 6(4)). Simply email us at omsfitness@gmail.com or inform your coach in writing. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Consent Manager: Under Section 6(7) of the DPDP Act, you may also give, manage, review, or withdraw your consent through a registered Consent Manager, once such frameworks are operational.
3. Information We Collect
We adhere to the principles of data minimization and purpose limitation — we collect only the data that is necessary for the specific, stated purpose.
(a) Personal & Identity Information
- Full name, date of birth, age, and gender
- Phone number, email address, and residential address
- Emergency contact name, relationship, and phone number
- Photograph for identity records (student ID, if applicable)
- Government-issued ID details of parent/guardian (for minor verification only)
(b) Health & Medical Information
- Medical history relevant to physical training (allergies, past injuries, chronic conditions, medications)
- Fitness declaration and physician clearance (if requested)
- Parent/guardian health declaration for minors
(c) Payment & Billing Information
- Payment is processed securely through third-party payment gateways (Razorpay, UPI, bank transfer, or cash at academy).
- We do NOT store your credit/debit card numbers, CVV, UPI PIN, or banking passwords. All financial data is handled directly by our payment service providers in compliance with PCI-DSS standards.
- We retain only transaction references (transaction ID, amount, date, payment method) for receipt and accounting purposes.
(d) Training & Participation Data
- Class attendance records and batch preferences (morning/evening/online)
- Training progress, belt rank, and assessment records
- Competition/tournament participation details and performance notes
- Signed waiver, consent, and indemnity forms (physical or digital)
(e) Media & Content
- Photographs and videos taken during classes, events, belt ceremonies, or competitions — only with your explicit prior written consent (or parental consent for minors)
- Testimonials, feedback, or reviews voluntarily provided by you
- EXIF Warning: If you upload images to our website or send them via WhatsApp, please ensure they do not contain embedded location data (EXIF GPS). Recipients may be able to extract location data from such images.
(f) WhatsApp & Communication Data
- When you message us on WhatsApp, your phone number, message content, and any shared media are processed by WhatsApp (Meta Platforms, Inc.) under their own privacy policy. We access this data solely to respond to enquiries, confirm bookings, and send class-related updates.
- WhatsApp may collect your IP address, device information, and usage data. We encourage you to review WhatsApp’s Privacy Policy.
- Note: WhatsApp/Meta servers may be located outside India. Please see Section 9 (Cross-Border Data Transfers) below.
(g) Website Technical Information
- IP address, browser type and version, operating system, device type
- Pages visited, time spent, referring URL, and navigation path
- Cookies and similar tracking technologies (see Section 5)
- Approximate location data (city-level, if provided by your browser)
(h) Enquiry Form Data
- When you fill out an enquiry or “Book Free Trial” form, we collect: your name, phone number, student’s age (if applicable), and the source page. This data is used solely to contact you regarding your enquiry and is shared only with authorized staff.
4. How We Use Your Information (Purpose of Processing)
We use your personal data only for the following specific, legitimate purposes:
- To register students, manage class schedules, batch assignments, and attendance
- To ensure student safety through emergency contact information and medical history
- To process fee payments, issue receipts, and manage membership records
- To track training progress, belt promotions, and provide personalized coaching
- To maintain waivers, consents, and indemnity forms required for martial arts/fitness activities (which carry inherent risk of injury)
- To create promotional content (photos, videos, testimonials) — only with your explicit prior consent
- To communicate class schedules, batch changes, holidays, events, and notices via WhatsApp, SMS, email, or phone
- To respond to enquiries and assist with admissions
- To improve our programs, website, and customer experience
- To comply with applicable laws, regulations, legal processes, or governmental requests
- To protect the rights, safety, and property of Om’s Academy, students, staff, and the public
- To resolve disputes, enforce our Terms, and prevent fraud or misuse
We do NOT use your data for:
- Automated decision-making or profiling that significantly affects you
- Behavioral monitoring or targeted advertising directed at children (as prohibited under DPDP Rules 2025)
- Selling, renting, or trading to third parties for marketing purposes
5. Cookies & Tracking Technologies
Our website uses cookies and similar technologies. We categorize them as follows:
- Essential Cookies: Necessary for website functionality (session management, form submissions). These do not require consent.
- Analytics Cookies: We use Google Analytics to understand website traffic, popular pages, and user behavior. This data is aggregated and anonymized and does not personally identify you. These are loaded only after you provide consent via our cookie banner.
- Third-Party Cookies: Embedded content (Google Maps, YouTube, WhatsApp widget, social media plugins) may set their own cookies. We do not control these. Please review the respective privacy policies of these services.
Your Choices: You can manage or disable cookies through your browser settings or our cookie consent banner. Disabling essential cookies may affect website functionality. For more information, visit allaboutcookies.org.
6. Third-Party Services & Data Processors
We engage trusted third-party Data Processors (as defined under the DPDP Act) to support our operations. These include:
- Payment Processors: Razorpay, UPI platforms, or bank gateways for secure fee collection
- Website Hosting: Secure cloud servers (e.g., Hostinger, AWS, or similar)
- Analytics: Google Analytics (Google LLC) for website usage analysis
- Communication: WhatsApp Business (Meta Platforms, Inc.), SMS gateways, and email services
- Cloud Storage: Google Drive or similar for storing training records and media securely
- Website Platform: WordPress CMS for content management
All Data Processors receive only the minimum information necessary to perform their specific functions. They are bound by contractual data protection obligations. We do not sell, rent, or trade your personal information to any third party.
7. Data Sharing & Disclosure
We share your personal data only in the following limited circumstances:
- Internal: With authorized coaches, instructors, and admin staff on a need-to-know basis. All staff are bound by confidentiality obligations.
- Parents/Guardians of Minors: Attendance, progress, and relevant communication shared with the child’s parent/guardian.
- Data Processors: As described in Section 6, under contractual protection.
- Legal Requirements: When required by law, court order, government authority, or regulatory body (including the Data Protection Board of India).
- Safety & Emergencies: To protect the health, safety, or property of any person — including sharing medical information with emergency responders in case of injury during training.
- With Your Consent: For promotional materials, testimonials, competition results, or any other purpose you explicitly agree to.
- Business Transfers: In the event of merger, acquisition, or sale of assets, your data may be transferred, subject to continued protection under this Policy.
8. Data Retention & Erasure
We retain personal data only for as long as the specified purpose is being served, or as required by law. Our retention schedule:
- Student Registration & Medical Records: Duration of enrollment + 3 years (for medical liability, injury claims, and reference)
- Payment & Financial Records: 7 years from the end of the relevant financial year (as required under Income Tax Act, GST laws)
- Waivers & Consent Forms: Duration of enrollment + 3 years (critical for liability protection)
- Media Content (Photos/Videos): Until consent is withdrawn in writing, or until no longer needed for the stated purpose
- Website Enquiry Data: 1 year from date of enquiry (deleted unless converted to enrollment)
- Website Analytics Data: 26 months in anonymized form (Google Analytics default)
- System & Processing Logs: Minimum 1 year (as required under DPDP Rules 2025, Rule 6, for security detection and investigation)
- WhatsApp Communication: We do not independently store WhatsApp messages beyond what WhatsApp retains. Relevant booking confirmations may be noted in internal records.
Erasure Process:
- Upon withdrawal of consent or fulfillment of purpose, we will erase your personal data unless retention is required by law.
- Where applicable, we will notify you at least 48 hours before scheduled erasure of your data (as per DPDP Rules 2025).
- We will also instruct our Data Processors to erase any personal data made available to them for processing.
- You may request early deletion at any time (subject to legal retention requirements) by emailing omsfitness@gmail.com.
9. Cross-Border Data Transfers
Some of our third-party service providers (e.g., WhatsApp/Meta, Google Analytics, cloud hosting providers) may store or process data on servers located outside India.
- Under Section 16 of the DPDP Act, personal data may be transferred outside India unless the Central Government has specifically restricted transfer to that country or territory (the “negative list” approach).
- We ensure that any cross-border transfer is conducted in compliance with applicable Indian laws and that adequate safeguards are in place through contractual obligations with our service providers.
- If you use WhatsApp to communicate with us, your data is subject to Meta’s global data processing practices. We recommend reviewing WhatsApp’s Privacy Policy for details on international data transfers.
- We do not transfer your data to any country that has been notified as restricted by the Government of India.
10. Your Rights as a Data Principal
Under the DPDP Act (Sections 11–14) and DPDP Rules 2025, you have the following rights:
- Right to Access (Section 11): You may request a summary of your personal data being processed, the processing activities, and the identities of all Data Fiduciaries/Processors with whom your data has been shared.
- Right to Correction & Erasure (Section 12): You may request correction of inaccurate data, completion of incomplete data, updating of outdated data, or erasure of your personal data (subject to legal retention requirements).
- Right to Grievance Redressal (Section 13): You have the right to raise grievances regarding our handling of your data. You must first approach us through our grievance mechanism (Section 14 below) before approaching the Data Protection Board.
- Right to Nominate (Section 14): You may nominate an individual who shall exercise your rights under the DPDP Act in the event of your death or incapacity. To nominate, email us with the nominee’s name, relationship, and contact details.
- Right to Withdraw Consent: At any time, with the same ease as it was given. Withdrawal does not affect prior lawful processing.
- Right to Object: You may object to processing for direct marketing or promotional communications at any time.
How to Exercise Your Rights:
Email us at omsfitness@gmail.com with the subject line “Data Rights Request — [Your Name]”. We will respond within 90 days of receiving your verified request, as prescribed under the DPDP Rules 2025. We may verify your identity before processing your request.
11. Grievance Redressal & Complaints
In compliance with Section 8(10) and Section 13 of the DPDP Act, we have established the following grievance redressal mechanism:
Designated Grievance Officer / Data Protection Contact:
👤 Name: [Name of Designated Person]
📧 Email: omsfitness@gmail.com
📞 Phone: +91 96360 02244
📍 Address: C6/1, Sandhya Marg, Akruti Apartments, Chitrakoot, Jaipur, Rajasthan 302021
⏱️ Response Time: Within 90 days of receipt of grievance
Escalation to the Data Protection Board of India:
If you are not satisfied with our response, or if we fail to respond within the prescribed period, you may file a complaint with the Data Protection Board of India (DPBI) through their online portal. As per Section 13(3), you must first exhaust our internal grievance mechanism before approaching the Board. Appeals against Board decisions lie with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
12. Data Security & Breach Notification
Security Safeguards:
In compliance with Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules 2025, we implement reasonable technical and organizational security safeguards, including:
- Encrypted connections (HTTPS/SSL) for all website traffic
- Password-protected, role-based access to digital records
- Restricted access — only authorized staff can view student data
- Physical security of paper records (locked storage at academy premises)
- Encryption and access controls for cloud-stored data
- Retention of system and processing logs for a minimum of 1 year
- Regular review and updating of security practices
Data Breach Notification:
In the unlikely event of a personal data breach, in compliance with Section 8(6) and Rule 7 of the DPDP Rules 2025:
- We will notify the Data Protection Board of India within 72 hours of becoming aware of the breach, with a detailed report.
- We will notify each affected Data Principal without delay, providing details of the breach, likely consequences, and recommended mitigating steps.
- We will take immediate action to contain and remediate the breach.
Disclaimer: While we implement robust safeguards, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security. You are also responsible for safeguarding any credentials you use to interact with our services.
13. Children’s Privacy (Special Protections)
Om’s Academy welcomes students from age 5. We treat children’s data with the highest level of care as mandated by Section 9 of the DPDP Act and the DPDP Rules 2025:
- We obtain verifiable parental/guardian consent before collecting or processing any personal data of a child (under 18). This includes verifying the parent’s/guardian’s identity and relationship through government-issued ID.
- Parents/guardians have full rights to access, review, correct, or request deletion of their child’s data at any time.
- Emergency contact and medical information for minors is shared only with authorized staff who directly interact with the child during training.
- We do NOT use children’s data for any purpose beyond enrollment, safety, training, and parent/guardian communication.
- Photographs/videos of minors are taken and used only with prior written parental consent.
- We do NOT engage in behavioral monitoring, profiling, or targeted advertising directed at children (as expressly prohibited under DPDP Rules 2025).
- We do not knowingly collect personal data from children under 13 through our website without verifiable parental consent.
- If we discover that a child’s data was collected without proper parental consent, we will delete it promptly.
14. Embedded Content from Other Websites
Our website may include embedded content (Google Maps, YouTube videos, social media embeds, WhatsApp chat widget). When you interact with such content:
- It behaves as if you have visited the third-party website directly.
- These websites may collect data about you, set cookies, embed tracking, and monitor your interaction — especially if you are logged into their service.
- We do not control their data practices. Please review their respective privacy policies.
15. Our Accountability & Compliance Commitment
As a Data Fiduciary under the DPDP Act, we acknowledge and commit to the following obligations under Section 8:
- We are responsible for compliance with the DPDP Act and Rules in respect of all processing undertaken by us or on our behalf by any Data Processor — irrespective of any agreement to the contrary.
- Where personal data is used to make a decision that affects you, or is disclosed to another party, we ensure its completeness, accuracy, and consistency.
- We implement appropriate technical and organizational measures for effective observance of the Act.
- We publish the contact information of our designated person (Section 11 above) who can answer questions about our processing of your data.
- We maintain an effective grievance redressal mechanism.
- We erase personal data when the purpose is no longer served or upon withdrawal of consent, unless retention is required by law.
Penalties for Non-Compliance: We acknowledge that the DPDP Act imposes penalties of up to ₹250 crore for failure to prevent a personal data breach, up to ₹200 crore for non-compliance with children’s data provisions, and up to ₹150 crore for failure to fulfill other Data Fiduciary obligations. We take these obligations seriously.
16. Changes to This Privacy Policy
We may update this Policy to reflect changes in our practices, applicable laws, or operational requirements:
- The “Last Updated” date at the top will be revised with each change.
- Material changes (e.g., new data categories, new purposes, changes to sharing practices) will be communicated via a prominent notice on our website, WhatsApp broadcast, or email at least 15 days before taking effect.
- Where required, we will seek your fresh consent for any new or changed purpose of processing.
We encourage you to review this Policy periodically. Your continued use of our services after changes constitutes acceptance of the updated Policy.
17. Contact Us
For any questions, concerns, data rights requests, consent withdrawal, grievances, or complaints regarding this Privacy Policy or our handling of your personal data, please contact us:
Om’s Martial Arts & Fitness Studio
📍 Address: C6/1, Sandhya Marg, Akruti Apartments, Chitrakoot, Jaipur, Rajasthan 302021, India
📧 Email: omsfitness@gmail.com
📞 Phone: +91 96360 02244
🌐 Website: omsacademy.org
⏱️ We aim to respond to all queries within 48 business hours and resolve data rights requests within 90 days.
This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000. For the full text of the DPDP Act, visit meity.gov.in. For complaints, visit the Data Protection Board of India’s portal once operational.
