Privacy Policy for Parents and Instructors

1.Parties, scope and roles

1.1This agreement is issued by HobbyDoor Private Limited (HobbyDoor, Company, we, us) for its platform and related at-home hobby class services as actually operated and confirmed above.

1.2Parent/Customer means an adult booking a class or managing a learner profile. Child/Learner means an individual under 18. Instructor means a tutor applying to or providing services through HobbyDoor. Processor means an entity processing personal data on HobbyDoor's behalf and instructions. Data Principal and Data Fiduciary have the meanings given by the DPDP Act when applicable.

1.3HobbyDoor will identify its legal role from the actual facts for each processing activity. A vendor is a Processor only to the extent it processes data on HobbyDoor's behalf and instructions. An Instructor's role depends on the actual processing and law; this agreement does not determine status by label.

1.4This document covers data used for accounts, class booking/delivery, safety, payments/payouts, support, quality, security, compliance and dispute handling, limited to disclosed, lawful purposes.

2.Indian law and phased commencement

2.1Applicable laws include the Digital Personal Data Protection Act, 2023 (DPDP Act) and Digital Personal Data Protection Rules, 2025 (DPDP Rules), only to the extent each provision is in force and applies; Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020 as amended; Information Technology Act, 2000; Bharatiya Sakshya Adhiniyam, 2023; Protection of Children from Sexual Offences Act, 2012 (POCSO); and other applicable laws.

2.2As at 6 October 2026, DPDP commencement is phased. Under G.S.R. 843(E) of 13 November 2025, the first listed provisions commenced on publication; DPDP Act sections 6(9) and 27(1)(d) are scheduled one year later; and the principal processing duties/rights provisions listed in the notification are scheduled eighteen months later (13 May 2027). Under G.S.R. 846(E), DPDP Rules 1, 2, 17-21 commenced on publication; Rule 4 is scheduled after one year (13 November 2026);

Rules 3, 5-16, 22-23 after eighteen months (13 May 2027). Check later amendments, corrigenda, exemptions and commencement notices before relying on dates.

2.3This agreement does not postpone any other duty already in force. Before each future provision applies, HobbyDoor will update its notice and workflow as required. Where mandatory law conflicts with this agreement, law prevails.

3.Shared privacy commitments

Use personal data only for a stated lawful purpose and to the extent reasonably necessary. Keep service, safety, legal compliance, optional photography and marketing purposes distinct.

Limit access to authorised people with a need to know. Use appropriate safeguards, which may include access controls, authentication, encryption/masking, logs, backups and incident response. The Company must implement a control before representing it as an existing feature.

Do not sell or rent personal data for another party's own use. Give Instructors and service providers only the data reasonably needed for a confirmed class or defined service.

Do not use children's data for targeted advertising or behavioural tracking, or process it in a way prohibited by law or likely to harm a child, except where a specific legal exemption applies. Check the legal basis, notice, consent, retention and transfer requirements for each use. Do not bundle optional consent with necessary service choices.

4.Incidents and breach response

4.1Anyone discovering suspected loss, unauthorised access, disclosure, alteration or misuse must promptly notify the Company through its monitored channel: [support@hobbydoor.com]. HobbyDoor will contain, assess, document, investigate, mitigate, preserve relevant evidence and decide notifications under each applicable law and contract.

4.2When DPDP Rule 7 is in force and applies, the Data Fiduciary must notify affected Data Principals without delay and notify the Board without delay; detailed information is due within 72 hours of awareness unless the Board allows longer on written request. This timeline is not represented as operative before its commencement. Separately assess any CERT-In, POCSO, consumer, sectoral, authority or contractual duty.

4.3The Instructor's one-hour internal incident report is only a contractual target if a monitored route exists; it does not replace or delay a direct legal report. Vendors must notify HobbyDoor without undue delay and quickly enough to support statutory deadlines.

5.Retention and deletion

5.1Retain data only for its documented purpose and applicable legal, accounting, safety, dispute, fraud-prevention or evidence need. Use the completed Schedule 2. Source proposals (including 90 days for some photos, one year for some logs and multi-year screening/safety periods) are not confirmed facts or adopted periods here.

5.2Before publication, assign each category a period, trigger, owner, deletion method, processor/backup treatment and legal-hold process. A hold must be limited to relevant records, access restricted, reason/approver recorded, periodically reviewed and released when no longer needed.

6.Grievances and consumer rights

6.1Publish a live grievance route and respond within applicable legal timelines. Where the Consumer Protection (E-Commerce) Rules apply, their grievance requirements apply. Under the 2020 Rules these include acknowledgement within 48 hours and redress within one month; check amendments and effective dates before implementing updated procedures.

6.2The Consumer Protection (E-Commerce) Amendment Rules, 2026 are scheduled to take effect on 1 January 2027. Before then, assess HobbyDoor's classification and implement applicable requirements, including giving consumers a copy of complaints recorded by the grievance officer; National Consumer Helpline convergence; seller/service disclosures; non-misleading search results; prominent sponsored-listing labels; displaying both reduced and prior prices (the lowest offered during the preceding 30 days); compliance with the 2023 dark-pattern guidelines, annual self-audit and displayed compliance certificate; affirmative consent for specified use of consumer data; and restrictions on bundled fees. Apply each only to the extent the final Gazette provision covers HobbyDoor's actual service and marketplace model.

6.3Nothing here waives a consumer right, statutory remedy or liability that cannot lawfully be excluded. Customer cancellation/refund terms belong in customer terms, must be disclosed before purchase and should be proportionate.

7.Parent and child information

7.1Subject to actual collection and necessity, HobbyDoor may process Parent name, mobile, email, account/authentication records, class address/map pin, booking history/schedule, preferences, support/WhatsApp messages, payment transaction/invoice information, ratings, reviews, complaints and device/IP/security logs.

7.2Child data should ordinarily be limited to first name/nickname, full birth date, age/age band, hobby/skill information, relevant safety/accessibility details voluntarily supplied, class reports and authorised photos. Do not ordinarily require a child's school, personal phone/email, or government ID without a lawful, stated need.

7.3. A Parent must provide accurate information and have authority to provide the child's data and consent where required, and notify HobbyDoor if authority changes.

8.Consent, photographs and recordings

8.1Where consent is the applicable basis, provide a clear notice identifying data, purpose, service and withdrawal method. When DPDP Act sections 5, 6 and 9 and DPDP Rule 10 apply, obtain verifiable parental consent before processing child data using the method Rule 10 requires. A checkbox/declaration is not a substitute where Rule 10 requires verification. Do not name DigiLocker or another provider as in use unless contracted, implemented and tested.

8.2Keep service consent separate from optional child-photo and marketing choices. Optional choices must be off by default. Collect an identifiable child photo for class verification only with separate specific consent or another applicable lawful basis. Do not use an identifiable child photo for marketing without separate specific consent.

8.3Do not intentionally record class audio/video unless separate lawful notice, consent and process exist. Verification photos should focus on class setup and avoid a child's face/identifying features where practicable. If a child is unintentionally identifiable without required permission, restrict access and delete/replace promptly unless a documented safety, legal or evidence hold applies.

8.4Withdrawal stops future processing based on consent, subject to processing required or authorised by another lawful basis or law. If required child-data consent is withdrawn, HobbyDoor may be unable to continue the child profile or service and will explain the effect.

9.Instructor access and safety disclosures

9.1For a confirmed class, the assigned Instructor may receive only data reasonably needed: learner first name, age band, hobby/skill, schedule, class location and relevant safety/accessibility data. Home-address access should end once no longer needed. Do not expose parent/child personal phone numbers unless necessary and lawfully disclosed.

9.2Data may be disclosed to a parent/guardian, police, Special Juvenile Police Unit, child-protection authority, court, emergency service or competent authority when required/permitted by law or reasonably necessary to address serious safety risk. Limit disclosure to what is necessary. Do not notify someone if that increases risk or conflicts with a lawful direction.

10.Parent/Guardian acceptance

legally authorised to provide the child's information and consent where required.

marketing by selected channels. Optional consent may be withdrawn using the published contact route.

11.Instructor data

11.1Subject to actual collection and necessity, HobbyDoor may process Instructor name, phone, email, photo, city/service area, skills, certificates, portfolio/demo notes, identity verification, police/background checks/references, bank/UPI and payout records, check-in/out location, class reports, ratings, complaints and verification photos. Do not store full Aadhaar numbers or unnecessary ID copies. Use a lawful, proportionate verification method and accurately describe it.

11.2Purposes include application/onboarding, identity and child-safety verification, assessment, profile/matching, class coordination, check-in/out, payment/payout, complaints, security, legal compliance and records. Public-profile marketing is a separate optional choice.

11.3Retention is governed by completed Schedule 2, Confirm periods for applicants, background records, payout data, location data and safety complaints against actual systems and applicable law.

12.Instructor obligations

Use family address/details only for a confirmed class and lawful safety duties. Do not store family data on a personal device unless authorised and necessary; delete/return it when no longer needed and at the end of the class series, subject to a legal hold.

Do not privately contact a family/child outside authorised channels, solicit personal social handles, market to them, post about them/their home/their child, or disclose their data.

Do not record audio/video or photograph a child outside an authorised, consented process.

Verification photos should show setup and avoid the child's face where practicable.

Promptly report child-safety concerns through the monitored route. Do not investigate, repeatedly question the child, confront a suspected offender, promise secrecy or delay urgent protection. A person with knowledge of or reasonable apprehension of a POCSO offence must report under POCSO section 19 to the Special Juvenile Police Unit or local police. Internal reporting never replaces that duty. Section 21 provides penalties for failure to report/record in specified circumstances. Preserve the child's words and relevant evidence; share only for protection/legal reporting.

Immediately report suspected personal-data loss, access, disclosure or misuse. The one-hour internal target applies only if a monitored channel exists and does not replace direct statutory duties.

Do not retaliate against a child, Parent, witness or reporter. HobbyDoor may suspend child-facing assignments/restrict access to protect a child or preserve evidence, with review and reasons as appropriate. Any payout hold/adjustment must be lawful, agreed, evidence-based and proportionate; undisputed sums are not automatically forfeited.

13.Instructor rights and acceptance

Use the privacy contact to request information, correction, erasure or withdrawal where the right is in force and applies. Requests may be verified. Data may be retained where required by law, safety, dispute, tax/accounting or evidence duties.