Privacy Policy

1. Who We Are and How to Reach Us

NextGen InnovateLabs Pvt. Ltd. is a company based in Hyderabad, Telangana, India, offering online courses in Artificial Intelligence, Generative AI, and emerging technologies to learners of all age groups.

For the personal data we collect through the Services, we act as the Data Fiduciary (the entity that decides why and how your data is processed) under the DPDP Act.

If you have questions about this policy or your data, or wish to exercise your rights, contact us at:

Email: contact@nextgenlab.in

We have designated a contact point for privacy queries. You may address your communication to the "Data Protection Contact" / Grievance Officer at the email above. Where the DPDP Act requires the appointment of a Data Protection Officer or the publication of their contact details, we will update this policy accordingly.

2. The Personal Data We Collect

We collect only the data we need to provide and improve the Services. Depending on how you interact with us, this may include:

Identity and contact data: your full name, email address, phone number, and (if provided) your organization, school, or city. For learners who are children, we also collect a parent or guardian's name and contact details.

Account and enrolment data: the course(s) you register for, your learning progress, submissions, projects, and any certificates issued.

Payment data: information needed to process course fees, such as transaction amount, payment status, order reference, and the last few digits of a card or UPI/payment instrument as returned by our payment processor. We do not store full card numbers, CVV, or banking passwords; these are handled directly by our payment gateway.

Communications data: messages you send us through our contact form, email, or support channels, including the contents of your enquiry.

Usage and technical data: information collected automatically when you visit our website, such as IP address, browser type, device and operating system, pages viewed, referring URLs, and approximate location. See Section 9 on cookies.

We do not intentionally collect special or sensitive categories of data and ask that you do not send them to us unless necessary.

3. How We Collect Your Data

We collect personal data in the following ways:

Directly from you, when you fill in our contact form, register for or purchase a course, communicate with us, or subscribe to updates.

From a parent or guardian, when they enrol a child or provide consent on the child's behalf.

Automatically, through cookies and similar technologies when you use our website (see Section 9).

From service providers, such as our payment gateway, which confirms the status of a transaction, and analytics providers that report aggregated usage.

Where we ask for data and you choose not to provide it, we may be unable to deliver part of the Services (for example, we cannot enrol a participant without their name, contact details, and payment).

4. Why We Use Your Data and Our Legal Basis

Under the DPDP Act, we process personal data only for lawful purposes, either with your consent or for certain legitimate uses permitted by law. We use your data to:

Provide the Services: create and manage enrolments, deliver course content, track progress, issue certificates, and provide support.

Process payments: collect course fees and applicable GST, issue invoices and receipts, and handle refunds where applicable.

Communicate with you: respond to enquiries, send service messages (such as enrolment confirmations and schedule changes), and, where you have consented, send newsletters and information about new programs.

Improve and secure the Services: understand how our website and courses are used, troubleshoot problems, prevent fraud and misuse, and keep our systems safe.

Comply with law: meet tax, accounting, regulatory, and legal obligations, and respond to lawful requests from authorities.

We ask for your consent at the point of collection (for example, through a clear consent notice when you enrol or subscribe). You can withdraw consent at any time as described in Section 7; withdrawing consent does not affect processing already carried out, and may limit our ability to provide the Services.

5. Children's Data and Parental Consent

Our programs are open to participants of all age groups, and some of our learners are children (in India, individuals under 18). Where a participant is a child, we treat their data with extra care.

Verifiable parental consent: Before we knowingly process the personal data of a child, we obtain the verifiable consent of a parent or lawful guardian, as required by the DPDP Act. During enrolment we ask for confirmation that a parent or guardian consents and provide them with this policy. A child should not enrol or submit personal data without involving a parent or guardian.

No tracking or targeted advertising of children: We do not undertake tracking or behavioural monitoring of children, and we do not direct targeted advertising at children.

No processing likely to harm a child: We do not process children's data in a manner that we assess is likely to cause a detrimental effect on the well-being of a child.

Minimal collection: We collect only the data needed for a child to take part in a program and to communicate with their parent or guardian.

Parental rights: A parent or guardian may review, correct, or request deletion of their child's data, and may withdraw consent, by contacting us at contact@nextgenlab.in. If we learn that we have collected a child's data without the required parental consent, we will delete it promptly.

6. How We Share Your Data

We do not sell your personal data. We share it only as needed to run the Services and as described below:

Service providers (Data Processors): companies that process data on our behalf and under contract, such as payment gateways, cloud hosting and storage providers, email and communication tools, course-delivery or video platforms, and analytics providers. They may use the data only for the purposes we specify and must protect it.

Professional advisers: such as accountants, auditors, and legal counsel, where reasonably necessary.

Legal and regulatory bodies: where required to comply with law, a court order, or a lawful request, or to establish, exercise, or defend legal claims.

Business transfers: if we are involved in a merger, acquisition, financing, or sale of assets, your data may be transferred as part of that transaction, subject to this policy.

We require the parties we share data with to keep it confidential and secure.

7. Your Rights

Subject to the DPDP Act and other applicable laws, you have the following rights over your personal data:

Right to access: obtain a summary of the personal data we hold about you and how we process it.

Right to correction and updating: ask us to correct inaccurate or misleading data and complete incomplete data.

Right to erasure: ask us to delete personal data that is no longer needed for the purpose it was collected, unless we are required to retain it by law.

Right to withdraw consent: withdraw consent for processing that is based on consent, at any time, as easily as it was given.

Right of grievance redressal: raise a complaint with us about how we handle your data (see Section 11).

Right to nominate: nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any right, contact us at contact@nextgenlab.in. We may need to verify your identity before acting. For a child's data, requests should come from the parent or guardian. We will respond within the timelines required by applicable law.

8. Data Storage, Security, and Retention

Storage and location: We store personal data on secure servers operated by us or our cloud service providers. Our data may be hosted in India or in other countries; where data is processed outside India, we take steps to ensure it is handled consistently with this policy and applicable law, and we do not transfer data to any jurisdiction restricted by the Government of India.

Security: We use reasonable technical and organisational safeguards to protect personal data against unauthorised access, alteration, disclosure, or loss. These include access controls, encryption in transit where appropriate, and limiting access to staff and processors who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification: If a personal data breach occurs, we will take steps to contain it and will notify affected individuals and the Data Protection Board of India where required by the DPDP Act.

Retention: We keep personal data only for as long as needed to fulfil the purposes in this policy, including to provide the Services, maintain records of enrolment and certification, and meet legal, tax, and accounting obligations. When data is no longer needed, we delete it or anonymise it. Payment and invoice records may be retained for the period required under Indian tax and company law.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies to function properly, remember your preferences, and understand how the site is used.

We broadly use: essential cookies, which are necessary for the site to work; preference cookies, which remember your settings; and analytics cookies, which help us measure and improve performance. We may use third-party analytics tools that set their own cookies.

You can control or delete cookies through your browser settings, and you can decline non-essential cookies where we offer that choice. Blocking some cookies may affect how the website works. For more detail, please see our Cookie Policy.

10. Third-Party Links and Services

Our website and course materials may contain links to third-party websites, tools, or platforms (for example, code repositories, deployment services, or payment pages). We provide these for convenience and do not control them.

This Privacy Policy does not apply to third-party services. We are not responsible for their content or privacy practices. We encourage you to read the privacy policies of any third-party service before providing personal data to it.

11. Grievance Redressal and Complaints

If you have a concern or complaint about how we handle your personal data, please contact us first so we can try to resolve it:

Data Protection Contact / Grievance Officer NextGen InnovateLabs Pvt. Ltd. Email: contact@nextgenlab.in

We will acknowledge your complaint and respond within the timelines required by applicable law. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India under the DPDP Act.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you by email or through the Services.

We encourage you to review this policy periodically. Your continued use of the Services after an update means you accept the revised policy, except where we are required to obtain fresh consent.