Privacy notice

Bright Pines Foundation (“we”, “us”) is a non-profit organisation based at A-91 Shivalik, Malviya Nagar, New Delhi 110017, India. We run AI education programmes for schools, colleges and universities in India.

For the personal data described in this notice, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). This notice applies to this website, brightpinesindia.org, and to enquiries you send us.

Our website is meant for staff of schools, colleges and universities. We collect only the following:

• School workshop request form: school name, your name, your role, phone number, email address, city, board, school type, the workshop you choose, approximate number of students, preferred format and month, and any message you write.
• College programme request form: college or university name, your name, your role, phone number, email address, city, type of institution, which students (undergraduate or postgraduate), the programme you are interested in, approximate number of students, preferred format and month, and any message you write.
• Calls, WhatsApp messages and emails: your phone number or email address, and whatever you choose to tell us.
• Campaign tags: if you arrived from one of our links, the campaign name in that link (for example, which email or post it came from) is saved with your form.
• Technical data: when you visit, our hosting provider processes your IP address, browser type and the pages requested, to deliver the website and keep it secure.

We do not ask for, and ask you not to send, sensitive information such as identity documents, bank details or health information.

This website is not meant for children and does not collect personal data from students.

In school workshops we do not collect personal data from students. Where a school or college asks us to issue certificates, it may share students' names with us. We use those names only to prepare the certificates, on the institution's behalf and under its instructions, and delete them once the certificates are issued.

We use your personal data only for these purposes:

• to reply to your request and contact you about it;
• to understand your institution's needs and prepare a written proposal;
• to schedule and run the programme, and issue certificates and a report;
• to keep the records Indian law requires, such as accounting and tax records; and
• to keep this website secure and prevent misuse.

We will not use your data for any other purpose, such as unrelated marketing, without asking for your consent first.

Before you submit a request form, we ask you to tick a box agreeing to us using your details for the purposes above. That is your consent under section 6 of the DPDP Act. Submitting the form is not possible without it, and we keep a record of when each form was submitted.

When you call, message or email us, you provide your details voluntarily so that we can respond, which the DPDP Act allows under section 7.

You can withdraw your consent at any time, as easily as you gave it, by writing to us (see section 10). Withdrawing consent does not affect anything we did before you withdrew it. After you withdraw it, we stop using your data and delete it, unless the law requires us to keep it.

We share your data only with the service providers we need to run our work, and only for the purposes above:

• Website hosting: our website is built and hosted through Lovable.
• Database: form submissions are stored in a secure cloud database provided by Supabase, through Lovable Cloud.
• Email, phone and messaging: our email provider, phone and WhatsApp (operated by Meta) when you contact us that way.
• Notifications: when a form is submitted, a copy of the request may be sent to our team's email through an automation tool.

These providers may store data on servers outside India. The DPDP Act allows this, except to countries the Government of India restricts, and we will follow any such restriction. We never sell your data or share it with anyone for advertising.

We may disclose personal data if the law requires it, for example to comply with a lawful request from a government authority.

• If we do not go on to work together, we delete your enquiry one year after our last contact with you.
• If we work together, we keep your details for as long as the engagement lasts, and then for as long as Indian law requires us to keep business records.
• Technical logs are kept for at least one year, as the DPDP Rules, 2025 require for security purposes, and then deleted.

You can ask us to delete your data sooner (see section 9).

All traffic to this website is encrypted (HTTPS). Our database is set up so that the public website can only add new requests; it cannot read, change or delete anything. Only our team can see submissions, and only for the purposes in this notice.

If a personal data breach happens, we will inform you and the Data Protection Board of India without delay, as the DPDP Act and Rules require, and tell you what happened and what you can do.

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you and how we use it;
• correct, complete or update your data;
• have your data erased, unless the law requires us to keep it;
• withdraw your consent at any time;
• have your grievances addressed by us; and
• nominate another person to exercise these rights for you in the event of your death or incapacity.

Email us at info@brightpinesindia.org with the subject “Personal data request”, or call us on +91 88001 02567. Tell us your name and the phone number or email address you used, so that we can find your records. We may ask you to confirm your identity before acting on a request.

We reply within 30 days. The DPDP Rules, 2025 set an outer limit of 90 days for resolving grievances.

The person who answers questions about how we process personal data is Atul Singh, Chief Executive Officer, at the email, phone number and address on this page.

If you are not satisfied with our response, you may complain to the Data Protection Board of India. The Act asks you to raise the grievance with us first.

We do not use advertising or analytics cookies, and we do not track you across other websites.

If you arrive from one of our campaign links, the campaign name is kept in your browser's session storage until you close the tab, so that it can be saved with your form.

Our website loads fonts from Google Fonts, so Google receives your IP address when the page loads. WhatsApp links open WhatsApp, which follows Meta's own privacy policy.

We will update this notice when our practices or the law change, and show the new date at the top. If we make a significant change to how we use your data, we will ask for your consent again where the law requires it.

This notice is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 and the Information Technology Act, 2000.