Privacy Policy

Plain-Language Summary

This summary highlights the main points. The full Policy below provides the details.

• We collect information needed to enroll students, deliver and improve classes, operate our LMS, communicate with families, process payments, protect users and comply with law.
• Student data may include name, age, chess profile, attendance, assignments, game history, LMS activity, chat or class interactions and, where applicable, audio/video recordings.
• Because many Students are children, we use age-appropriate safeguards and parental processes. We do not use children’s personal data for targeted advertising or behavioural advertising.
• Some classes may be recorded for safeguarding, quality, training, dispute resolution, service improvement or authorised playback. Promotional use is handled separately and, where required, with specific consent.
• We use trusted service providers such as video-conferencing, cloud, payment, messaging, analytics, CRM and chess/LMS providers. They may process data for Upstep under appropriate contractual and security controls.
• Data may be processed in India and other countries. Where required, we use contractual or other recognised safeguards for international transfers.
• Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, opt out of certain uses, complain to a regulator or exercise other statutory rights.
• We do not sell personal data for monetary consideration. We do not knowingly sell or share children’s personal data for cross-context behavioural advertising.

1. About This Privacy Policy

1.1 Who controls your personal data

Upstep Academy is a brand operated by Upstep Education Private Limited (“Upstep”, “we”, “us” or “our”). For the personal data covered by this Policy, Upstep generally acts as the organisation that determines why and how the data is processed, subject to the role of any third-party platform or provider acting independently under its own privacy notice.

1.2 Scope

This Policy applies to personal data collected through our Website, inquiry and demo forms, enrollment and payment processes, live classes, one-to-one and group coaching, masterclasses, tournaments, LMS and chess-learning tools, support channels, WhatsApp/SMS/email communications, recordings and other Upstep-controlled Services.

1.3 Privacy laws

Upstep operates internationally. The privacy rules that apply depend on the individual’s location, the nature of the Service and the processing involved. This Policy is designed to support compliance with applicable privacy and children’s-data laws, including the EU GDPR, UK GDPR and Data Protection Act 2018, COPPA and applicable US state privacy laws, India’s Digital Personal Data Protection Act 2023 and Rules 2025 as relevant provisions come into force, and applicable laws in Canada, Australia, Singapore and the UAE.

2. Personal Data We Collect

We collect only the categories reasonably relevant to operating the Services, subject to applicable law. The exact information varies by Student, programme and platform.

3. How We Collect Personal Data

We may collect personal data:

• directly from a Parent, adult Student or Student, including through forms, classes, calls, messages and support requests;
• automatically through the Website, LMS, class platforms and security/analytics technologies;
• from Coaches and authorised Upstep personnel who record attendance, progress, feedback, safeguarding or support information;
• from payment processors, video-conferencing providers, chess platforms, tournament organisers or other service providers used for the Services;
• from publicly available chess-rating, tournament or federation sources where relevant to a Student’s chess activities; and
• from a school, club, partner or other organisation where it has lawful authority to provide the information to us.

4. Why We Use Personal Data

We use personal data only for legitimate and lawful purposes. Depending on the jurisdiction, our legal basis may include performance of a contract, steps requested before entering a contract, consent, legitimate interests, compliance with legal obligations, protection of vital interests, or other lawful grounds recognised by applicable law.

5. Children’s Privacy

Children receive enhanced privacy protection.

5.1 Parent involvement

A Parent or legal guardian should enroll and authorise participation for a Minor. Parents are responsible for providing accurate age information and for completing any parental-consent or verification step that applicable law requires. We may limit or pause a feature until required consent or verification is completed.

5.2 What we collect from children

Children may provide or generate information while learning, including their name or username, class participation, chess games, moves, assignments, chat, questions, coach feedback, progress data and, where enabled and lawful, audio/video interaction or recordings. We seek to avoid collecting information that is not reasonably needed for the educational, safety or operational purpose involved.

5.3 US children under 13 / COPPA

For a child in the United States under 13 where COPPA applies, Upstep will provide required notice and obtain verifiable parental consent before collecting, using or disclosing the child’s personal information, unless a statutory exception permits limited collection. A Parent may request to review the child’s personal information, have it deleted, refuse further collection or use, and exercise other COPPA rights. If we learn that information was collected from a child under 13 without required consent, we will take appropriate steps to obtain consent or delete the information.

5.4 EU and UK children

Where Upstep relies on consent to provide an online service directly to a child, the age at which the child may consent independently varies. Under the EU GDPR the default threshold is 16, although Member States may set a lower age not below 13. Under the UK GDPR the relevant threshold is 13. Below the applicable threshold, we make reasonable efforts to obtain or verify authorisation from the holder of parental responsibility where Article 8 applies.

5.5 India

India’s DPDP Act defines a child as a person under 18. Where and when the relevant DPDP provisions apply, Upstep will obtain verifiable parental or lawful-guardian consent before processing a child’s personal data where required, use appropriate verification measures, and comply with applicable restrictions on processing that may adversely affect a child, tracking or behavioural monitoring, and targeted advertising directed at children, subject to any lawful exemptions.

5.6 Other jurisdictions

We also apply local child-privacy requirements where relevant. This may include parental consent or meaningful-consent standards in Canada, age-appropriate protections under Australian privacy law, Singapore PDPA requirements and children-specific guidance, and additional UAE requirements for children, including where rules apply to children under 13.

5.7 No targeted advertising to children

Upstep does not use children’s personal data for targeted or behavioural advertising and does not knowingly sell or share children’s personal data for cross-context behavioural advertising. We do not condition ordinary educational access on optional consent for promotional use of a child’s photograph, image, testimonial or story where such consent is legally required.

5.8 Parent review and deletion requests

Subject to applicable law and any lawful retention requirement, a Parent may contact Upstep to ask what personal data we hold about their child, request correction or deletion, withdraw consent where processing relies on consent, or request that future collection or use stop. We may need to verify the requester’s identity and authority before acting.

6. Live Classes, Audio/Video and Recordings

6.1 Class data

Live online classes may involve video, audio, screen sharing, chat, digital chess boards, assignments and Coach feedback. Participants should avoid sharing unnecessary sensitive information during a class.

6.2 Academy recordings

Upstep may record some sessions where lawful and appropriately notified. Purposes may include safeguarding, quality assurance, Coach training, complaint or attendance resolution, service improvement, internal educational records and authorised playback. The categories recorded may include video, audio, screen sharing, chat and digital-board activity.

6.3 Consent and promotional use

Where applicable law requires a particular form of participant or parental consent for recording, we will seek it before relying on the recording for that purpose. Recording a class for educational, safety or operational purposes does not by itself authorise public or promotional use. Public promotional use is governed separately by Section 7 and applicable consent requirements.

6.4 Recording retention

Recordings are retained only for as long as reasonably necessary for the relevant purpose, legal obligation, dispute, safeguarding need or authorised playback period. Upstep may delete recordings when they are no longer needed and does not promise permanent archival access unless a specific Service says otherwise.

7. Student Achievements, Photos, Testimonials and Media

Upstep may recognise Student achievements such as ratings, improvements, tournament results, rankings, awards, certificates, titles or milestones through official Upstep channels, including the Website, social media, WhatsApp communications, newsletters and other materials, subject to applicable law. Achievement content may include a Student’s name, photograph or other identifiable information.

Where a use is based on consent, consent may be withdrawn prospectively as permitted by law. Withdrawal does not necessarily require recall of printed materials already distributed or removal from independent third parties outside Upstep’s reasonable control, although we will take reasonable steps concerning content under our control where required.

8. Chess Games, LMS Data and Derived Educational Content

Chess games and chess-related activity conducted, played, submitted or generated through the LMS, classes, practice, assignments or tournaments may be stored and analysed for delivering instruction, assessing progress, fair-play review, curriculum improvement, product development, analytics and other legitimate educational or business purposes.

This data may include games, moves, positions, variations, annotations, mistakes, tactical sequences, timing and related learning metadata. Because a game record may be linked to a Student account, it may constitute personal data even though chess moves or positions themselves are not inherently identifying.

Upstep may create puzzles, exercises, annotations, classifications, compilations, statistical insights, training datasets or other educational resources from game data as permitted by the Terms of Service and applicable law. Where appropriate, material used outside the Student’s individual learning environment may be aggregated, anonymised or de-identified.

9. Communications and Marketing

9.1 Service communications

We may use email, SMS, WhatsApp, telephone or other channels provided or used by you to send class links, reminders, schedule updates, homework information, receipts, renewal notices, safety notices and customer-support messages. These are generally operational communications connected with the Services.

9.2 Marketing

We may send information about Upstep programmes, events, offers or educational content where permitted by law. Where consent is required, we will seek it. Marketing preferences can be changed using the available unsubscribe/opt-out method or by contacting Upstep. Opting out of marketing does not stop necessary service communications.

9.3 Direct marketing to children

We do not direct targeted or behavioural advertising at children. Any promotional communication involving or directed to a child will be handled with age-appropriate safeguards and applicable parental or other consent requirements.

10. Cookies and Similar Technologies

Our Website and digital services may use cookies, pixels, local storage, SDKs and similar technologies. These technologies may be used for:

• strictly necessary functions such as security, login, session management and basic site operation;
• preferences and functionality, such as remembering settings;
• analytics and performance measurement, such as understanding how visitors use the Website; and
• marketing measurement or advertising technologies where legally permitted and appropriately disclosed.

Where applicable law requires consent before non-essential cookies or similar technologies are used, we will provide an appropriate consent mechanism. Browser settings may also allow cookies to be blocked or deleted, although some features may then work differently. Upstep does not knowingly use tracking technologies to behaviourally advertise to children.

11. When We Share Personal Data

We do not sell personal data for monetary consideration. We may disclose personal data only as reasonably necessary for the purposes described in this Policy, including to the following categories:

Service providers are expected to process personal data only for authorised purposes and to use appropriate confidentiality, security and data-protection measures. Some third-party services may act as independent controllers and apply their own privacy notices.

12. International Data Transfers

Upstep is based in India and serves Students internationally. Personal data may therefore be processed in India, the United States, the United Kingdom, the European Economic Area, Singapore, the UAE, Australia, Canada or other countries where Upstep or its service providers operate.

Privacy laws and enforcement mechanisms differ between countries. Where applicable law requires transfer safeguards, Upstep will use an appropriate mechanism, which may include adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, contractual protections, recognised certifications or another lawful transfer mechanism. We may also conduct transfer-risk assessments or adopt supplementary safeguards where required.

For India, international transfers will be handled in accordance with applicable DPDP requirements and any government restrictions or conditions in force at the relevant time.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide Services, maintain academic or account history, comply with tax/accounting/legal obligations, resolve disputes, protect users, investigate fraud or safeguarding matters, or establish and defend legal claims.

When data is no longer needed, we may delete it, anonymise it, de-identify it or securely archive it where continued retention is lawful. Anonymised information that no longer identifies an individual may be retained and used for legitimate purposes.

14. Security

Upstep uses administrative, organisational and technical safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss or misuse. Depending on the system, measures may include access controls, role-based permissions, authentication, secure hosting, encryption where appropriate, logging, backups, vendor controls, staff confidentiality obligations and incident-response procedures.

No online system can be guaranteed completely secure. Parents and Students should protect passwords and class links, use secure devices, avoid sharing unnecessary personal information and notify Upstep promptly if they suspect an account or privacy incident.

Where a personal-data breach triggers a legal notification obligation, Upstep will notify affected individuals and/or the relevant authority as required by applicable law.

15. Your Privacy Rights

Privacy rights vary by jurisdiction. Subject to applicable law and exceptions, you may have the right to:

• know whether and how we process your personal data and obtain access or a copy;
• correct inaccurate or incomplete personal data;
• request deletion or erasure;
• restrict, object to or withdraw consent for certain processing;
• receive data in a portable format where the law provides this right;
• opt out of sale, sharing, targeted advertising or certain profiling where applicable;
• appeal or challenge a privacy-rights decision where applicable;
• nominate another person to exercise specified rights where applicable under Indian law;
• complain through Upstep’s grievance process or to a competent privacy regulator; and
• not be discriminated against for exercising a statutory privacy right.

We may ask for information reasonably necessary to verify identity, authority or parental status. We will not require more personal data than reasonably necessary for verification. Some requests may be refused or limited where the law permits, including where retention is required by law, necessary for legal claims, required for safety or another person’s rights would be affected.

16. Regional Privacy Notices

16.1 India

Where and when applicable provisions of the DPDP Act and Rules apply, individuals may have rights including access to information about processing, correction and erasure, grievance redressal and nomination, subject to the Act. For children, applicable provisions may require verifiable parental consent and restrict detrimental processing, tracking/behavioural monitoring and targeted advertising. Upstep will apply the rules and commencement schedule in force at the relevant time.

16.2 European Economic Area

Where the EU GDPR applies, Upstep may rely on contract, legitimate interests, consent, legal obligation, vital interests or another lawful basis as appropriate. Individuals may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, and may complain to their local supervisory authority. Where required for international transfers, Upstep uses recognised safeguards such as Standard Contractual Clauses.

16.3 United Kingdom

Where UK data-protection law applies, similar rights are available under the UK GDPR and Data Protection Act 2018. Article 8 applies where consent is the lawful basis for an information society service offered directly to a child; the UK digital-consent age is 13. Individuals may complain to the UK Information Commissioner where applicable.

16.4 United States and California

COPPA protections for children under 13 are described in Section 5.3. Where Upstep is subject to the CCPA/CPRA or another US state privacy law, eligible residents may have rights to know, access, correct or delete personal information and to opt out of sale, sharing, targeted advertising or certain profiling. Upstep does not sell personal data for monetary consideration and does not knowingly sell or share personal data of children under 16 for cross-context behavioural advertising without the affirmative authorisation required by law.

16.5 Canada

Where Canadian privacy law applies, Upstep seeks meaningful consent appropriate to the sensitivity of the information and the maturity of the individual. For children who cannot meaningfully consent – generally including children under 13 absent exceptional circumstances – parental or guardian consent is sought. Optional promotional use of a child’s photo or video is not treated as necessary to receive ordinary educational Services where the law requires separate consent.

16.6 Australia

Where Australian privacy law applies, Upstep follows applicable Australian Privacy Principles concerning notice, collection, use/disclosure, security, access/correction, direct marketing and cross-border handling. We also monitor and apply children-specific online privacy requirements as they become legally applicable to the Services.

16.7 Singapore

Where Singapore’s PDPA applies, Upstep follows applicable obligations relating to notification, consent, purpose limitation, protection, retention, access/correction, transfer limitation, breach notification and accountability. Children’s data is handled with the higher care contemplated by Singapore’s guidance for children’s personal data in the digital environment.

16.8 United Arab Emirates

Where UAE privacy law applies, Upstep follows applicable consent, transparency, security and data-subject-rights requirements. Additional child digital-safety requirements may apply, including parental consent and restrictions on targeted advertising or commercial use of personal data for children below specified ages.

17. Automated Tools, Analytics and AI

Upstep may use automated tools, chess engines, analytics or AI-assisted systems to support learning, game analysis, content recommendations, quality review, fraud/fair-play detection, support or operational efficiency. These tools may generate scores, classifications, recommendations or alerts.

Upstep does not intend to make solely automated decisions that produce legal or similarly significant effects on a Student or Parent without meaningful human involvement where applicable law restricts such decision-making. Fair-play or safeguarding concerns may be informed by automated indicators, but Upstep may also consider Coach observations, account history, game data and other relevant evidence.

18. Changes to This Policy

We may update this Policy to reflect changes in law, technology, Services or data practices. The latest version will be published on the Website with an updated effective date. Where required by law, we will provide additional notice or obtain fresh consent before materially changing a processing activity that requires consent.

19. Contact, Privacy Enquiries and Complaints

For privacy questions, parental requests, access/correction/deletion requests, consent withdrawal or complaints, contact Upstep through the official contact channels published on the Website.

Website: https://www.upstepacademy.com
Email: [email protected]

Upstep will publish or maintain reasonably accessible contact details for the person responsible for privacy/grievance enquiries, including any Data Protection Officer or designated privacy contact where applicable law requires one. We may update those business contact details without treating the change as a substantive amendment to this Policy.