Privacy Policy

Last updated: 25 October 2026

1. Who We Are
2. Scope & Consent
3. Data We Collect
4. Children's Data
5. How We Use Data
6. Sharing & Disclosure
7. Payment Data
8. Aadhaar & Identity Documents
9. Cookies & Logs
10. Data Security
11. Retention & Deletion
12. Your Rights
13. Withdrawal of Consent
14. Storage & Transfer
15. Data Breach
16. Third-Party Links
17. Changes to this Policy
18. Grievance Officer

1. Who We Are

Shishu Vikas Yojana (“SVY”), the website svy.org.in and the SVY Student, Agent and Admin portals are operated by A3N IT Services (“A3N”, “we”, “us”). For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), A3N is the Data Fiduciary that decides why and how your personal data is processed.

2. Scope & Consent

This policy applies to personal data of parents / guardians, enrolled students, agents, supervisors, partners and visitors, collected through the website, portals, agents, forms, SMS and phone. It is published under Section 43A of the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the DPDP Act.

By submitting personal data, you give your free, specific, informed and unambiguous consent to its processing for the purposes stated below. Where you provide data of another person (for example, your child or spouse), you confirm that you are authorised to do so.

3. Data We Collect

Category	Examples
Student details	Name, date of birth, gender, class, school, photograph, address, application / A3N account number
Parent / guardian details	Father's and mother's name, mobile number, email, relationship to the student
Identity & KYC documents	Aadhaar number and card images, birth certificate, school / bonafide certificate, marksheet, parent's PAN
Financial details	Bank account number, IFSC, account holder name, passbook copy (for scholarship and claim payments)
Health & claim details	Illness / treatment details, hospital bills, discharge summary, prescriptions and reports submitted with a health claim
Agent & partner details	Name, contact details, KYC, wallet and transaction records
Transaction details	Payment amount, date, transaction reference / UTR, payment status
Technical data	IP address, browser and device type, pages visited, login and audit logs

Passwords, financial information, health information and biometric / identity information are treated as sensitive personal data and given additional protection. We collect only the data needed for the purposes below.

4. Children's Data

• SVY serves children. Under Section 9 of the DPDP Act, a child's personal data is processed only with the verifiable consent of the parent or lawful guardian, obtained at enrollment through the agent / KYC process.
• Children's data is used only for enrollment, verification, benefit administration and legal compliance. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children, and do not process children's data in any way likely to harm their well-being.
• Student portal logins are meant to be used with the knowledge of the parent or guardian.

5. How We Use Data

• To enroll the student, verify identity and eligibility (KYC), issue the SVY ID / virtual card and create portal logins.
• To process renewals, scholarships, claims and other benefits, including payments to verified bank accounts.
• To arrange insurance-linked cover and claims with insurers.
• To process payments, maintain agent wallets and issue receipts.
• To send service communications by SMS, phone or email (application status, renewal reminders, payment confirmations).
• To prevent fraud, misuse and duplicate enrollment, maintain audit logs and secure our systems.
• To comply with law, court orders and requests from lawful authorities, and to establish or defend legal claims.
• To prepare anonymised, aggregate statistics (for example, number of families and schools served) that do not identify any person.

6. Sharing & Disclosure

We do not sell, rent or trade personal data. We share it only on a need-to-know basis with:

• Authorised SVY agents and supervisors — for students they enroll or service, limited to what they need.
• Insurers and their administrators — for insurance-linked cover and claims.
• Banks, payment gateways and payment aggregators — to collect fees and pay scholarships and claims.
• Service providers (Data Processors) — SMS gateway, hosting, IFSC / bank verification and IT support, who process data only on our instructions and under confidentiality obligations.
• Government, regulators, courts and law enforcement — where required by law or to protect rights, safety and prevent fraud.
• A successor entity — in case of a merger, acquisition or transfer of the SVY programme, subject to this policy.

7. Payment Data

Online payments are processed by RBI-authorised payment gateways / aggregators that are PCI-DSS compliant. We do not collect or store your card number, CVV, expiry date, UPI PIN or net-banking credentials. We receive only the payment status, amount and transaction reference. The gateway's own privacy policy applies to data you enter on its payment page.

8. Aadhaar & Identity Documents

• Aadhaar and other identity documents are collected only for KYC, to prevent duplicate or fraudulent enrollment, and with your consent. Submission of Aadhaar is voluntary where another acceptable document is allowed.
• We do not use Aadhaar for authentication with UIDAI, do not publish it, and display it only in masked form wherever possible.
• Access to identity documents is restricted to authorised personnel and the agent servicing the student.

9. Cookies & Logs

We use only essential cookies — for login sessions, security (anti-forgery) and language preference. We do not use advertising or cross-site tracking cookies. Server and audit logs (IP address, time and action) are kept for security and fraud prevention. You can block cookies in your browser, but login-based services may then not work.

10. Data Security

We follow reasonable security practices as required under the IT Act, 2000 and the 2011 Rules, including HTTPS encryption in transit, secure login controls with lockout after repeated failed attempts, role-based access control, anti-forgery protection and audit logging. No method of transmission or storage is completely secure; while we work to protect your data, we cannot guarantee absolute security. Never share your password or OTP with anyone — SVY staff and agents will never ask for them.

11. Retention & Deletion

• We keep personal data for as long as the membership is active and for the period needed to complete benefits, claims and renewals.
• After that, data is retained only as long as required by law (for example, financial and tax records for up to 8 years) or to resolve disputes, and is then deleted or anonymised.
• Where a membership has been closed and you request erasure, we erase data that we are not legally required to keep.

12. Your Rights

Under the DPDP Act, you (or the parent / guardian on behalf of a child) have the right to:

• Access — a summary of your personal data being processed and the parties it is shared with;
• Correction & completion — correct inaccurate or update incomplete data;
• Erasure — erasure of data no longer needed, subject to legal retention requirements;
• Grievance redressal — a response from our Grievance Officer; and
• Nomination — nominate a person to exercise these rights in the event of death or incapacity.

To exercise a right, write to grievance@svy.org.in from your registered email, or call 1800 103 2701. We may verify your identity before acting on a request.

13. Withdrawal of Consent

You may withdraw consent at any time by writing to grievance@svy.org.in. Withdrawal does not affect processing already done. Because enrollment, benefits and claims cannot be provided without the related data, withdrawing consent may end the membership; fees already paid are not refundable, as per the No Refund Policy. Data required by law will continue to be retained.

14. Storage & Transfer

Personal data is stored on secured servers of our hosting provider. Any storage or transfer of personal data outside India is made only as permitted under the DPDP Act and the rules notified by the Government of India.

15. Data Breach

In the event of a personal data breach, we will take immediate steps to contain it and will inform the Data Protection Board of India and the affected persons as required under the DPDP Act, and CERT-In where applicable.

16. Third-Party Links

Our website may link to third-party sites (for example, YouTube videos or a payment gateway). We are not responsible for their content or privacy practices; please read their policies.

17. Changes to this Policy

We may update this policy from time to time. Changes are published on this page with a revised “Last updated” date. Material changes affecting how we use your data will also be notified through the website or SMS where appropriate.

18. Grievance Officer

In accordance with the IT Act, 2000, the rules under it and the DPDP Act, the Grievance Officer is:

Complaints are acknowledged within 48 hours and resolved within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

This policy should be read together with our Terms & Conditions.