DPR Prep (dprprep.com) is operated by DPR EDUCATION Pvt Ltd, H.No. 8-8-527, RTC Cross Roads, Hyderabad, Telangana, India. This policy describes the personal data we hold about you, why we hold it, who else sees it and what you can ask us to do with it. Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") we are the Data Fiduciary for this data. In short: we collect what a preparation account needs, we protect it, and we do not sell it.
1. What we hold about you
| Kind of data | Examples |
|---|---|
| Account | Name, e-mail, mobile number and password. The password is kept only as an Argon2id hash, which cannot be turned back into the password. |
| Preparation profile | Exams you follow, target year, stage of preparation, preferred language and goals. |
| Learning record | Answers in practice and tests, time per question, scores, ranks, bookmarks and topic progress. |
| Purchases | Plan, amount, coupon, order and receipt numbers, Razorpay payment ID and the type of payment method (such as "UPI"). We never receive card numbers, CVVs, UPI PINs or banking passwords; Razorpay handles those. |
| Security | Sign-in history, active devices, one-time-code records and IP addresses linked to security events. |
| Messages | Whatever you write to support. |
2. What we use it for
- Opening and protecting your account, confirming your e-mail and signing you in with a one-time code.
- Running practice and mock tests for your chosen exams, and producing scores, solutions, ranks and analytics.
- Taking payments, activating plans, sending receipts and processing refunds.
- Sending service e-mails such as sign-in codes, receipts, revised results and important notices about your account. Marketing e-mails are sent only if you agree to them.
- Detecting fraud, cheating and misuse, and keeping the Platform secure.
- Meeting our legal, tax and accounting duties and answering lawful requests.
We rely on the consent you give when you register, which you can withdraw, and, where the DPDP Act allows, on legitimate uses such as complying with the law and providing the service you asked for.
3. Who else sees it
- Razorpay Software Private Limited processes payments and refunds.
- Hostinger hosts our servers and e-mail. The application and database run on servers in India.
- Government or law-enforcement authorities receive data only where the law requires us to share it.
These providers act on our instructions and must protect your data. On leaderboards, other students see you anonymously (for example "Student 4") unless the administrator chooses to show a first name and last initial; your e-mail and mobile number are never shown. We use no advertising or third-party tracking cookies.
4. Cookies
Only essential cookies are used: one keeps you signed in, one protects forms against forgery, and an optional "remember me" cookie keeps you signed in longer. There are no analytics or advertising cookies. When you pay, Razorpay's checkout may set cookies of its own to complete the payment.
5. How long we keep it
- Account, profile and learning data: for as long as your account exists, or until you ask us to delete it.
- IP addresses in security logs: removed after 90 days.
- Used sign-in and verification code records: deleted after 30 days.
- Exam device and resume records: deleted after 365 days.
- Application error logs: around 30 days.
- Payment and invoice records: as long as tax and accounting law requires, generally up to 8 years, even after an account is deleted.
6. How we protect it
Connections are encrypted with HTTPS; passwords and session tokens are hashed; sign-in uses a second step by e-mail code; database accounts have only the access they need; an append-only audit log records sensitive actions; browsers receive strict security headers; and backups run regularly. No system can be made perfectly secure. If a breach affects you, we will tell you and the Data Protection Board of India as the law requires.
7. Your rights
The DPDP Act lets you:
- see a summary of the personal data we hold about you and how we use it;
- correct or update it, much of which you can do yourself under Profile and My Exams;
- have it erased: we delete or anonymise your account and keep only what the law obliges us to;
- withdraw your consent at any time, which ends the service because the account cannot run without the data;
- nominate someone to exercise these rights if you die or become unable to;
- complain to our Grievance Officer and, if the complaint is not resolved, to the Data Protection Board of India.
Write to contact@dprprep.com from your registered e-mail address to use any of these rights. We reply within 30 days.
8. Children
The Platform is meant for adults preparing for competitive examinations. Anyone under 18 may use it only with the verifiable consent of a parent or legal guardian. We do not track children or direct advertising at them. If you believe a child has signed up without consent, tell us and we will delete the account.
9. Grievance Officer
Narasimha Patel, DPR EDUCATION Pvt Ltd, H.No. 8-8-527, RTC Cross Roads, Hyderabad, Telangana, India. E-mail contact@dprprep.com · Phone 8247094634. Complaints are acknowledged within 48 hours.
10. Changes to this policy
The effective date at the top shows the current version. We will let you know of significant changes by e-mail or on the Platform.
