Schools
Colleges
Immersions
Certifications
Internships
About
Policy · Privacy & data protection
Your data, used only for what you asked.
This notice explains what personal data HCD Institute collects, why, who we share it with, how long we keep it, and the rights you have. It is written to meet India's Information Technology Act, 2000 and its 2011 data security rules, the Digital Personal Data Protection Act, 2023 as its provisions come into force, and, for people in the UAE, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
Who we are
The organisation responsible for your data.
In India, the data fiduciary is HCDNOW, trading as HCD Institute (The Institute of Human-Centred Design), Ponnattil, Kuravilangad, Kottayam, Kerala 686633, India. For programmes run in the UAE, the controller is HCD Institute's company registered in Dubai, UAE, named in your programme agreement.
Contact for anything in this notice: dic@hcd.institute or +91 90195 12094.
What we collect
Only what we need.
| What | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, email, phone, city | Enquiry, admission and booking forms; email and WhatsApp |
| Programme details | School or institution, grade or role, programme chosen, application answers | Application and booking forms |
| Learning records | Attendance, project work, jury feedback, certificates issued | Our faculty and DIC Hub, IIT Hyderabad faculty during the programme |
| Payment details | Amount, invoice and GST details, payment status | Our payment provider; we do not store card or bank numbers |
| Safety details (residential programmes) | Emergency contact, medical or dietary needs you choose to share | Consent and registration forms |
| Photos and video | Images taken during programmes | Only as set out in our media consent policy |
| Website use | Pages visited, device and browser type | This website, as set out in our cookie policy |
Why we use it
The purposes, and our basis.
- To run the programme you asked forAdmissions, scheduling, teaching, assessment, certificates and alumni records. Basis: your consent, given when you apply or book.
- To keep students safeSupervision, emergency contact and safeguarding during programmes, especially residential ones. Basis: consent, and legitimate uses the law allows for safety and medical emergencies.
- To take payment and keep accountsInvoices, GST and accounting records. Basis: consent, and compliance with tax law.
- To reply to youAnswering enquiries and complaints. Basis: consent, which you give by writing to us.
- To tell you about programmesOnly if you opt in. You can unsubscribe at any time.
We do not use personal data for automated decisions about admission, and we do not use children's data for advertising, profiling or behavioural tracking.
Children
Extra care for anyone under 18.
- Parental consentFor a student under 18, we ask for the consent of a parent or lawful guardian, given through the school or by the parent completing our forms. If we find we hold a child's data without that consent, we delete it.
- Through the schoolFor HCD Lab @ School, the school shares only what is needed to run the programme, under its own consent arrangements and our MoU.
- No tracking or targetingWe do not track or monitor children's online behaviour, build profiles of them, or direct targeted advertising at them.
- See alsoOur child safety & safeguarding policy.
How long we keep it
No longer than needed.
| Data | How long |
|---|---|
| Enquiries that don't lead to enrolment | Up to 2 years, then deleted |
| Learning records and certificates | As long as needed to verify a certificate you hold |
| Payment and tax records | As long as GST, income-tax and company law require (currently up to 8 years in India) |
| Safeguarding records | As long as the law and our safeguarding duties require |
Your rights
Ask, and we will act.
- AccessAsk what personal data we hold about you and who we have shared it with.
- Correction and updateAsk us to correct or complete inaccurate data.
- ErasureAsk us to delete data we no longer need, unless the law requires us to keep it.
- Withdraw consentWithdraw consent at any time, as easily as you gave it. This doesn't affect what was done before.
- NominateNominate someone to exercise your rights if you cannot.
- ComplainRaise a grievance with us first. In India, you may then approach the Data Protection Board of India. In the UAE, the UAE Data Office.
We acknowledge requests promptly and respond within the time the law allows. We may need to confirm your identity first.
Security
Kept safe.
Access to personal data is limited to the people who need it, accounts are protected, and providers are chosen for their security. If a breach affects your data, we will inform you and the authorities as the law requires.
We may update this notice. The date below shows the latest version. Last updated: 5 November 2026.