Privacy Policy

Who We Are and Scope

Zenith Railway Academy (“ZRA”, “we”, “us” or “our”) is operated by Zenith Rail Edvarsity Private Limited, registered at B130, 2nd Floor, Greenfields, Faridabad, 121010, Haryana. ZRA is responsible for deciding the purposes and means of processing the personal data described in this notice, except where another organisation is independently responsible and is identified to you.

This Privacy Policy applies to railwayacademy.org, its enquiry and registration experiences, courses, events, learner accounts, assessments, certificate verification, payments, support and other ZRA-controlled services described here. Where a third-party platform or educational partner operates as an independent data fiduciary/controller, its own privacy information may also apply. This policy does not replace a specific privacy notice shown at the point of data collection.

What Personal Data We Collect

Depending on how you interact with ZRA, we may collect:

• Identity and contact details: name, email, phone/WhatsApp number, country and contact preferences.
• Enquiry and professional details: programme interests, qualifications, employer, designation, experience, enquiry text and related correspondence, where relevant.
• Account and enrolment information: login/account identifiers, enrolled courses, eligibility documents when necessary, registration status and learner support records.
• Learning and assessment records: attendance, participation, submitted assignments, scores, feedback, progress, completion status and certificate information.
• Transaction records: purchased courses, invoice and billing details, payment status, refunds and transaction references. Card details are handled through authorised payment providers where a hosted integration is used.
• Event and competition information: event registration, answers, scores, leaderboard/winner information, and fulfilment details where a prize or reward is claimed.
• Technical and website information: IP address, device/browser information, security logs and cookie or tag-derived data where the relevant technologies are used.
• Communication records: messages, consent or preference selections, timestamps, enquiries, unsubscribe requests and support/grievance history.

We identify mandatory fields in each form and seek to avoid collecting information not needed for the stated purpose.

How We Obtain Information

We obtain personal data directly when you submit a form, contact us, create an account, enrol, make a payment, participate in a class, event or quiz, submit an assessment, claim a reward or communicate with our team. We may also receive programme-related information from an employer, sponsoring organisation, educational partner, payment provider or service provider where relevant and permitted. Website technologies may collect technical information as described in the Cookies and Analytics section below.

If an organisation registers learners on their behalf, we will provide or make available appropriate information to those learners about their data and programme-related reporting arrangements.

Why We Process Data

We process personal data for the specific purposes notified to you, which may include:

• answering enquiries and providing requested counselling or course information;
• creating and administering accounts, applications and enrolments;
• delivering classes, laboratories, webinars, assessments, feedback and learner support;
• recording attendance, progress and results and issuing or verifying certificates;
• processing payments, invoices, refunds and records required by applicable law;
• organising events, quizzes, competitions, leaderboards and eligible prizes;
• communicating essential notices about an enquiry, registration, transaction or active programme;
• protecting users, preventing misuse, maintaining website/platform security and investigating incidents;
• meeting applicable legal and regulatory obligations; and
• sending optional promotional communications where the appropriate choice or other legally permitted basis applies.

Our processing will be based on consent or another ground permitted by applicable law, as relevant to the specific purpose and circumstances. A link to this policy alone does not create consent for unrelated promotional uses. Where consent is relied upon, the notice presented to you will identify the relevant personal data and specific purpose.

Event, Course and Learning Information

For courses and masterclasses, we use information to register participants, share joining instructions, provide learning access, administer assignments or assessments, support learners and issue applicable results or credentials. For institution-backed or employer-sponsored programmes, necessary participation, eligibility, assessment or certification information may be shared with the specified institution, sponsor or employer as described in the programme notice and relevant arrangements. We do not treat all ZRA partners as automatic recipients of every learner’s data.

For competitions, relevant scores, response times and winner details may be used to determine results. Where public leaderboards, winner names or photographs are used, the specific display and publicity arrangements are described in the event notice, with appropriate permission sought for optional promotional use.

Email, WhatsApp and Marketing Choices

We use the contact details you provide to respond to your own enquiries and communicate about the programmes and events in which you participate. Optional newsletters, unrelated course offers, future event promotions and cart-follow-up reminders are handled as separate communication purposes, as applicable.

Where consent is relied on, you can choose email and WhatsApp promotional communications separately, and the boxes will not be preselected. You may withdraw promotional consent through a functioning unsubscribe or STOP mechanism, any available preference controls, or by contacting the privacy team. We will act on the withdrawal and propagate it to relevant systems, subject to necessary records of the withdrawal. Withdrawal does not prevent essential service, transaction or programme notices.

You can manage both channels at any time in My Account → Communication Preferences if you have an account.

Incomplete Course-Cart Follow-ups

If the course-cart feature asks for contact details before purchase, any reminder or sales follow-up will depend on the separate communication choices displayed in that flow, where consent is relied on. Choosing not to receive reminders does not stop you from continuing to the cart or checkout. ZRA may record the relevant course, chosen communication channel, consent evidence, message status and enrolment outcome to administer those specific follow-ups, so that follow-up stops after a verified purchase.

We currently use Interakt for WhatsApp, Brevo for email, and SolidPerformers for sales enquiries. You can stop WhatsApp follow-up by replying STOP, stop email follow-up through the unsubscribe link in a cart email, or change both channels in My Account → Communication Preferences if you have an account. Purchase receipts and other service messages are handled separately.

Payment and Billing

When you purchase a ZRA offering, personal data needed to process the order, maintain transaction records, issue receipts and manage refunds may be processed by ZRA and authorised payment and accounting service providers. We do not ask you to submit CVVs or OTPs through unrelated enquiry forms or email.

Retention of billing and transaction records is governed by applicable tax, accounting and other legal requirements, as well as relevant operational needs.

Sharing with Third Parties and Educational Partners

We share personal data only where relevant to a stated purpose and permitted by applicable law. Recipients may include:

• technology providers supporting website hosting, forms, CRM, email, WhatsApp, payments, learning platforms, support, analytics and security;
• instructors and assessors engaged for a particular programme, to the extent needed to deliver and assess it;
• the institution delivering, examining or certifying your particular programme;
• a sponsoring employer or organisation receiving agreed participation or completion reports for its cohort;
• authorised logistics providers where a claimed reward or prize requires delivery; and
• public authorities or other recipients where disclosure is legally required.

Providers processing information on ZRA’s behalf are subject to appropriate contractual and security arrangements. Some institutions or third parties may be independently responsible for their own processing, in which case their own privacy notices may apply. We do not sell personal data to advertisers.

International Processing

ZRA may use systems, delivery partners or service providers located outside India in connection with international courses and services. Where personal data originating in India is transferred outside India, ZRA will review and comply with the applicable Digital Personal Data Protection Act requirements and any restrictions notified by the Government, as well as relevant laws in other jurisdictions where they apply.

Security and Confidentiality

We use appropriate organisational and technical safeguards to protect personal data against unauthorised access, disclosure, alteration, loss and misuse, including appropriately restricted access, secure transmission, backups, logging, relevant vendor safeguards and incident response. No online service can promise absolute security. People with authorised access must use data only for permitted purposes.

Data Retention and Deletion

We keep personal data for the period reasonably necessary for the specific notified purpose, taking account of applicable legal, tax, accounting, certification, dispute-resolution and security requirements. Retention periods differ for enquiries, unsuccessful applications, learner accounts, attendance and assessment records, certificates, payment records, marketing preferences, event entries and security logs.

When the purpose is complete, or a valid erasure request applies, we will erase information unless retention is necessary under applicable law or another permitted requirement. We may retain limited evidence of a consent withdrawal or completed request as necessary to demonstrate compliance.

Your Privacy Rights

Subject to the law applicable to the relevant processing, you may request information about your personal data and its processing, ask for correction, completion or updating, request erasure where applicable, withdraw consent, seek grievance redressal, and exercise nomination rights. The scope of a request and any exceptions will depend on the applicable law and the purpose for which information is held.

To make a request, write to [email protected]. Please provide enough information to locate the relevant account or record. We may verify your identity appropriately before changing or disclosing data and may ask for clarification where required. We will explain the outcome and any applicable limitation or retention requirement.

Withdrawal of consent will be as straightforward as the original method where consent is relied upon. It may affect access to a service if that processing is necessary for providing the service and no alternative permitted basis applies.

Grievances and Privacy Contact

For privacy questions or concerns, contact:

ZRA will acknowledge, investigate and respond to privacy grievances through its published process within the period specified in that process, not exceeding the applicable maximum under the DPDP Rules when those provisions apply. You may have a right to approach the Data Protection Board of India after exhausting the grievance process in accordance with the Act.

Children’s Personal Data

Our online registration, competition and enrolment services are intended for individuals aged 18 or older. A person under 18 should not register independently. Where ZRA becomes aware of an unauthorised child’s account or registration, we will take appropriate action to restrict or remove the relevant information, subject to applicable obligations.

Cookies, Analytics and Website Technologies

ZRA may use technically necessary cookies or similar functions for website operation and security, and may use analytics, performance or marketing technologies where actually implemented. Where a particular technology requires consent under applicable law, the relevant choice will be provided before the technology is used. A cookie banner is not automatically required solely because a website uses cookies; the applicable processing and geographic rules are considered on that basis.

Certificate Verification, Prizes and Rewards

Where a certificate-verification service is offered, we use the submitted certificate or enrolment identifier to check authenticity and return only information necessary for that purpose. Verification does not expose contact details, detailed learning history or unnecessary personal information.

If ZRA offers rewards or prizes requiring fulfilment, the information needed to verify eligibility and arrange delivery is requested only at the relevant stage. Physical addresses are not collected from all participants merely because some may win a prize. Any public announcement or promotional use of winner information is covered by the relevant event notice and permissions.

Data Breaches

Where a personal data breach occurs, ZRA will assess and respond to it, take appropriate containment and remediation actions, and provide notifications to affected individuals and the relevant authorities where required by applicable law. The contact details in this policy can be used to report suspected privacy or data-security incidents.

Changes to This Policy

We may revise this Privacy Policy when our services, processing arrangements or legal obligations change. We will publish the revised policy with its effective or last-updated date and provide additional notice or request fresh consent where required. Simply continuing to browse the website will not be treated as consent to a new unrelated purpose where the law requires specific consent.