Oak Field Research LLP is dedicated to safeguarding student and user data. This policy is formulated in strict accordance with the Digital Personal Data Protection (DPDP) Act, 2023 (India) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data) Rules, 2011.
1. Data Fiduciary / Controller
The data fiduciary responsible for processing your personal information is Oak Field Research LLP (operating the educational brand Oak Field Ed).
Official Contact: oakfieldreseaech@gmail.com | Helpline: +91 98048 33038.
2. Information We Collect
We collect only the minimum personal data required to deliver our educational services:
- Identity & Account Details: Name, registered email address, and profile photo when signing up via Supabase Auth.
- Billing & Transaction History: Purchase amounts, timestamps, product identifiers, and Razorpay transaction/order IDs. Note: Oak Field Ed never collects, processes, or stores raw credit/debit card numbers, CVVs, or UPI PINs on its infrastructure. All cardholder data is securely handled within Razorpay's PCI-DSS Level 1 environment.
- Learning Telemetry & Video Progress: Lesson completion status, quiz submissions, problem solving records, and video streaming session tokens via Bunny Stream.
- Technical Logs: IP address, device user-agent, operating system, and essential authentication session cookies.
3. Purpose & Legal Basis for Processing
We process your data under legitimate and lawful grounds:
- To provide, personalize, and unlock course content, problem sets, and webinars (Contractual Performance).
- To authenticate user sessions securely and maintain account access (Contractual Performance).
- To generate statutory GST tax invoices and comply with Indian financial reporting laws (Legal Obligation).
- To prevent intellectual property piracy, stream ripping, and credential sharing (Legitimate Interest).
- To send critical transactional notifications, login verification links, and webinar Zoom links via Brevo (Contractual Performance).
4. Third-Party Service Providers (Data Processors)
We integrate with trusted, industry-standard infrastructure providers who process data strictly under our contractual instructions:
Managed PostgreSQL database & authentication with Row-Level Security (RLS) encryption.
RBI-licensed PCI-DSS Level 1 payment gateway handling UPI, Cards, and Net Banking.
High-performance video CDN providing token-authenticated streaming and DRM security.
Transactional email infrastructure for account confirmations and order receipts.
We do not sell, rent, or trade your personal information to third-party data brokers or marketing agencies.
5. Data Security & Storage Standards
All communications between your browser and our servers are protected using industry-standard TLS 1.3 encryption. Internal database access is restricted via Row-Level Security (RLS) policies in PostgreSQL, guaranteeing that learners can only access data belonging to their verified UID.
6. Data Retention
We retain user account data as long as your account remains active. Transaction and invoice records are preserved for a minimum statutory period of 8 years to comply with Indian GST, Income Tax, and Companies/LLP statutory audit requirements.
7. Your Rights Under the DPDP Act, 2023
You have the right to:
- Request a summary of your personal data processed by Oak Field Ed.
- Request correction or updating of inaccurate personal data.
- Request erasure of personal data that is no longer required for statutory or educational purposes.
- Withdraw consent for optional non-essential communications.
To exercise any of these statutory rights, please email our Grievance Officer at oakfieldreseaech@gmail.com. Requests are addressed within 30 days.
8. Grievance Redressal Officer
In accordance with Rule 5(9) of the IT Rules, 2011 and the DPDP Act, 2023:
Officer: Grievance Officer, Oak Field Research LLP
Email: oakfieldreseaech@gmail.com
Telephone: +91 98048 33038
Address: Oak Field Research LLP, India
Acknowledgment: Within 48 hours | Resolution: Within 30 days