GDPR & DPDP Compliance Statement

This statement sets forth the operational procedures implemented by New Education Resources Private Limited to comply with the European Union General Data Protection Regulation (Regulation (EU) 2016/679) and India's Digital Personal Data Protection Act 2023.

1. Purpose & Territorial Scope

Although our primary educational operations are centered in India, students, academic researchers, and partner educators located in the European Economic Area (EEA), United Kingdom, and globally access our open textbook library. We extend high-standard privacy protections to all individuals irrespective of residency.

2. GDPR Data Protection Principles (Article 5)

Every processing activity conducted on the Platform adheres to:

• Lawfulness, Fairness, and Transparency: We process data only with explicit consent or legitimate pedagogical interest, with zero deceptive design patterns.
• Purpose Limitation: Contact and newsletter subscriber details are utilized strictly for educational correspondence and not repurposed.
• Data Minimisation: We do not mandate registration or student tracking to download open educational resources.
• Accuracy: Educators and users may request immediate correction of outdated contact records.
• Storage Limitation: Subscriber data is expunged immediately upon unsubscribe, and inquiries are purged after 180 days.
• Integrity and Confidentiality: Data is encrypted using AES-256 and HTTPS/TLS 1.3 standards.

3. Lawful Bases for Processing (Article 6)

Service Area	Data Processed	GDPR Lawful Basis
Academic Digest Newsletter	Email address	Consent (Art. 6(1)(a)): Provided freely by entering email into subscription form.
Inquiry & Support Forms	Name, email, message	Legitimate Interests (Art. 6(1)(f)) or Contractual Pre-steps (Art. 6(1)(b)) to respond to institutional inquiries.
Server Logging	IP, Timestamp, User Agent	Legitimate Interests (Art. 6(1)(f)): Maintaining cybersecurity and mitigating denial-of-service threats.

4. Data Subject Rights (Articles 15 through 22)

As a data subject, you are entitled to:

1. Right of Access (Art. 15): Obtain confirmation of whether your data is being processed and receive a copy.
2. Right to Rectification (Art. 16): Correct inaccurate or incomplete information.
3. Right to Erasure / "To Be Forgotten" (Art. 17): Have your personal details deleted without undue delay.
4. Right to Restrict Processing (Art. 18): Limit processing under certain contested circumstances.
5. Right to Data Portability (Art. 20): Receive your submitted contact records in a structured, commonly used JSON/CSV format.
6. Right to Object (Art. 21): Object at any time to newsletter communications.
7. Automated Decision-Making (Art. 22): We perform zero automated profiling or credit scoring.

5. Educational Protection of Children

Under Article 8 of the GDPR and Section 9 of the Indian DPDP Act 2023, children deserve specific protection. We do not solicit personal information from minors, we do not require accounts for viewing materials, and we do not use third-party behavioral trackers on student pages.

6. International Data Transfers

When data is processed outside the EEA (such as on our primary cloud servers in India), transfers are safeguarded under standard contractual clauses (SCCs) and MeitY-certified security controls guaranteeing equivalent levels of data protection.

7. Data Breach Notification Protocol (Article 33 & 34)

In the event of a security incident affecting personal data, New Education Resources will notify relevant supervisory authorities and affected individuals within 72 hours of becoming aware of the breach, accompanied by mitigation measures.

8. How to Exercise Your Rights (DSAR Protocol)

To initiate a Data Subject Access Request (DSAR) or request record deletion: