Privacy Policy

• Website enquiries: your name, contact details, organisation, role, training requirements, message and correspondence, to respond and plan a requested engagement.
• Account and enrolment, if a platform account is provided: name, contact details, learner or employee ID, institution or employer, assigned role, course allocation and authentication records, to create and administer access.
• Learning activity: course enrolment, module progress, attendance, completion, learning submissions, support questions and relevant session or access logs, to deliver and support the assigned learning journey.
• Assessments and workplace performance: answers, scores, competency evidence, trainer feedback, supervisor sign-offs, role-related performance measures and certification details, where these form part of the disclosed programme.
• Live learning and simulations: participation, submitted work and simulation results where used. Any identifiable audio, video, screen recording, remote proctoring or biometric analysis requires a separate notice and applicable consent before collection.
• Billing and support: billing contacts, invoice and payment references, helpdesk records and complaint details, to administer the relevant transaction or resolve a problem.
• Website and platform operation: IP address, browser and device details, session events, timestamps and error or security logs, to maintain service availability and prevent misuse.

We do not collect all these categories from every visitor. Public website browsing does not itself enrol you in a learning or performance system. Do not submit confidential employer records or other people’s personal information unless authorised and necessary for the activity.

Information comes from you and your platform activity, or from your employer, school, trainer, supervisor or assessment partner for the disclosed programme. An institutional upload does not authorise unrelated use.

We use the relevant information to answer enquiries; establish access; deliver courses, simulations and assessments; provide support; issue certificates; and produce the reports agreed for the programme. Attendance, completion and competency information may be visible to authorised trainers, assessors, supervisors and client administrators identified in your programme notice.

Before an employer-sponsored programme starts, the programme notice must explain the fields collected, who can see individual results, whether performance information is written back to an HR system, how long it is kept and whom to contact. An employer’s right to receive a particular report does not permit unrelated monitoring or unlimited access to learner records.

We use anonymised statistics for service evaluation where individuals cannot reasonably be identified. Identifiable learning records are not repurposed for advertising or unrelated profiling. We do not sell learner data. Optional publicity, newsletters and future course promotions require a separate choice where consent is required.

We explain the relevant purpose when we ask for personal information. Where consent is required, we obtain it through an appropriate affirmative action and keep a record. For sensitive personal information, we obtain written or electronic consent in the form required by applicable law. Simply browsing this website or reading this policy does not constitute consent to marketing, sensitive data collection or unrelated processing.

You can decline optional information, refuse promotional communications or withdraw consent by contacting us. Withdrawal does not affect earlier lawful processing. If information is essential for a particular service, we explain why and the effect of not providing it; an unrelated service or benefit will not be withheld because you decline optional publicity or marketing.

We process information without consent only where an applicable law permits or requires the particular use. We do not treat a contract, a commercial interest or a donor requirement as a general exemption from consent obligations.

If a programme introduces AI assistance, remote proctoring, recording or automated scoring, we provide a specific notice before use, covering the information involved, purpose, recipients and meaningful consequences. We do not treat this policy as permission for biometric identification, emotion analysis or training a general-purpose AI model on identifiable learner submissions.

You may ask for an explanation and human review of a disputed assessment or recommendation through the programme contact or our privacy contact. Any use of an automated result for an employment or eligibility decision must be explained by the organisation making that decision. We do not promise that a client will use results only for training unless that is expressly agreed and communicated.

We apply reasonable technical, organisational and physical safeguards proportionate to risk, including role-based access, confidentiality, appropriate protection in transmission and storage, secure paper handling and provider oversight. No system is completely secure.

We assess incidents, contain harm, take corrective action and notify affected individuals and authorities as legally required within applicable deadlines. Report suspected misuse to our privacy contact. Never email passwords, OTPs or full payment credentials.

Authorised staff, trainers, assessors, certification bodies and programme administrators receive only the information needed for their disclosed role. Hosting, learning systems, IT support, communications, cloud storage and payment providers process relevant information under appropriate confidentiality, security and purpose restrictions. A client receives programme reports within the scope explained to learners.

We may disclose information to advisers, auditors, public authorities or courts when legally permitted or required. A business transfer may involve relevant records under appropriate safeguards. We do not share identifiable learner records with BroadArks Foundation or another brand merely because of a common association; a separate purpose and lawful basis are required.

Cookies and similar technologies can support security, sessions and user preferences. Optional analytics can measure website use; embedded maps, videos, social media features or advertising tools can send device and usage information to their providers. The categories actually used, providers, purposes and expiry periods are described in the cookie information presented on the website.

Non-essential analytics and advertising technologies are enabled only after the relevant opt-in where required. You may reject optional categories or change an earlier choice through the website cookie controls, where offered. Browser settings also allow you to block or delete cookies, although necessary functions may then be affected. A browser setting alone may not withdraw consent already recorded by a third party.

Links to external websites and services are governed by those operators’ privacy notices. We provide relevant information before an optional embedded feature is activated or before personal information is sent to an independent service. This policy does not authorise third party tracking.

Services may use infrastructure in India and other countries where providers operate. Transfers are subject to applicable legal restrictions, required safeguards and, for information governed by the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (SPDI Rules), the same required level of protection and contractual necessity or your consent. Ask us or your programme administrator for details of the providers and locations relevant to your programme.

We retain identifiable information only for the stated purpose and the period required by applicable law. Enquiries are retained for handling and reasonable follow-up; applications for the relevant selection process; and service records for delivery, support and applicable certification or audit requirements. Learning evidence and certificates may need a longer verification or statutory period than routine access logs. For client-controlled records, we follow lawful documented retention and return or deletion instructions; the client must tell learners its applicable periods. Independently required records are retained only for the relevant legal purpose.

Consent records, complaints, security logs and evidence of transactions may need to be retained separately for applicable legal periods. A pending dispute, investigation or lawful preservation requirement may suspend normal deletion. Donor or client agreements do not authorise unlawful or indefinite retention.

When retention is no longer justified, we delete, securely destroy or irreversibly anonymise the information and require processors to do the same. Restricted backups are removed through their scheduled overwrite cycle and are not restored for routine use. Contact us for the retention period applicable to your particular record.

Where learners are under 18, we use an age-appropriate notice and obtain verifiable parental or lawful guardian consent where required. An employer, school or sponsor’s instruction is not by itself parental consent. We do not direct targeted advertising at children or undertake tracking or behavioural monitoring of children unless a specific applicable legal exemption permits it and its conditions are met. Required learning progress tracking must be assessed against those conditions before use.

Where a lawful guardian must act for a person with disability under applicable law, we verify that authority. We offer an appropriate assistance route for privacy questions or requests. Optional publicity or promotional recording is separate from learning participation.

You may contact us to review information you supplied, request correction or updating, withdraw consent, stop optional communications, and request deletion where continued retention is not required. We will explain any lawful reason for retaining a record or refusing part of a request. We may retain minimal suppression information to respect an opt-out.

When the relevant provisions of the Digital Personal Data Protection Act, 2023 apply and are in force, you may also exercise the applicable statutory rights to a summary of personal data and processing, information about sharing, correction, completion, updating, erasure, grievance redressal and nomination of another individual to exercise rights in the event of death or incapacity. These rights are subject to the conditions and exceptions in law.

Email info@broadarks.com with the subject “Privacy request - yandnow.com”. Include your name, the service or programme concerned, a relevant reference if available, and the action requested. We verify identity proportionately and may verify authority for a parent, guardian or representative. Please do not send an Aadhaar copy or other identity document unless we first explain why it is necessary and provide a secure route.

We aim to acknowledge requests within seven working days and resolve privacy grievances within one month of receipt, or sooner where law requires. We will explain the outcome and any permitted extension. If you remain dissatisfied, ask for escalation to the Grievance Officer. This process does not limit remedies before a competent authority or court. Where the DPDP complaint provisions are in force and applicable, you may approach the Data Protection Board of India after using our grievance process as required by law.

Y&Now operated by BroadArks Technology Private Limited
Attention: Anitha Menon; Chief Grievance Office & Chief Compliance Officer
Email: cco@broadarks.com
Telephone: +91 755 3553372
Sagar Premium Tower, Phase I, Block C, CP-02, JK Hospital Road, Kolar, Bhopal 462042, Madhya Pradesh, India.

We update this policy when our services, practices or applicable requirements change. The current version and effective date will appear on this page. For a material change, we provide appropriate notice and obtain fresh consent where required before using information for a new purpose. Continued website use does not replace consent where consent is legally required.