The Climate Promise Privacy Policy

1. Overview

Purple Umbrella Foundation ("we", "us", "our") operates The Climate Promise initiative at theclimatepromise.org. This Privacy Policy explains what personal data we collect through the Climate Pledge form, why we collect it, how we use and protect it, and what rights you have over that data. This policy is governed by the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

By submitting the Climate Pledge form on behalf of a student, the submitting adult (parent, guardian, or teacher) confirms they have read and agreed to this policy.

2. Who This Policy Applies To

This policy applies to:

• Parents or guardians who submit the Climate Pledge on behalf of their child
• Teachers or school administrators who submit pledges on behalf of students under their supervision
• Any adult who interacts with the Climate Promise website or contacts us directly

Students do not submit their own data directly. All pledge submissions are made by an authorised adult acting on the student's behalf.

3. Data We Collect

When a pledge is submitted, we collect the following information about the student:

• Full name
• Age or grade level
• School name
• City

We also collect the following from the person submitting the form:

• Email address (used to deliver the digital certificate and confirmation)

We do not collect payment information, national identification numbers, biometric data, health data, or any sensitive personal data as defined under the DPDP Act.

4. Why We Collect This Data

We collect this data solely for the following purposes:

5. Legal Basis for Processing

Under the DPDP Act, 2023, we process personal data on the following grounds:

• Consent: The submitting adult provides explicit consent at the time of form submission.
• Legitimate use: Processing is necessary to fulfil the purpose for which the data was provided (issuing the pledge certificate).

Because all submissions are made by adults on behalf of minors, we do not rely on the minor's own consent. The parent, guardian, or teacher is the Data Principal for the purposes of this submission.

6. Data Retention

We retain submitted data for as long as necessary to fulfil the stated purposes, subject to the following:

• Certificate and confirmation data: retained for 12 months from the date of submission, unless the submitting adult requests earlier deletion.
• Aggregated programme statistics: retained indefinitely in anonymised form.
• Contact enquiries: retained for 6 months from resolution.

After the retention period, data is permanently deleted from our systems.

7. Data Sharing and Disclosure

We do not sell, rent, or trade personal data. We share data only in the following limited circumstances:

• Service providers: We may share data with third-party service providers (such as email delivery or certificate generation tools) who process data strictly on our behalf under data processing agreements.
• Legal obligation: We may disclose data if required to do so by law, court order, or a competent government authority under applicable Indian law.
• School coordination: School name and city may be shared with partner schools for programme coordination, without identifying individual students publicly.

No student data is shared with advertisers, third-party marketers, or any organisation outside the scope of the Climate Promise programme.

8. Data Security

We apply reasonable technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction. These include:

• Encrypted data transmission (HTTPS)
• Access controls limiting who can view submitted data
• Regular review of data handling practices

In the event of a personal data breach that is likely to result in harm to Data Principals, we will notify the affected parties and the Data Protection Board of India as required under the DPDP Act.

9. Your Rights

As the submitting adult (Data Principal), you have the following rights under the DPDP Act:

• Right to access: Request confirmation of what data we hold about you or the student.
• Right to correction: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of personal data, subject to our legal retention obligations.
• Right to withdraw consent: Withdraw your consent at any time. This will not affect data processed prior to withdrawal.
• Right to grievance redressal: Raise a complaint with us, and if unresolved, with the Data Protection Board of India.

To exercise any of these rights, contact us at the details in Section 11.

10. Cookies and Tracking

Our website may use basic cookies for functionality (such as remembering form progress). We do not use cookies for advertising or cross-site tracking.

You can disable cookies through your browser settings; this may affect some website functionality.

11. Contact and Grievance Officer

For any questions, data requests, or complaints about this Privacy Policy, contact us at:

We will respond to all requests within 30 days of receipt. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is operationalised under the DPDP Act.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this document and, where the changes are material, notify submitting adults via email.

Continued use of the Climate Promise pledge form after changes are posted constitutes acceptance of the revised policy.