Privacy & Cookies Policy - Global Fin X Academy

1. Who We Are (Data Controller)

Global Fin X Academy ("we", "our", "us") is a sole proprietorship owned and operated by Pedamallu Lakshmi Srihitha, trading as Global Fin X Training Academy, with its principal place of business at:

Raithu Bidda Apartments, Simhapuri Colony, Bachupally,
Hyderabad, Telangana – 500090, India.

We operate the website globalfinx.in and the Learning Management System (LMS) at learning.globalfinx.in. As the entity that determines the purpose and means of processing your personal data, we are the Data Fiduciaryunder the Digital Personal Data Protection Act, 2023 ("DPDPA 2023").

For all privacy-related queries or to exercise your rights, contact our Grievance Officer at info@globalfinx.in.

2. Personal Data We Collect

2.1 Data You Provide Directly at Checkout

When you enrol in a course through our website, we collect the following to process your enrollment:

Full name — used to create your LMS account and personalise your enrollment confirmation.
Email address — used to send your payment receipt, LMS access link, and transactional course communications.
Phone number (optional at our checkout form, but collected by Razorpay for payment verification) — used to provision your LMS account and for WhatsApp-based support.

Example: When you enrol in "CMA US Part 1", you enter your name, email, and optionally your phone number in our checkout modal. This information is passed to Razorpay to open the payment window and, once payment is confirmed, is used to create your student account on learning.globalfinx.in.

2.2 Payment Data

All payment transactions are processed by Razorpay Software Private Limited, a PCI-DSS Level 1 certified payment gateway. We do not collect, store, or have access to your credit/debit card numbers, UPI IDs, net banking credentials, or any other sensitive payment instrument information.

After a successful transaction, Razorpay sends us a Razorpay Order ID and a Razorpay Payment ID. These reference numbers are stored in our database solely to track your enrollment status and for financial record-keeping.

Example: Your payment confirmation email will reference a Razorpay Payment ID (e.g., "pay_XXXXXXXXXX"). This is an immutable reference number — we cannot use it to initiate a new charge or access your payment details.

2.3 LMS Account Data

Upon successful payment, we automatically create a student account on our LMS. This account contains:

Your name, email address, and phone number (as provided at checkout).
A unique student code (e.g., "GFX-ST0001") and enrollment number (e.g., "Enr-0001").
Course enrollment details, batch information, access validity period, and fee payment records.
Course progress data — lectures viewed, view-time consumed, and activity timestamps.

2.4 Usage and Technical Data

When you visit globalfinx.in, we automatically collect technical information through cookies and analytics tools, including:

IP address, browser type, operating system, and device type.
Pages visited, time on page, and referring website.
Interactions with the site (button clicks, video plays) collected via Google Tag Manager and Google Analytics 4.

This data is aggregated and anonymised where possible and is used solely to improve our website and course content.

3. How and Why We Use Your Data

Purpose	Data Used	Legal Basis
Processing your course enrollment and payment	Name, email, phone	Contractual necessity
Creating and managing your LMS account	Name, email, phone, student code	Contractual necessity
Sending enrollment confirmation and LMS access link	Name, email	Contractual necessity
Course-related transactional emails (exam reminders, validity updates)	Name, email	Contractual necessity
Financial record-keeping and GST / tax compliance	Name, email, payment reference IDs, amount	Legal obligation
Improving our website and course content	Anonymised usage data, cookies	Legitimate interest
Responding to your support or grievance queries	Name, email, phone, order details	Legitimate interest / Legal obligation

We do not send marketing emails, promotional newsletters, or unsolicited course recommendations. Every email we send is directly related to your enrollment, account, or a request you initiated.

4. Third-Party Service Providers (Data Processors)

We share your personal data with the following service providers only to the extent necessary to deliver our services. Each is contractually obligated to handle your data securely and in accordance with applicable law.

4.1 Razorpay — Payment Processing

Data shared: Name, email address, and phone number are passed to Razorpay when you initiate payment. Razorpay directly collects your payment instrument details.

Purpose: Secure processing of course enrollment payments.

Entity: Razorpay Software Private Limited, 1st Floor, SJR Cyber, 22 Laskar Hosur Road, Adugodi, Bengaluru – 560030.

4.2 Resend — Transactional Email Delivery

Data shared: Name and email address are shared with Resend to deliver your enrollment confirmation and LMS access emails.

Purpose: Reliable delivery of transactional emails.

4.3 Supabase — Database and Authentication Hosting

Data shared: All student account data (name, email, phone, enrollment records, payment references, course progress) is stored in databases hosted on Supabase's infrastructure (built on AWS).

Purpose: Secure storage and retrieval of enrollment and LMS data.

4.4 Google — Analytics and YouTube Embeds

Google Tag Manager and Google Analytics 4: We use GTM to deploy analytics scripts that collect anonymised usage data (pages viewed, session duration, country-level location). No personally identifiable information (name, email, phone) is shared with Google Analytics.

YouTube embeds: Our course pages embed demo videos hosted on YouTube. When you interact with an embedded video, Google may set cookies in accordance with their own privacy policy, regardless of whether you have a Google account.

We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.

5. Cookies and Tracking Technologies

Cookies are small text files stored on your browser when you visit a website. We use the following categories of cookies:

Category	Purpose	Set by
Essential	Required for the site to function (session management, dark mode preference)	globalfinx.in
Analytics	Anonymised data on how visitors use the site, to help us improve it	Google Analytics 4
Embedded content	Set when you play an embedded YouTube demo video	YouTube / Google
Payment session	Set by Razorpay during the checkout flow to manage your payment session securely	Razorpay

You can manage or delete cookies through your browser settings. Disabling essential cookies may affect site functionality and the checkout process.

6. Data Retention

We retain your personal data indefinitely from the date of your first enrollment. Reasons include:

Your LMS account and course access history must remain available if you return for additional courses or require proof of enrollment.
Financial records (amounts paid, Razorpay payment references) must be retained under Indian accounting and tax law.
Your enrollment history may be required to issue completion certificates or validate your academic record.

If you wish to request deletion of your personal data and are not subject to a legal retention obligation, contact us at info@globalfinx.in with subject line "Data Erasure Request". We will respond within 30 days. Deletion of your account will permanently revoke access to all enrolled courses and associated materials.

Example: If you enrolled in ACCA MA in 2025, your enrollment record, LMS account, and payment reference will be retained indefinitely so we can confirm your enrollment history if requested by you or required for audit or legal purposes.

7. Your Rights under the DPDPA 2023

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the following rights:

Right to Access: Request a summary of the personal data we hold about you and how it is being processed.
Right to Correction and Erasure: Request correction of inaccurate or incomplete data, or erasure of data no longer necessary for the original purpose (subject to legal retention obligations).
Right to Grievance Redressal: Have your privacy complaints addressed. We will respond within 30 days.
Right to Nominate: Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email info@globalfinx.in with the subject line "Data Rights Request". We may ask you to verify your identity before processing your request.

8. Children's Privacy

Our courses are professional qualifications aimed at individuals aged 18 years and above. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe your child has provided us with personal data, contact us immediately at info@globalfinx.in and we will delete such data without delay.

9. International Data Transfers

Your data may be processed on servers located outside India by our third-party service providers (Supabase on AWS infrastructure, Resend, Google). We ensure such transfers are made under appropriate contractual safeguards consistent with the DPDPA 2023 and the privacy commitments of each provider referenced in Section 4.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be reflected in the "Last updated" date at the top of this page. Your continued use of our website or LMS after any changes constitutes acceptance of the revised Policy.

11. Contact and Grievance Officer

Grievance Officer: Pedamallu Lakshmi Srihitha

Trading as: Global Fin X Training Academy

Address: Raithu Bidda Apartments, Simhapuri Colony, Bachupally, Hyderabad, Telangana – 500090, India

Email: info@globalfinx.in

Phone / WhatsApp: +91 83280 80730

Response time: Within 30 days of receipt.