HELM

Privacy Policy

Effective date: 19 July 2026

1. Introduction

This Privacy Policy explains how the HELM platform (my.thehelm.co.in) collects, uses, and protects your personal data, and your rights under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”). HELM is the data fiduciary for the personal data described here.

2. Data we collect

  • Account data: your name, email address, and password (stored only as a secure hash).
  • Consent record: the date you agreed to our Terms and Privacy Policy and the version you agreed to, kept as proof of consent.
  • Learning activity: course enrolments, lesson progress, quiz attempts, and certificates issued to you.
  • Hackathon activity: registrations and the submissions you upload (documents and text).
  • Directory data: the business listing details you submit.
  • Technical data: limited server logs and a session cookie required to keep you signed in.

3. Why we use it and our lawful basis

We process your data to provide the Platform — to authenticate you, deliver courses, record progress, issue certificates, run hackathons and forward submissions to organisers, publish approved directory listings, and keep the service secure. Our lawful basis is your consent (given at signup) and the performance of the service you request. We do not sell your personal data.

4. Cookies

We use a single, strictly necessary session cookie to keep you signed in. It is httpOnly and is not used for advertising. We do not run third-party advertising or cross-site tracking on the Platform.

5. Sharing and processors

We share data only as needed to run the Platform, with service providers acting on our instructions: our video provider (Bunny Stream) for hosting and delivering course video, and our email provider (Resend) for transactional email such as verification, password reset, and hackathon submission notifications. Hackathon submissions are shared with the organiser email configured for that hackathon. We may disclose data where required by law.

6. Retention

We keep your personal data for as long as your account is active and as needed to provide the Platform and meet legal obligations. Issued certificates are retained as a durable record of achievement. When data is no longer required, we delete or anonymise it.

7. Your rights under the DPDP Act

Subject to the DPDP Act, you have the right to access and correct your personal data, to withdraw consent, to seek erasure, and to grievance redressal. Some of these are currently handled manually — to exercise a right, contact us (Section 9) and we will respond within a reasonable time. Self-service data export and erasure, and a consent preferences page, are planned enhancements.

8. Security

We protect your data with measures including encrypted transport (HTTPS), hashed passwords, access controls, validated and re-encoded file uploads, and private storage for uploaded documents that is never served publicly. No system is perfectly secure, but we work to safeguard your information.

9. Contact

For any privacy question or to exercise your rights, contact us through the details published on thehelm.co.in. This policy forms part of our Terms of Service.