← Back to home1. Who we are
The Bharat Innovation Olympiad ("BIO") is run by Lemon Ideas ("we"). We decide why and how the personal data described here is used, so under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary.
For anything about your personal data — questions, requests or complaints — write to our Grievance Officer at olympiad@lemonideas.in, or raise a Support ticket under "Privacy & your data".
2. What we collect, and why
- Participant's name, email, mobile number, class, section and school — to create the account, allot an exam sitting, send exam information, and publish results and certificates.
- Parent or guardian's name, email and mobile number, and the participant's date of birth, gender, city and state — to obtain and record parental consent and to contact the parent or guardian.
- A photo of an identity document — to confirm, before the exam, that the participant is who they say they are.
- A face template (a set of numbers computed in your browser, not a photo) and, only if an exam rule is broken, a snapshot at that moment — to proctor the online exam fairly.
- Exam answers, scores, rank and certificates — to evaluate the exam and issue results.
- Payment status and Razorpay reference numbers — to confirm the registration fee. Card, UPI and bank details are entered only on Razorpay's own page; we never see or store them.
- Messages we send you (email, SMS, WhatsApp) and whether they were delivered — so we know exam information reached you.
- Sign-in records: time, method, IP address and device/browser type, including failed attempts — to keep accounts secure and to meet our legal duty to keep security logs (CERT-In).
We do not sell personal data, show advertising, or track participants for marketing. This site has no third-party analytics or advertising trackers.
3. Children and parental consent
Participants are in Grades 6 to 12, so most are under 18. We process a child's personal data only with the consent of their parent or lawful guardian, which is given on the registration form and in the guardian step, and recorded with its date and version.
We do not use children's data for behavioural monitoring, profiling or targeted advertising. Exam proctoring is used only during the exam, only to keep it fair, and is explained before the exam starts.
4. Who we share it with
Service providers who process data only on our instructions: Amazon Web Services (hosting, storage and email, in India), Razorpay (payments), WATI (WhatsApp messages), 2Factor and SMSJust (SMS), Resend (email), Cloudinary (older media files) and Neon (database hosting).
Results are shared with the participant's school and, where applicable, the partner organisation that enrolled the school.
Our main systems are in India (Hyderabad). A copy of some records is also held by Neon in Singapore for our staging environment.
We disclose data to authorities only when the law requires it.
5. How long we keep it
- Sign-in codes: deleted within a week of expiry.
- Sign-in records and security logs: 180 days, as CERT-In requires, then deleted.
- Payment records: for the period tax and accounting law requires.
- Certificates: kept so that a printed certificate can always be verified.
- Everything else: while the account is active and for the olympiad season it relates to. When it is no longer needed, or when you ask us to erase it, we delete or anonymise it — except what the law requires us to keep.
5A. How we protect it
Encrypted connections (HTTPS) everywhere; data encrypted at rest; sign-in sessions held in secure cookies that page scripts cannot read; rate limits and a web application firewall; access limited to staff who need it; and an incident process. If a breach affects your data, we will tell you and the Data Protection Board of India without delay.
6. Your rights
- Access — on your Profile page, "Download my data" gives you a copy of the personal data we hold about you.
- Correction and update — edit your profile, or raise a Support ticket under "Privacy & your data → Correct my data".
- Erasure — on your Profile page, "Request deletion", or Support → "Privacy & your data → Delete my data".
- Withdraw consent — Support → "Privacy & your data → Withdraw consent". Withdrawing does not affect what was lawfully done before, but it ends participation in the olympiad.
- Nominate a person to exercise these rights if you die or become unable to — write to olympiad@lemonideas.in.
- Grievance — raise a Support ticket or write to olympiad@lemonideas.in. We respond as soon as we can and within 90 days at most. If you are not satisfied, you may complain to the Data Protection Board of India.
A parent or guardian exercises these rights on behalf of a participant under 18.
This notice is available in English; on request we will provide it in any language listed in the Eighth Schedule to the Constitution.