Privacy Policy

This Privacy Policy explains how Prism School of Music, a unit of PSOM Studios Private Limited (“Prism”, “we”, “us” or “our”), collects, uses, shares and protects personal data when you visit our website, contact us, book a demo, enrol, or take classes with us, online or at any of our schools, including Origin Story. It is issued in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and the Information Technology Act, 2000 and the rules made under it, to the extent applicable.

Under the DPDP Act, Prism is the Data Fiduciary for your personal data, and you are the Data Principal. Where a student is under 18, the parent or lawful guardian acts on the child's behalf.

1. personal data we collect

We collect only the personal data we need to provide our services. Depending on how you interact with us, this may include:

• Contact and enquiry details: name, mobile or WhatsApp number, e-mail address, preferred course and school, and the contents of your messages to us.
• Enrolment details: the student's name, date of birth or age, parent/guardian details for students under 18, address, emergency contact, course, level and schedule.
• Payment details: fees paid, invoices, instalment records and transaction references. Card and bank details are processed by our payment partners; we do not store full card numbers.
• Learning records: attendance, lesson notes, assessments, exam registrations, results and Student Progress Reports.
• Health and accessibility information that you choose to share with us so we can keep a student safe and make reasonable accommodations, such as allergies, medical conditions or learning needs.
• Photographs, audio and video of lessons, recitals and events, only as described in section 5.
• Technical data when you use our website: IP address, device and browser type, pages visited, referring pages, and cookie identifiers.

2. how we collect IT

We collect personal data directly from you when you fill in a form on our website, message us on WhatsApp, call or e-mail us, register at a school, or use our app; from your use of our website through cookies and similar technologies; and, where you arrive through an advertisement, from the advertising platform that referred you.

3. why we use IT

We process personal data on the basis of your consent, or for the legitimate uses permitted under Section 7 of the DPDP Act, such as where you voluntarily provide data for a specified purpose, and to comply with law. We use personal data to:

• respond to enquiries and arrange free demos;
• register and enrol students, schedule and conduct lessons, and manage attendance and rescheduling;
• issue invoices, collect fees and process refunds;
• track progress, prepare students for graded exams and register them with exam boards;
• keep students safe, including in a medical emergency;
• send service messages about classes, schedules, fees, recitals and events by WhatsApp, SMS, e-mail or phone;
• send information about new courses, workshops and events, where you have agreed to receive it. You can opt out at any time;
• operate, secure and improve our website, app and services; and
• comply with our legal, tax and accounting obligations, and establish or defend legal claims.

We do not sell your personal data.

4. children's personal data

Under the DPDP Act, a child is anyone under 18. Many of our students are children, including in our K-12 Programme for ages 3 to 12. We process a child's personal data only with the verifiable consent of the parent or lawful guardian, which we obtain at enrolment, and only for the purposes set out in this Policy.

We do not track or behaviourally monitor children, and we do not direct targeted advertising at children. We do not process a child's personal data in any way that is likely to cause harm to the child. Our advertising is aimed at adults and parents.

5. photographs, videos and recordings

We may photograph or record lessons, recitals and events for our records and, with consent, for use on our website and social media. We use a student's image, name or recordings for promotional purposes only with the specific written consent of the student (if 18 or over) or of the parent or guardian (if under 18). You can refuse or withdraw this consent at any time by writing to us. We will then stop further use and take reasonable steps to remove the material from our channels, although material already published may not always be fully retrievable.

6. who we share IT with

We share personal data only as needed to run our services, and with service providers who are bound to protect it and to use it only on our instructions. These may include:

• payment gateways and banks, to process fees and refunds;
• messaging, telephone, e-mail and SMS providers, including our WhatsApp Business service provider;
• cloud hosting, software and student-management system providers;
• examination boards, such as ISoM, Trinity College London, ABRSM, RSL Rockschool and LCME, when a student registers for an exam;
• analytics and advertising platforms, such as Google and Meta, in relation to website use as described in section 7; and
• professional advisers, auditors, and government, regulatory or law-enforcement authorities where required by law, including under the Protection of Children from Sexual Offences Act, 2012.

Some of these providers may store or process data outside India. Any such transfer is made in accordance with the DPDP Act and any restrictions notified by the Government of India.

7. cookies and analytics

Our website uses cookies and similar technologies to make the site work, to understand how visitors use it, and to measure the effectiveness of our advertising. These may include analytics and advertising tools from providers such as Google and Meta. You can block or delete cookies in your browser settings; the website will still work, although some features may be limited.

8. how we protect IT

We use reasonable security safeguards to protect personal data against unauthorised access, use, disclosure, alteration or loss, including access controls, restricted access on a need-to-know basis, and encryption in transit where supported. No system is completely secure, but we work to protect your data and to limit the harm of any incident.

If a personal data breach occurs, we will inform the affected Data Principals and the Data Protection Board of India as required by the DPDP Act and the DPDP Rules.

9. how long we keep IT

We keep personal data only for as long as it is needed for the purpose for which it was collected, or as required by law, including tax, accounting and record-keeping laws and any minimum retention periods under the DPDP Rules. Enquiry data from people who do not enrol is deleted or anonymised when it is no longer needed. When personal data is no longer required, we delete or anonymise it.

10. your rights

Subject to the DPDP Act, you have the right to:

• obtain a summary of the personal data we hold about you and the processing we carry out;
• have inaccurate or incomplete personal data corrected, completed or updated;
• have personal data erased when it is no longer needed, unless we are required by law to keep it;
• withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out, and it may mean we can no longer provide some services;
• have your grievances redressed; and
• nominate another person to exercise these rights on your behalf in the event of death or incapacity.

A parent or guardian may exercise these rights for a child. To make a request, e-mail mgmt@prismschoolofmusic.com. We may need to verify your identity before acting on a request.

11. grievances and complaints

If you have a concern about how we handle personal data, write to our Grievance Officer at mgmt@prismschoolofmusic.com, or contact the administrator at any of our schools. We will acknowledge your complaint within 48 hours and aim to resolve it within 15 business days, and in any case within the 90 days allowed under the DPDP Rules.

If you are not satisfied with our response, you may complain to the Data Protection Board of India after exhausting this grievance process, as provided under the DPDP Act.

12. changes to this policy

We may update this Policy to reflect changes in the law or in how we work. The current version is always available on this page. Where changes are significant, we will let enrolled students and parents know through our usual communication channels.

13. contact us

Prism School of Music, a unit of PSOM Studios Private Limited. E-mail: mgmt@prismschoolofmusic.com. Schools: Sector 38, Gurugram; Sector 10, Faridabad; Chittaranjan Park, New Delhi; and Origin Story, Sushant Lok Phase I, Gurugram.