Privacy Policy

This Privacy Policy explains what personal data Performance Lab collects when you visit our website, apply to or participate in our programs, and how we use, share and protect that data. It covers your rights under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

01Who We Are

Performance Lab ("we", "us", "our") operates the website performancelab.in and provides live online training programs in performance marketing and AI workflows. Performance Lab is operated by Xllo Corporation LLP, registered in Kerala, India ("the LLP"), which is the data controller responsible for your personal data.

By using performancelab.in and providing your information, you agree to the practices described in this policy. Where the law requires your consent (for example, analytics and marketing cookies, or marketing messages), we ask for it separately and you can withdraw it at any time.

02Data We Collect

We collect the following categories of personal data:

• Identity and contact data: name, email address, phone/WhatsApp number, city, and LinkedIn profile (if you share it) — collected when you book an assessment, fill an application or contact us.
• Application and assessment data: your responses to our admission assessment and screening questions, including your professional background, experience level, goals and availability.
• Payment data: payments (including the ₹99 assessment fee and course fees) are processed by Razorpay Software Pvt. Ltd. We receive confirmation of payment, amount, and your name/contact details — we never receive or store your card numbers, CVV, UPI PIN or banking passwords. Razorpay's handling of your data is governed by its own privacy policy at razorpay.com/privacy.
• Program participation data: attendance, homework submissions, capstone projects, messages in the cohort WhatsApp group, and recordings of live sessions in which your video, audio, name and chat messages may appear.
• Usage and device data: IP address, browser type, pages visited and similar analytics data collected through cookies and tracking technologies, where you have consented (see Section 7).

03How We Use Your Data

• To process your assessment booking, review your application, conduct screening calls and manage your enrollment.
• To deliver the program: session access links, recordings, materials, community access, certificates and support.
• To process payments and maintain financial records as required by Indian tax law.
• To communicate with you about your application, the program, schedule changes and future batches — primarily via WhatsApp and email.
• To send marketing communications about our programs, only where you have consented; you can opt out at any time (Sections 9 & 10).
• To improve our curriculum, website and admissions process using aggregated, de-identified analytics.
• To comply with legal obligations and enforce our Terms of Use and Refund Policy.

04Legal Bases for Processing (GDPR)

Where the GDPR applies to you, we rely on the following legal bases:

• Performance of a contract: processing your application, payment, enrollment and program delivery.
• Consent: analytics and marketing cookies, marketing communications, and any use of your results or testimonials in our marketing. You may withdraw consent at any time.
• Legal obligation: retaining payment and tax records as required by law.
• Legitimate interests: securing our site, preventing fraud, and improving our curriculum and admissions using aggregated analytics — balanced against your rights and freedoms.

05Session Recordings and Student Work

Live sessions are recorded so enrolled students can revisit them. Recordings may capture your name, voice, video and chat messages. Recordings are shared only with students and staff of your cohort and are not made public.

We may wish to use excerpts of student results, capstone presentations or testimonials in our marketing. We will do so only with your prior written consent (a WhatsApp confirmation counts), and you may withdraw that consent for future use at any time by contacting us.

06Who We Share Data With

We do not sell your personal data. We share it only with service providers (processors) necessary to run the program, and only to the extent needed:

• Razorpay — payment processing.
• Google (Workspace, Forms, Drive, Looker Studio, Analytics, Ads) — application forms, course materials, reporting, analytics and advertising measurement.
• Meta (Pixel, Conversions API, WhatsApp) — communication, cohort community groups, and advertising measurement.
• Zoom / Google Meet — live session delivery and recordings.

Each provider processes data under its own privacy terms and, where required, under a data-processing agreement. We may also disclose data where required by law, court order or governmental authority.

07Cookies and Advertising Pixels

Our website uses cookies and similar technologies via Google Tag Manager, including Google Analytics (GA4), the Meta Pixel and Google Ads tags, to understand site usage and measure advertising performance.

When you first visit, a cookie consent banner lets you accept or reject non-essential cookies:

• Strictly necessary cookies are always active — they keep the site, payments and security working and do not track you.
• Analytics cookies (Google Analytics) and marketing cookies (Meta Pixel, Google Ads) load only with your consent.

We honour Google Consent Mode, so Google tags adjust their behaviour based on your choice. You can change or withdraw your consent at any time using the "Cookie settings" link in our footer. You may also opt out of personalised advertising via Meta's Ad Preferences and Google's Ads Settings. Disabling cookies does not prevent you from using the site.

08Data Retention

• Applicants who do not enroll: application and assessment data retained up to 12 months, then deleted, so we can notify you of suitable future batches (unless you ask us to delete it sooner).
• Enrolled students: records, certificates and capstone work retained up to 5 years to verify certification.
• Payment and tax records: retained for 8 years as required under Indian law.
• Session recordings: retained up to 12 months after cohort completion, then deleted.

09Your Rights (DPDP Act, India)

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Request correction of inaccurate or incomplete data, and updating of your records.
• Request erasure of your personal data, subject to legal retention requirements (e.g. payment records).
• Withdraw consent at any time for processing based on consent, including marketing messages — reply STOP on WhatsApp or use the unsubscribe link in any email.
• Nominate another individual to exercise your rights in case of death or incapacity.
• Raise a grievance with us (Section 13), and if unresolved, complain to the Data Protection Board of India.

To exercise any right, contact us using the details in Section 13. We respond within 30 days.

10Additional Rights for EU / UK / EEA Users (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, you additionally have the right to:

• Access a copy of your personal data.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten"), subject to legal retention obligations.
• Restriction of processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests or direct marketing.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office; in the EU, your national data protection authority).

We do not charge for exercising these rights and aim to respond within one month.

11International Data Transfers

We are based in India and process and store data in India and with the service providers listed in Section 6, some of which store data in other countries.

If you access our services from outside India — for example, from the UAE, other GCC countries, the EU or the UK — your data is transferred to and processed in India. Where your data is protected by the GDPR, such transfers are made under appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an equivalent mechanism, and our major sub-processors (Google, Meta, Zoom, Razorpay) maintain their own transfer safeguards. By using our services, you acknowledge this transfer and processing.

12Automated Scoring and Profiling

Our admission assessment uses automated scoring to help us review applications efficiently — for example, indicating how well an applicant's background and goals fit the cohort. This scoring assists our team; it does not by itself decide admission. Every application is reviewed by a person, and shortlisted applicants have a screening call before any decision. You may ask us to explain a decision or request human review by contacting us (Section 13).

13Grievance Officer and Contact

For any privacy question, request or complaint, contact:

14Data Security

We use reasonable technical and organisational safeguards: access to student data is limited to authorised personnel, accounts are protected with two-factor authentication where available, and payment processing is handled entirely by PCI-DSS-compliant Razorpay. No method of transmission or storage is 100% secure; in the event of a personal data breach affecting you, we will notify you and the Data Protection Board of India (and any other authority required by law) as required.

15Children

Our programs and website are intended for individuals aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

16Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be announced on the website or by email/WhatsApp to enrolled students. Continued use of our services after changes constitutes acceptance.