Privacy policy

1. Who we are

This policy is issued by The Organization Learning Labs LLP (LLPIN ACV-6693), a limited liability partnership registered in India with its registered office at 48, Church St, Shanthala Nagar, Ashok Nagar, Bengaluru, Karnataka 560001, India ("OLL", "we", "us").

It applies to this website, the OLL assessment platform (platform.ollacademy.com), the organization admin portal (admin.ollacademy.com), the OLL Research library (research.ollacademy.com), and Ollie, the AI assistant on our websites (together, the "Services").

This policy is published under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 as their obligations come into force.

2. Our role

• When you visit our websites, contact us, use Ollie or sign up on your own, we decide why and how your personal data is processed. We are the Data Fiduciary and you should contact us about it.
• When your employer or another organization nominates you for an assessment, that organization decides to run the assessment and is the Data Fiduciary. We process your personal data on its behalf as its Data Processor, under a contract with it. You can contact either the organization or us; where a request belongs to the organization, we will pass it on and tell you we have done so.

3. What we collect

Information you give us

• Account details: name, work email, password (stored only in hashed form), organization name and phone number where provided.
• Role context: job role, function, department, industry and sub-industry, the role you are developing towards, and profiling answers the assessment needs.
• Assessment responses: your answers to scenario, multiple-choice, ranking and task questions.
• Goals and development inputs: priorities you set, progress you record and anything you submit during a development activity.
• Enquiries: your name, email, organization, phone number and message when you use our contact form, write to us or call us.
• Ollie conversations: the messages you type into Ollie and any contact details you choose to share with it.
• Nominations: when you nominate someone or ask us to approach a colleague, your name, email and role, and the name, role, email and organization of the person you nominate.

Information generated when you use the Services

• Results and outputs: competence scores, level bands, capability signatures and your Development Action Plan.
• Usage and log data: pages and features used, time taken, device and browser type, IP address and approximate location derived from it, and security logs.
• Campaign data: if you arrive through a link we sent you, an identifier for that campaign so we know the link was used.

We collect only what the Services need. We do not ask for passwords to other services, financial account details, health, biometric, religious or similar sensitive information, and you should not submit it in an assessment, a form or to Ollie. Payments, where made online, are handled by our payment provider and we do not store your card details.

4. Why we use it

• To create and administer accounts and deliver the assessment relevant to your role and industry.
• To produce your results and Development Action Plan, and help you interpret them.
• To report progress and completion to the organization that nominated you, where it has authorized the assessment.
• To produce aggregated capability insight for that organization, as described in section 6.
• To answer enquiries, respond through Ollie and follow up on requests you make.
• To contact a person you nominate, as described in section 7.
• To improve the assessment architecture, our research and the Services, using de-identified data.
• To keep the Services secure, prevent misuse and meet our legal obligations.

We process personal data only on a ground the DPDP Act allows:

• Your consent, which is free, specific, informed and unambiguous, and which you can withdraw at any time as easily as you gave it; or
• A legitimate use under section 7 of the DPDP Act, such as information you provide voluntarily for a specific purpose (for example, an enquiry), purposes of employment where your employer nominates you, or compliance with law, a court order or a government request.

Withdrawing consent does not affect processing that took place before you withdrew it. If you withdraw consent we need to deliver an assessment, we may be unable to continue it.

5. Who sees assessment results

• The participant sees their full results and Development Action Plan.
• OLL assessment staff access results only where needed to deliver, support and quality-assure the assessment, under confidentiality obligations.
• The nominating organization receives progress and completion updates where it has authorized the assessment, and aggregated insight as described below.

A single participant's result is an individual-level view. It is not a measure of the whole organization and we do not present it as one.

6. Aggregated insight

Department and organization views are built from authorized, aggregated results. We design them so that individual results cannot reasonably be identified, including by applying a minimum group size before a breakdown is shown. Where a group is too small to aggregate safely, the view is withheld.

7. People nominated by someone else

A colleague or your organization may give us your name, role, work email and organization so that we can invite you to an assessment or tell you about the Services. When we first contact you, we will say who nominated you and why, and link to this policy.

You are free to decline. You can ask us at any time to stop contacting you or to delete the details we were given, by replying to our message or writing to the Grievance Officer in section 17. If you do not respond, we delete nomination details within 12 months of the last contact. A person who nominates someone confirms they have a genuine work reason to do so.

8. Ollie, our AI assistant

• Ollie is an automated assistant. Its answers are generated by an AI model and can be incomplete or wrong. They are not professional, legal or employment advice.
• Your messages are sent to our AI service provider, Anthropic, to generate a reply, and are stored by us so the conversation can continue and so we can improve Ollie and follow up on requests.
• Do not share sensitive personal data, or information about other people you are not entitled to share, with Ollie.
• We keep Ollie conversations for 12 months from your last message, unless you ask us to delete them sooner. A small counter in your browser limits the number of messages per day; it holds no content.

9. Sharing and service providers

We do not sell personal data and we do not share it for advertising. We share it only:

• with the organization that nominated you, to the extent described in section 5;
• with service providers who process it on our instructions under contract, including:
  • Railway: website and application hosting;
  • Resend: sending emails, such as enquiry confirmations;
  • Anthropic: the AI model that powers Ollie;
  • providers of cloud hosting, databases, email and payment processing for the platforms;
• where required by law, a court order or a lawful request from a government authority, or to protect the rights, property or safety of our users, OLL or the public;
• in connection with a merger, acquisition or restructuring, where the recipient is bound by protections no less than this policy.

An up-to-date list of service providers is available from the Grievance Officer on request.

10. Cookies and browser storage

Our website does not use advertising, analytics or other tracking cookies. It uses only storage that is strictly necessary for features you use:

• Local storage holds Ollie's daily message counter.
• Session storage holds the details you enter in the pilot or nomination flow until you close the tab, so you do not have to retype them.

The platforms use essential cookies to keep you signed in and secure. You can clear stored data through your browser settings, but some features may then stop working. If we introduce analytics or other non-essential cookies, we will update this section and ask for your consent first.

11. Retention

• Account and assessment data: while your account is active and for 3 years after it closes or the customer contract ends, so development progress remains meaningful and we can meet legal and contractual obligations, unless a contract with your organization sets a different period.
• Enquiries, Ollie conversations and nominations: 12 months from the last interaction.
• Security logs: at least 1 year, as required by law.
• Tax and accounting records: for the period Indian tax law requires.

When the purpose is served and no law requires us to keep it, we delete personal data or de-identify it. Before deleting account data for inactivity, we will give you at least 48 hours' notice so you can sign in or download your reports. De-identified and aggregated data may be kept for research.

12. Security and breaches

We use reasonable security safeguards, including access controls, encryption in transit, segregation of assessment content and results, restricted and logged access to identifiable results, and contractual security obligations on our providers. No system is completely secure, but we work to limit both the likelihood and the impact of an incident.

If a personal data breach occurs, we will inform affected individuals without delay and notify the Data Protection Board of India and CERT-In within the times the law requires, explaining what happened, the likely consequences and the steps we are taking.

13. Your rights

Under the DPDP Act and other applicable law, you can:

• get a summary of the personal data we hold about you and how we process it;
• ask us to correct, complete or update it;
• ask us to erase it, unless we must keep it to meet a legal obligation;
• withdraw a consent you gave;
• nominate another person to exercise your rights if you die or become unable to act, by writing to us with that person's name and contact details;
• raise a grievance with us, and then with the Data Protection Board of India.

To use any of these rights, write to the Grievance Officer in section 17. We may need to verify your identity first. Where your employer nominated you, we may pass part of your request to them. If the General Data Protection Regulation applies to you, you also have the rights it provides, including to complain to your supervisory authority.

14. Transfers outside India

We are based in India. Some service providers, including our email and AI providers, may store or process personal data in other countries. We transfer personal data outside India only under contracts that require it to be protected, and never to a country the Government of India has restricted under section 16 of the DPDP Act.

15. Children

The Services are intended for working professionals aged 18 or over and are not directed at children. We do not knowingly process personal data of anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

16. Changes to this policy

We may update this policy as the Services or the law change. We will post the revised version here with a new date and, where a change is significant, tell account holders by email or on the platform before it takes effect.

17. Grievance Officer and contact

For any question about this policy, to use your rights, or to raise a grievance about how your personal data has been handled, contact our Grievance Officer:

• Name: Parikshit Roy Chowdhury, Founder and Designated Partner
• Email: [email protected]
• Phone: +91 76766 46518
• Post: The Organization Learning Labs LLP, 48, Church St, Shanthala Nagar, Ashok Nagar, Bengaluru, Karnataka 560001, India

We acknowledge grievances within 48 hours and resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is accepting complaints.

This policy is published in English. If you need it in another language listed in the Eighth Schedule to the Constitution of India, write to us and we will provide it. Our terms and conditions also apply to your use of the Services.