Toddle & DPDPA

Toddle’s role

Toddle handles personal data in two ways.

When a school uses Toddle, the school is the Data Fiduciary for student, parent and staff personal data. Toddle is a Data Processor and processes that data only on the school’s instructions.

When you interact with Toddle directly, for example by visiting toddleapp.com, requesting a demo, registering for a webinar, subscribing to our newsletter, completing a form or applying for a job, Toddle is the Data Fiduciary and decides why and how that data is used, as described in our Privacy Policy.

How Toddle Protects Your Data Under DPDPA 

Lawful Processing

Where Toddle is a Data Processor, it processes personal data only on the instructions of the Data Fiduciary (typically the school) and only for the lawful purposes the school has specified. Where Toddle is the Data Fiduciary, it processes personal data only for the purposes set out in our Privacy Policy, on the basis of your consent or another legitimate use permitted by the DPDPA.

Security Measures

Your data security is our priority. We use reasonable security safeguards, including encryption in transit and at rest, to protect your personal information from unauthorized access, changes, or misuse. We continuously adapt our practices to stay ahead of new threats.

Data Breach Notification

Where Toddle is a Data Processor, Toddle will notify the affected school, as the Data Fiduciary, without undue delay, and give it the information it needs to inform the Data Protection Board of India and each affected Data Principal. Where Toddle is the Data Fiduciary, Toddle will itself inform the Data Protection Board of India and each affected Data Principal, as required by the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. In both cases, Toddle will also take immediate steps to mitigate risks and prevent further harm.

Parental Consent

Toddle understands the importance of protecting the privacy of children (defined as individuals below the age of 18). As a Data Processor under the Digital Personal Data Protection Act, 2023 (DPDPA), Toddle processes data only on the instructions of the Data Fiduciary (typically the school/teacher). The Data Fiduciary is responsible for obtaining verifiable parental consent before any child’s personal data is processed. To support this process, Toddle has provided a consent form which can be downloaded from here.

Your Rights Under DPDPA

If your personal data was shared with Toddle by your school, your school is the Data Fiduciary. Please send any request under the rights below to your school, or write to privacy@toddleapp.com and we will pass it on and support your school in responding. For personal data you gave Toddle directly, write to privacy@toddleapp.com and Toddle will respond to you itself.

Right to Access Information About Your Personal Data

You can ask at any time for a summary of all your personal data being processed along with the related processing activities. You can also request the identity of any other Data Processors and Data Fiduciaries with whom your personal data has been shared.

Right to Correction, Updation & Completion

Toddle respects your right to have accurate and complete information. If you find that any personal data we hold is inaccurate, incomplete, or needs updating, you can request its correction, updation, or completion by contacting privacy@toddleapp.com.

Right to Erasure

If you want your personal data deleted, please write to privacy@toddleapp.com, or contact your school if your school shared your data with Toddle. Your personal data will be deleted from Toddle’s records unless the law requires it to be kept.

Right to Withdraw Consent

Where your personal data is processed on the basis of your consent, you can withdraw that consent at any time. Withdrawing consent should be as easy as giving it. Parents and lawful guardians can withdraw consent given on behalf of a child.

For consent you gave Toddle directly, for example to receive marketing emails, you can withdraw it by unsubscribing from those emails or writing to privacy@toddleapp.com. Toddle will then stop processing the affected personal data within a reasonable time, unless the law requires it to be kept. Where your school obtained the consent, Toddle will act on the school’s instructions. Withdrawal does not affect the lawfulness of processing carried out before it.

Right of Grievance Redressal

If you have any questions or concerns about your data privacy rights under the DPDPA, you can reach out to Toddle’s Data Protection Officer, Anshul Chauhan, at privacy@toddleapp.com. If your grievance is not resolved, you can approach the Data Protection Board of India.

Right to Nominate an agent

The DPDPA recognizes your right to appoint a representative to manage your data privacy rights in case of death or incapacitation. Toddle will uphold your designated representative’s authority.

Our employees

All our employees get periodically trained in relevant data security practices. They complete background checks, and sign non-disclosure agreements and immediately lose access to all systems and data when terminated.