Privacy · in effect 5 September 2026
Privacy policy
Version 2.7, in effect from 5 September 2026, and it supersedes every earlier version of this page. Playway Books may revise this text; the version and date above change when it does, and continued use of this website after that is acceptance of the revision. If you need the text as it stood on a particular date — because you are relying on it — write and ask, and it will be sent to you.
What this site actually does with data
Two forms, no accounts, and measurement and advertising that wait until you agree — separately. This site sells nothing directly, so it takes no payment details and stores no card data. Since 4 September 2026 Analytics and Advertising each run through Cloudflare Zaraz and each asks you first: refuse either and no identifier is created and nothing is recorded for it. The one cookie this site sets for itself is the one that remembers both answers. Google Analytics 4 and Google Ads are sent from Cloudflare’s own servers rather than from your browser, so no Google address is contacted by any page here; Microsoft Clarity, the other tool behind Analytics, is different — its script does contact Microsoft directly once you agree, and the cookies page says so in full. All three still receive what they’re sent, if you agreed, and are named as processors below. PostHog is separate from all of that and does not wait for anything: it is a script pasted directly into every page, not a Zaraz tool, and it runs whether you agree to Analytics, refuse it, or never see the panel. The cookies page names everything that can be set, and the control that changes your answer is on it — for the two questions PostHog is not one of.
The personal data we collect is what you send us through a form. There are two, both run for us by HubSpot: the sample-copy enquiry on For Schools and the message form on Contact. Both are part of the page they sit on, so opening either page contacts HubSpot and lets HubSpot set a visitor token in your browser, whether or not you go on to write anything. What you type goes to HubSpot’s European servers and to us, and it is used to answer you — nothing else. The forms are not behind the consent panel, and the two are on different terms deliberately: measurement waits to be asked, a form embed does not, and the cookies page states the difference rather than letting one rule appear to cover both. Every page on this site also contacts PostHog, regardless of whether you have agreed to Analytics or Advertising — that is described in full above and in the table on the cookies page. Beyond PostHog and the two form pages, nothing else contacts anybody unless you have agreed to Analytics or Advertising.
One thing is counted, and it is not about you. A Buy press passes through this site before it opens Amazon, Flipkart or JioMart, and adds one to a running total for that shop, that day. No cookie, no identifier, no row per person. A counter cannot be turned back into a reader, which is the only reason it is allowed to exist here.
We never sell your data, and we never will. No data broker, no advertising network, no mailing list, no exchange with anyone for money or for anything else.
This page was drafted for this website and this company on 2 September 2026. It states the law as we understand it and describes what we actually do, but it has not yet been settled by a lawyer, and it is not legal advice. If anything here is wrong, tell us at learn@playwaybooks.com and it will be corrected rather than defended.
Who is responsible for your data
Playway Books Pvt Ltd, of 43/2153, Jewel Homes, Flat E1, Whitefield, A-Block, SRM Road, Kaloor, Ernakulam, Kerala 682018, India, is the Data Fiduciary for the personal data described on this page — that is the term the Digital Personal Data Protection Act, 2023 uses for the person who decides why and how data is processed. You are the Data Principal. Our grievance and data-protection contact is published at the foot of this page and on the grievance page.
Which law applies, and when
This policy is written to the Digital Personal Data Protection Act, 2023. The DPDP Rules, 2025 were notified on 13 November 2025 and commence in stages: the consent-manager provisions from 13 November 2026, and the substantive compliance obligations from 13 May 2027.
So most of the DPDP obligations are not yet in force, and we are meeting them anyway. Notice, purpose limitation, a stated retention period, erasure on request and a published grievance route are all in place today rather than in 2027. Until then, the binding rules are s. 43A and s. 72A of the Information Technology Act, 2000 with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and this page satisfies rule 4 of those Rules as the published privacy policy they require.
We do not knowingly collect any of the categories the 2011 Rules treat as sensitive personal data — passwords, financial or card details, health, biometric, sexual orientation or medical records. Please do not put any of those in the notes field. If you do, we will delete it.
Exactly what is collected, and why
This table is the site's own inventory, kept in one file rather than typed into a page. Until 3 September 2026 it was checked against the database schema and the endpoint of the form Playway Books ran itself; both were deleted with that form, and the two forms here now are HubSpot's, whose fields are edited in HubSpot rather than in this website. So read the categories below as what an enquiry can contain, not as a column list. If a category is added, it is added here in the same change.
| What | Why it is held | Source |
|---|---|---|
| School name | To answer the enquiry and address the quotation. | You type it |
| Board, class and approximate number of copies | To price the order and send the right sample. | You type it |
| Your name | So a reply is addressed to a person. | You type it |
| Email address | To reply. It is not added to any mailing list. | You type it |
| Telephone number, if you give one | To ring you instead of writing, where that is quicker. Optional. | You type it |
| Anything you write in the notes field | Because you asked us to read it. | You type it |
| Whatever else the form asks for | The two forms are run for us by HubSpot and their fields are edited there rather than in this website’s code, so this list names the categories rather than a fixed set of boxes. What is constant is the purpose: to answer you, send a sample copy and prepare a quotation. | You type it |
| A visitor token set by HubSpot | Set in your browser by HubSpot as soon as either form page loads, so that a form you begin and a form you send are recognised as the same visit. It is HubSpot’s rather than ours, and it is set whether or not you go on to write anything. | On loading /for-schools/ or /contact/ |
| Which pages you read, and for how long | Collected only if you agree to Analytics, against an identifier held for Google Analytics 4, so that Playway Books can see which pages are read and which are not. Cloudflare Zaraz asks before anything measures anything and sends the events from its own servers rather than from your browser, so no Google address is contacted by any page here. Refuse and no identifier is created; the control on the cookies page changes that answer at any time. | On agreeing to Analytics, on any page |
| Mouse movement, clicks and scrolling, recorded as session replay and heatmap data | Collected only if you agree to Analytics, by Microsoft Clarity — a second, independent tool behind the same question as Google Analytics 4 rather than a feature of it. Unlike Google Analytics 4, Clarity’s script runs in your browser and sends what it records to Microsoft directly — www.clarity.ms, scripts.clarity.ms and u.clarity.ms — rather than through Cloudflare. Refuse and it never loads; the control on the cookies page changes that answer at any time. | On agreeing to Analytics, on any page |
| An advertising and remarketing identifier held for Google Ads | Collected only if you agree to Advertising — a separate question from Analytics, and you may answer them differently. Cloudflare Zaraz sends it from its own servers rather than from your browser, so no Google address is contacted by any page here. Refuse and no identifier is created; the control on the cookies page changes that answer at any time. | On agreeing to Advertising, on any page |
| Your answer to the consent panel | The one cookie this site sets for itself. It records which purposes you agreed to and nothing else — no identifier, no history — so that you are not asked again on every page. A refusal has to be remembered to be honoured, which is why this is the one thing a refusal does not remove. | On answering the panel |
| A count of Buy button presses, per shop per day | The one measurement this site takes by itself, whether or not you agree to the other. It is a running total and holds no identifier of any kind, so it cannot be worked backwards to a person. | Counted, not collected |
What is not collected
No account, because there are none. No password. No card, UPI or bank detail — this site cannot take one. No device fingerprint, and no advertising identifier of our own — Google’s, if you agree to Advertising, is described below. We buy no data about you from anybody and we build no profile of you across the web.
And what Google and Microsoft collect, if you agree to it. If you agree to Analytics: which pages you read, in what order and for how long, against an identifier held for Google Analytics 4; and, separately, session replay and heatmap data — mouse movement, clicks and scrolling — recorded by Microsoft Clarity, a second, independent tool added alongside it rather than a feature of it. If you agree to Advertising, a separate question: an advertising and remarketing signal held for Google Ads. None of that happens until you answer the panel, and refusing means no identifier is created for any of it. Cloudflare Zaraz sends the Google Analytics 4 measurement and the Google Ads signal from its own servers rather than from your browser, so Google never sees a request from your machine for either. Microsoft Clarity is different, and we say so rather than letting the same claim cover it by accident: its script runs in your browser once you agree to Analytics, and it contacts Microsoft directly — www.clarity.ms, scripts.clarity.ms and u.clarity.ms. One thing does NOT bound the scope beyond your answer, and it is worth stating plainly rather than leaving the sentence above to imply otherwise: PostHog. It counts pages read and elements clicked, against an identifier kept in this browser's local storage, and it runs on every page regardless of what you answer or whether you are ever asked — it is not a Zaraz tool and it is not behind the panel. The site's content security policy still names every address a script may talk to, so nothing beyond what is named here and on the cookies page could be added quietly without also changing this repository.
No automated decision-making and no profiling. Nothing on this site scores, ranks, segments or decides anything about you by machine. A person reads every enquiry.
Our legal basis for holding it
Under the DPDP Act, 2023 personal data may be processed on consent under s. 6, or for a “certain legitimate use” under s. 7. We rely on both, and each is tied to a specific purpose:
- · Your consent, given by submitting the enquiry form after reading the notice printed beside it. The purpose is to answer your enquiry, send a sample copy, prepare a quotation and follow it up. That is the whole purpose; the data is not used for anything else.
- · Section 7(a), voluntary provision for a specified purpose, where you write or ring us and give us your details so that we can reply.
- · Legal obligation, where a tax, company law or CERT-In requirement means a record has to be kept for a stated period. The retention table below names the law for each one.
Consent can be withdrawn at any time: one line to learn@playwaybooks.com is enough, and no reason is required. Withdrawal does not make unlawful anything done while consent was in force, and it does not remove a record a law obliges us to keep — if that applies, we will tell you which law and for how long.
The measurement has its own answer on file, and its own way back. Since 4 September 2026 you are asked before anything measures anything, so there is a recorded answer to withdraw — and withdrawing it takes one press rather than an email. The cookies page carries the control that reopens the panel, and a refusal there is honoured from that moment. Your browser still works as well as it ever did, on all of it including the two form pages, and the same page explains how. If you would rather Playway Books held nothing about you at all, the email address above will have it deleted.
We do not send marketing email. There is no mailing list, no newsletter and no drip sequence. If we write to you, it is about the enquiry you made.
Children
This site is written for teachers, heads of department, procurement offices and parents. It is not directed at children, and we do not knowingly collect personal data from anyone under eighteen.
Section 9 of the DPDP Act, 2023 requires verifiable parental consent before a child’s data is processed, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. Since 4 September 2026 that is no longer a clean “we run none of it”: Google Ads carries an advertising and remarketing signal, and Microsoft Clarity records session replay and heatmap data rather than page counts alone. Neither is directed at children or targets anyone by age — both run the same way for every visitor, behind the Analytics or Advertising question rather than anything that identifies who is reading, and neither builds a profile of a child specifically. It is nonetheless the part of this site a parent is most likely to want switched off for a child, and since 4 September 2026 there is something to switch: refusing the panel stops Analytics and Advertising outright, and the control on the cookies page changes either answer at any time. PostHog is not switched off by that panel, because it was never behind it; it also does not identify anyone by age or by name, and the browser controls the cookies page describes stop it the same way they stop everything else the panel cannot reach. What this site still cannot do is tell who is reading, so an answer given on a shared machine is the machine's answer rather than a particular child's — which is why the browser controls on the same page are named beside it, and why the enquiry form asks for a school and an adult contact rather than a student. If you believe a child has sent us data, write to learn@playwaybooks.com and it will be deleted without argument.
Who else can see it
Five parties: Cloudflare, HubSpot, Google, Microsoft and PostHog. Cloudflare, HubSpot and PostHog process solely on our instructions, under a contract that says so — PostHog's is its own published Cloud terms. Google is different, and named as different: Google Analytics 4 and Google Ads are Google's own processing as well as ours, done under Google's terms rather than ours. What changed on 4 September 2026 is that each now waits on its own question — Analytics or Advertising — and Cloudflare sends both from its own servers, so Google never sees a request from your browser for either. Microsoft is different again: Microsoft Clarity's script runs in your browser directly once you agree to Analytics, so unlike Cloudflare, HubSpot and Google it reaches Microsoft without passing through Cloudflare at all. PostHog also runs directly in your browser, like Clarity, but on every page and without waiting for Analytics or anything else — the only party here that is both direct-contact and unconditional. Nobody else. We do not sell, rent, barter or share personal data with any advertiser, broker or list.
| Who | What they do with it | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts this website. Its database holds the daily count of Buy-button presses, which is the only thing anything on this site writes any more. Since 4 September 2026 Cloudflare also runs the consent panel through Zaraz, asking you first and recording your answer in a first-party cookie kept in your own browser rather than that database. If you agree to Analytics, Zaraz sends Google Analytics 4’s measurement to Google from its own servers rather than from your browser, and separately delivers Microsoft Clarity’s script to your browser — Clarity then reports to Microsoft directly rather than through Cloudflare. If you agree to Advertising, Zaraz sends the Google Ads signal to Google the same way it sends Google Analytics 4’s. | Processed on servers in the ENAM region. Cloudflare is a global network and traffic may transit outside India. |
| HubSpot, Inc. | Runs the enquiry form on the schools page and the message form on the contact page, and holds what you type into either. The form is part of those two pages, so HubSpot is contacted when either one opens rather than when you start writing. | Processed in HubSpot’s European Union region (eu1). Only those two pages contact HubSpot; the rest of the site does not. |
| Google LLC | Google Analytics 4, which records which pages are read, and Google Ads, which carries an advertising and remarketing signal — asked about separately, as Analytics and Advertising. Each runs on every page but only if you agreed to it, and since 4 September 2026 each reaches Google from Cloudflare’s servers rather than from your browser — so Google receives neither without seeing a request from your machine. | Google is a global network and processing may happen outside India. |
| Microsoft Corporation | Microsoft Clarity, which records session replay and heatmap data — mouse movement, clicks and scrolling, not just which pages you read. It runs on every page but only if you agree to Analytics, and unlike every other processor here its script runs in your browser and reports to Microsoft directly — www.clarity.ms, scripts.clarity.ms and u.clarity.ms — rather than through Cloudflare’s servers. | Microsoft is a global network and processing may happen outside India. |
| PostHog | A second product-analytics tool, added 5 September 2026, which counts pages read and elements clicked. Unlike everything else in this table it is not a Zaraz tool: its script is pasted directly into every page and runs on every page unconditionally, with no consent question. It processes this solely on our instructions and for no purpose of its own, and session recording stays off. | Processed on PostHog Cloud EU, hosted in Frankfurt, Germany. No data leaves the EU. |
Disclosure we are compelled to make
We will disclose personal data where a court, a police officer acting under lawful authority, a tax authority or a regulator requires it, or where disclosure is necessary to establish, exercise or defend a legal claim, or to prevent an imminent harm. We will ask to see the authority, disclose the minimum the demand actually requires, and — unless the law forbids telling you — tell you it happened.
Transfer outside India
The data is held on infrastructure provisioned in India, but our host operates a global network and traffic may transit outside the country. Section 16 of the DPDP Act, 2023 permits transfer except to a country the Central Government has restricted; no such restriction affects our processing at the date of this policy, and if one ever does, the arrangement changes rather than the policy.
If the business changes hands
If Playway Books is sold, merged or reorganised, enquiry records may transfer to the successor, bound by this policy or one no less protective. We will publish notice of it here, and you may ask for erasure first.
How long each thing is kept
A retention period is a promise you can hold us to, so each one names what ends it. Data is erased when the purpose it was collected for is served and no law requires it kept.
| What | How long, and why |
|---|---|
| An enquiry that led to no order | Kept for 24 months from the last contact about it, then deleted. |
| An enquiry that led to an order | Kept for 8 financial years, because the invoice it relates to must be — s. 36 of the CGST Act, 2017 requires 72 months and the Companies Act, 2013 requires 8 years for books of account. |
| The daily count of Buy button presses | Kept indefinitely. It contains no personal data to delete. |
| Server and security logs | Retained for 180 days, which is what the CERT-In Directions of 28 April 2022 require. |
| Anything you ask us to erase | Deleted on request and confirmed, except where a law requires the record to be kept — in which case we will tell you which law and for how long. |
Your rights, and how to use them
One email exercises any of these: learn@playwaybooks.com. Tell us which right you are exercising and enough about the enquiry for us to find it. There is no form, no fee and no account to log into. We answer within 30 days and usually the same week.
| Right | What it means here |
|---|---|
| Access | A summary of the personal data we hold about you and what we have done with it. Section 11. |
| Correction and completion | Correction of anything inaccurate, and completion of anything incomplete. Section 12. |
| Erasure | Deletion of your personal data, unless a law requires us to keep it. Section 12. |
| Withdrawal of consent | As easily as it was given. Section 6(4)-(6) — which is why the consent panel can be reopened from the cookies page in one press, rather than only by writing to us. Withdrawing it does not undo what was lawfully done before. |
| Grievance redressal | A complaint to the Grievance Officer, answered in the times published on the grievance page. Section 13. |
| Nomination | You may nominate another person to exercise these rights if you die or become incapacitated. Section 14. |
| Complaint to the Board | If our answer does not satisfy you, a complaint to the Data Protection Board of India. Section 13(3) requires you to have exhausted the grievance route with us first. |
We may ask you to confirm who you are before acting on a request — not to obstruct it, but because handing someone else’s enquiry to the wrong person is itself a breach. Section 15 of the DPDP Act, 2023 places a duty on you too: not to make a false or frivolous request, and not to impersonate someone else in making one.
If our answer does not satisfy you, complain to the Data Protection Board of India. Section 13(3) requires you to have exhausted our grievance route first, which is why the address below matters.
How it is kept safe
Everything on this site is served over HTTPS with HSTS, so what you type into a form is encrypted in transit. The site carries a strict Content Security Policy that will not load a script, a stylesheet, a font or an image from anywhere it does not name — which is why there is no room on this site for a tracking pixel to be added by accident, and why anything added to the Cloudflare configuration that ran in your browser would be refused until this site allowed the address it talks to. The three typefaces are served from our own domain rather than a font CDN. Access to what a form collects is limited to the people at the office who answer enquiries.
The forms carry a bot check, so that automated submissions can be turned away. That is an anti-abuse measure, not tracking.
No system is perfectly secure and we will not pretend otherwise. What we will do is tell you. If a breach affects your personal data we will notify you and the Data Protection Board as the DPDP Act requires, and report the incident to CERT-In within the six hours its Directions of 28 April 2022 allow. Security logs are retained for 180 days for the same reason.
Found a weakness? Write to learn@playwaybooks.com. Responsible disclosure is welcome and will never be met with a legal threat — see clause 6 of the terms of use.
Cookies, in one line
This site sets one of its own, and it holds your answers to the consent panel — Analytics and Advertising are asked about separately. Four third parties may set theirs: Google (Analytics 4 and Ads) and Microsoft (Clarity) on every page but only if you agree, each behind its own question; HubSpot on the two pages that carry a form, as they load and without asking; and PostHog on every page, also without asking and without a Zaraz tool behind it. The cookies page sets out all four in full, carries the control that changes your answer, and explains the browser settings that stop all of it.
Other people’s sites
Pressing a Buy control takes you to a retailer, which is a different company with a different privacy policy and its own cookies. Our links to Facebook, Instagram, X, LinkedIn and YouTube are ordinary links; nothing from those platforms is embedded here, so none of them can see you on this site unless you click through. Once you leave, we cannot be responsible for what happens, and we would encourage you to read their policies before giving them anything sensitive.
Changes to this policy
The version and date at the head of this page change whenever the text does, and this page always carries the current version. A change that materially affects how we handle data already collected will be notified to anyone affected rather than published quietly. Earlier versions are available on request.
Governing law
This policy is governed by the laws of India, and the courts at Ernakulam, Kerala have jurisdiction over a claim arising out of it — without prejudice to your right to complain to the Data Protection Board of India or to a Consumer Commission, neither of which this clause affects.
The law this policy is written to
A description of the framework, not legal advice.
| Act, rules or instrument | What it governs here |
|---|---|
| The Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025 ss. 4–9, 11–14, 16; Rules notified 13 November 2025 | Playway Books is the Data Fiduciary for the schools enquiry form, the only place this site collects personal data. The Rules were notified on 13 November 2025 and commence in stages: the consent-manager provisions from 13 November 2026, and the substantive obligations from 13 May 2027. Those obligations are therefore not yet in force, and this site meets them anyway — notice, purpose limitation, erasure on request and a published grievance route are all in place now rather than in 2027. Section 9 governs the data of anyone under eighteen, which is why an enquiry is asked of a school or a parent and never of a student. |
| The Information Technology Act, 2000 ss. 10A, 43, 43A, 65, 66, 66B, 66C, 66D, 66F, 72A, 79, 84B, 84C | Section 10A makes a contract formed electronically enforceable, which is what makes acceptance of these terms binding. Sections 43 and 66 cover unauthorised access, downloading or extraction of data from a computer resource, damage, denial of service and the introduction of a contaminant — the provisions the acceptable-use and anti-scraping clauses are written against, and s. 43(b) reaches automated extraction of this site’s content directly. Section 43A obliges a body corporate holding sensitive personal data to maintain reasonable security practices. Sections 66B, 66C and 66D cover receiving stolen data, identity theft and cheating by personation using a computer resource. Section 72A punishes disclosure of information in breach of a lawful contract. Section 79 sets the safe harbour for intermediaries, which this site is not. Sections 84B and 84C make abetment and attempt punishable. |
| The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 rr. 4, 5, 8 | These remain the operative data-protection rules until the DPDP obligations commence in May 2027. They require a published privacy policy, consent before collection, a named grievance officer who disposes of a grievance within one month, and reasonable security practices — for which the Rules name IS/ISO/IEC 27001 as one acceptable standard. |
| The CERT-In Directions of 28 April 2022, under s. 70B(6) of the IT Act, 2000 | A cyber security incident of the kinds listed — unauthorised access, data breach, defacement, an attack on a database — must be reported to CERT-In within six hours of noticing it, and logs must be kept for 180 days within India. This is why a breach affecting the enquiry table is a reporting obligation and not merely an apology. |
| The Bharatiya Nyaya Sanhita, 2023, read with the IT Act ss. 303, 316, 318 | Theft, criminal breach of trust and cheating as they apply to data taken from this site or from the enquiry database. |
Ask us to delete it and we will, then tell you it is done.
Data requests, complaints and corrections all reach the same desk in Ernakulam. A person answers on weekdays, and nothing here needs a form.
The Grievance Officer
The Grievance Officer Playway Books Pvt Ltd 43/2153, Jewel Homes, Flat E1, Whitefield, A-Block, SRM Road, Kaloor, Ernakulam, Kerala 682018, India learn@playwaybooks.com +91 99471 23678Every complaint is acknowledged within 48 hours and answered within 30 days. Write in English or Malayalam. If a complaint needs longer than that, you will be told why and when to expect an answer, rather than hearing nothing.
Talk to us
- +91 99471 23678 Kochi office, weekdays
- WhatsApp +91 99471 23678
- learn@playwaybooks.com
43/2153, Jewel Homes
Flat E1, Whitefield, A-Block
SRM Road, Kaloor
Ernakulam, Kerala, India — 682018
- CIN
- U22220KL2022PTC074201
- GSTIN
- 32AAMCP6989J1ZN