Privacy Policy

Bilza is a service operated by Wittier, No. 2, 3rd Cross, 5th Block, Nandini Layout, Bangalore - 560096, India. In this policy “we”, “us” and “our” mean Wittier. You can reach us at contact@wittier.in.

We handle personal data in two distinct capacities, and your rights differ depending on which one applies to you.

• For the academy’s own account holders — the owner and staff who sign in to Bilza — we decide how and why the data is used. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act) we are the Data Fiduciary, and you can exercise your rights directly with us.
• For data about students, their guardians and enquiries that an academy enters into Bilza, the academy decides what is collected and why. The academy is the Data Fiduciary; we act as a Data Processor on that academy’s instructions. If you are a parent or student, your first point of contact is your academy. You may still write to us and we will help, and we will pass on anything we cannot act on ourselves.

We do not hold card numbers, UPI PINs or bank credentials. Online payments are handled by a payment gateway, and we receive only the result of the payment and a reference.

Many students at a performing-arts academy are children. Under the DPDP Act, personal data of anyone under 18 may be processed only with the verifiable consent of a parent or guardian. That consent is obtained by the academy, which decides what it records about a student. Academies using Bilza are responsible for having that consent before entering a child’s details.

We do not use children’s data for advertising, we do not track children across other websites or services, and we do not profile children for any purpose.

• Providing the service: running classes, attendance, fees, payroll and communication for the academy.
• Sending messages the academy asks us to send — fee reminders, class updates and similar — through WhatsApp, SMS, email or app notifications.
• Keeping the service secure: rate limiting, detecting misuse, and maintaining the audit trail.
• Support: looking into a problem when an academy reports one.
• Meeting our legal obligations, including tax and accounting records.

We do not sell personal data. We do not share it for anyone else’s advertising, and we do not use the content of an academy’s records to advertise to anybody.

We use a small number of service providers to run Bilza. They act on our instructions and may use the data only to provide their service to us:

• Cloud hosting and database providers, which store and serve the data.
• Payment gateways, when an academy collects fees online.
• Messaging providers for WhatsApp, SMS and email, which deliver the messages an academy sends.
• Notification services, to deliver alerts to a teacher’s phone.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If we are ever involved in a merger or acquisition, we will tell affected academies before their data moves, and it stays subject to this policy.

We host Bilza in data centres and store data with the providers described above. Some of those providers may process data outside India. Where that happens we rely on the provider’s contractual commitments to protect it, and we transfer only what is needed to run the service.

While an academy’s account is open, we keep its records so it can run its teaching and see its own history. Attendance and fee records are kept for as long as the academy needs them and for as long as tax and accounting law requires.

When an academy closes its account, we delete or irreversibly anonymise its data within a reasonable period, except where we are required to keep something — for example transaction records for tax. An academy can ask us to delete a specific record sooner, and we will do so unless we are legally required to keep it.

• Traffic between your browser or phone and Bilza is encrypted in transit.
• Passwords are never stored in a readable form. They are hashed with a slow, salted algorithm designed for passwords.
• Each academy’s data is separated from every other academy’s, and that separation is enforced by the database itself rather than only by application code.
• What each person can see is governed by their role, so a teacher sees the students they teach and not the academy’s finances.
• Significant changes are recorded in an audit trail that cannot be edited or deleted from within the application.

No service can promise perfect security. If a breach occurs that is likely to affect you, we will notify affected academies and the Data Protection Board of India as the DPDP Act requires.

Under the DPDP Act you may ask us to:

• Tell you what personal data of yours we hold and what we do with it.
• Correct or complete anything that is inaccurate or out of date.
• Erase personal data we no longer need, unless we are required to keep it.
• Nominate someone to exercise your rights if you die or become incapacitated.
• Withdraw consent you previously gave, where our use of the data rests on consent.

If you are a student or a parent, ask your academy first — they hold and control those records. If you do not get a response, write to our Grievance Officer below and we will help.

We set a cookie when you sign in, so that the service remembers you are signed in. It is essential to using Bilza and cannot be turned off while you are signed in. We do not use advertising or cross-site tracking cookies.

If you have a complaint about how your personal data has been handled, write to our Grievance Officer. We will acknowledge your complaint and respond within 30 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

If we change this policy we will update the date at the top of this page, and tell account holders about anything significant before it takes effect. Related terms are set out in our Terms of Service.