Indiana Consumer Data Protection Act (INCDPA) Compliance

Overview

The Indiana Consumer Data Protection Act (INCDPA), effective January 1, 2026, provides Indiana residents with comprehensive privacy rights regarding their personal data. Kids on the Yard is committed to protecting the privacy of Indiana residents and complying with all INCDPA requirements.

What is the INCDPA?

The Indiana Consumer Data Protection Act is a comprehensive privacy law that grants Indiana consumers fundamental rights regarding their personal data and requires businesses to implement responsible data protection practices. The law applies to businesses that conduct business in Indiana or produce products or services targeted to Indiana residents and meet specific data processing thresholds.

Your Rights Under the INCDPA

As an Indiana resident, you have the following rights under the INCDPA:

Right to Confirm and Access

You have the right to confirm whether we are processing your personal data and to access such personal data. This includes the right to obtain:

• Categories of personal data we collect about you
• Purposes for processing your personal data
• Categories of sources from which personal data is collected
• Categories of third parties with whom we share personal data
• Specific pieces of personal data we have collected about you

Right to Correct

You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes for processing such data.

Right to Delete

You have the right to delete personal data concerning you, subject to certain exceptions including:

• Completing the transaction for which personal data was collected
• Detecting security incidents and protecting against fraudulent or illegal activity
• Complying with legal obligations
• Exercising free speech rights or ensuring others can exercise free speech rights
• Engaging in public or peer-reviewed scientific research in the public interest

Right to Data Portability

You have the right to obtain your personal data in a portable and readily usable format that allows you to transmit the data to another business without hindrance from us.

Right to Opt-Out

You have the right to opt out of:

• Processing of personal data for purposes of targeted advertising
• Sale of personal data to third parties
• Profiling in furtherance of decisions that produce legal or similarly significant effects

How We Comply with INCDPA

Comprehensive Data Governance

Kids on the Yard complies with INCDPA through:

Data Minimization and Purpose Limitation

• Precise Collection: We collect only personal data that is adequate, relevant, and reasonably necessary for disclosed purposes
• Clear Purpose Specification: We process personal data only for disclosed, specific, and legitimate purposes
• Retention Optimization: We retain personal data no longer than reasonably necessary for stated purposes
• Continuous Assessment: We regularly review and update our data collection and retention practices

Transparency and Accountability Framework

• Comprehensive Privacy Notices: We provide clear, accessible information about our data collection and processing practices
• Detailed Processing Records: We maintain thorough records of processing activities, purposes, and legal bases
• User Empowerment Tools: We provide intuitive interfaces for Indiana residents to manage their privacy preferences
• Proactive Communication: We keep users informed about changes to our privacy practices and emerging legal requirements

Consumer Rights Infrastructure

We have established comprehensive systems to:

• Robust Identity Verification: Authenticate requests using secure, multi-layered verification methods to prevent unauthorized access
• Efficient Processing: Handle verified consumer requests within 45 days of receipt
• Clear Communication: Provide requested information in accessible, plain-language formats
• Equal Treatment: Ensure no discriminatory practices or service degradation for exercising privacy rights
• Quality Assurance: Maintain exceptional standards for response accuracy, completeness, and user satisfaction

Categories of Personal Data We Process

Under the INCDPA, we collect and process the following categories of personal data from Indiana residents:

Personal Identifiers and Contact Information

• Full legal name, email addresses, phone numbers, mailing addresses
• Account usernames, encrypted passwords, and multi-factor authentication credentials
• Government-issued identification numbers (when legally required for verification purposes)
• Emergency contact information and authorized representative designations

Comprehensive Educational and Academic Information

• Student academic records, performance data, grade histories, and comprehensive progress tracking
• Learning assessments, skill evaluations, standardized test scores, and individualized educational goal setting
• Detailed tutoring session recordings, session notes, recommendations, and curriculum advancement tracking
• Comprehensive parent/guardian communications regarding educational services, student needs, and academic planning

Financial and Transaction Information

• Payment card information, billing addresses, and preferred payment method details
• Comprehensive transaction histories, subscription details, payment records, and billing cycle information
• Refund and dispute information, failed payment logs, account adjustments, and credit application data
• Financial assistance information, scholarship applications, promotional discount records, and payment plan arrangements

Technical and Usage Information

• Comprehensive device information including IP addresses, browser types, operating system details, and hardware specifications
• Detailed website navigation patterns, service usage data, session duration, feature utilization, and interaction analytics
• Customer support communications, help desk tickets, technical issue reports, and comprehensive user feedback
• Platform preferences, account settings, accessibility configurations, and personalization choices

Communication and Engagement Data

• Email correspondence, live chat conversations, messaging histories, and comprehensive communication logs
• Phone call records, voicemail messages, call duration data, and communication preference settings
• Survey responses, feedback forms, product testimonials, reviews, and user-generated content
• Marketing communication consent records, detailed preference settings, and opt-out status tracking

Enhanced Sensitive Personal Data Protection

When we process sensitive personal data as defined by INCDPA (including precise geolocation data, biometric identifiers used for identification purposes, health information, or data concerning children under 13), we implement comprehensive enhanced protection measures:

Advanced Safeguards and Controls

• Explicit Informed Consent: We obtain clear, detailed, opt-in consent for all sensitive data processing activities
• Multi-Layer Security Enhancement: We implement additional comprehensive technical and organizational security measures
• Strict Processing Limitations: We restrict processing to strictly necessary purposes with clear legal justification
• Enhanced Access Controls: We implement sophisticated role-based access controls with detailed audit trails and real-time monitoring
• Specialized Procedures: We follow enhanced protocols for sensitive data storage, transmission, sharing, and secure deletion

Comprehensive Consent Management Framework

For sensitive personal data processing, we:

• Provide detailed, clear explanations of specific purposes and categories of sensitive data involved
• Offer comprehensive, easy-to-understand information about potential risks, benefits, and available alternatives
• Provide simple, accessible mechanisms to withdraw consent at any time with immediate effect
• Regularly review and reconfirm consent as appropriate based on processing changes and legal updates
• Maintain comprehensive, auditable records of all consent grants, modifications, and withdrawal requests

Third-Party Data Sharing and Processing

We may share personal data with carefully vetted and contractually bound third parties for legitimate business purposes:

Service Providers and Data Processors

• Cloud hosting and data storage providers with industry-leading security certifications and comprehensive compliance frameworks
• Payment processing companies and financial institutions with full regulatory compliance and PCI-DSS certification
• Customer support platforms and communication service providers with comprehensive data protection agreements
• Educational content providers, curriculum developers, and assessment platforms with appropriate privacy safeguards

Strategic Business Partners and Collaborators

• Technology integration partners and software platform providers with demonstrated privacy-by-design practices
• Analytics and performance monitoring services with strong privacy commitments and data anonymization capabilities
• Educational research organizations and accredited academic institutions (with appropriate institutional approvals and ethics review)
• Marketing partners and advertising platforms (only with explicit user consent and clear opt-in preferences)

Legal and Regulatory Compliance Requirements

• Law enforcement agencies (when required by valid legal process, court orders, or emergency circumstances)
• Regulatory authorities and government agencies (as mandated by applicable state and federal laws)
• Legal counsel, professional advisors, external auditors, and compliance consultants
• Court-ordered disclosures, litigation support services, and regulatory investigation support

We categorically do not sell personal data to third parties for monetary consideration under any circumstances.

Comprehensive Multi-Layer Data Security Framework

We implement state-of-the-art, multi-layered security measures to protect Indiana residents' personal data:

Advanced Technical Security Controls

• Military-Grade Encryption: Advanced encryption standards for data at rest and industry-leading encryption for data in transit
• Sophisticated Access Control Systems: Multi-factor authentication, biometric verification, and granular role-based access controls
• Advanced Network Security: Next-generation firewalls, AI-powered intrusion detection systems, behavioral analysis, and real-time threat monitoring
• Secure Development Lifecycle: Privacy and security by design principles integrated throughout all system development and deployment processes

Comprehensive Administrative and Organizational Controls

• Mandatory Privacy Training: Regular, comprehensive, role-specific training for all personnel with access to personal data
• Robust Policy Framework: Detailed, regularly updated policies covering data handling, retention, deletion, and incident response procedures
• Rigorous Vendor Management: Comprehensive security assessments, ongoing monitoring, and strict contractual requirements for all third-party processors
• Regular Security Audits: Periodic internal audits, external security assessments, and compliance reviews by qualified cybersecurity professionals

Robust Physical Security Measures

• Multi-Layer Facility Security: Advanced controlled physical access to data centers and processing facilities with biometric authentication
• Comprehensive Media Protection: Secure storage, handling, transportation, and certified destruction procedures for all physical storage media
• Advanced Environmental Controls: Sophisticated climate monitoring, fire suppression systems, backup power, and comprehensive disaster recovery capabilities
• Real-Time Access Monitoring: Comprehensive logging, video surveillance, and real-time monitoring of all physical access to sensitive areas

How to Exercise Your INCDPA Rights

Indiana residents may exercise their comprehensive privacy rights through multiple convenient and secure channels:

Submit a Comprehensive Privacy Request

• Secure Online Portal: Visit our dedicated Privacy Request Center with end-to-end encrypted submission
• Direct Email Communication: Send detailed requests to [email protected] with "INCDPA Request" in the subject line
• Dedicated Privacy Hotline: Call our specialized privacy hotline at International: +1 786-382-2000
• Secure Postal Mail: Send written requests to our business address with delivery confirmation and return receipt

Required Information for Efficient and Secure Processing

To verify your identity and process your request efficiently and securely, please provide:

• Your complete legal name and current contact information
• Email address associated with your Kids on the Yard account (if applicable)
• Proof of Indiana residency (current utility bill, driver's license, voter registration, or similar official documentation)
• Specific and detailed description of your privacy request and desired outcome
• Any additional information that may help us locate, verify, and process your personal data request

Detailed Response Timeline and Comprehensive Procedures

• Initial Acknowledgment: We confirm receipt of all requests within 10 business days via your preferred secure contact method
• Comprehensive Identity Verification: Multi-step verification process typically completed within 5-15 business days using secure authentication methods
• Complete Response Period: We provide comprehensive responses to verified requests within 45 days of receipt
• Complex Request Handling: May require up to 90 days with advance written notification and detailed explanation of complexity factors
• No Charge Policy: We provide up to two comprehensive responses per calendar year at no cost to Indiana residents
• Reasonable Fee Structure: May incur reasonable administrative fees for repetitive, manifestly unfounded, or excessively burdensome requests

Comprehensive Appeals Process and External Review Mechanisms

If you are not satisfied with our response to your privacy request under INCDPA:

Internal Appeal Process

1. Submit Detailed Appeal: Email [email protected] with "INCDPA Appeal" in the subject line
2. Include Complete Documentation: Provide your original request reference number and detailed explanation of specific concerns
3. Thorough Review Period: We will conduct comprehensive review of appeals and respond within 60 calendar days
4. Detailed Appeal Response: We will provide comprehensive written explanation of our decision and any corrective actions taken

External Review and Enforcement Options

If you remain unsatisfied with our internal appeal response, you may pursue comprehensive external remedies:

• Contact the Indiana Attorney General's Office Consumer Protection Division for complaint filing and investigation
• File complaints with relevant state consumer protection agencies and privacy enforcement authorities
• Consult with qualified legal counsel regarding your privacy rights under Indiana law and potential legal remedies
• Explore other legal remedies and enforcement mechanisms available under applicable state and federal privacy laws

Contact Information

For questions about our INCDPA compliance or to exercise your comprehensive privacy rights:

Privacy Team Kids on the Yard Limitless Virtue LLC 9701 NE 2nd Ave, Suite #1069 Miami Shores, Florida 33138 U.S.A Email: [email protected] Phone: International: +1 786-382-2000

Indiana Residents Privacy Hotline: Available Monday-Friday, 9 AM - 5 PM EST

Last Updated: January 1, 2025

For more information about the Indiana Consumer Data Protection Act, visit: https://iga.in.gov/legislative/2023/bills/senate/5