Privacy Policy

2. Definitions

• Personal Data: Any data about an individual who is identifiable by or in relation to such data.
• Data Principal: The individual to whom the personal data relates. Where the individual is a child, this includes the parent or lawful guardian. Where the individual is a person with a disability and has a lawful guardian, it includes that guardian.
• Data Fiduciary: The person who, alone or together with others, determines the purpose and means of processing personal data. For the purposes of this Policy, JNIAS is the Data Fiduciary.
• Data Processor: Any person who processes personal data on behalf of JNIAS.
• Processing: Any operation performed on personal data, including collection, recording, storage, use, sharing, restriction, erasure, or destruction.
• Child: An individual who has not completed eighteen (18) years of age.
• Applicable Law: All laws in force in India that apply to the processing of personal data, including those listed in Section 3.

3. Legal Framework

JNIAS processes personal data in accordance with Applicable Law, including:

• The Digital Personal Data Protection Act, 2023 and the rules made under it (the "DPDP Act");
• The Information Technology Act, 2000 and the rules made under it, including, for as long as they remain in force, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• Regulations, circulars, and directions issued by Mahatma Gandhi University, the University Grants Commission, the All India Council for Technical Education, and other statutory or regulatory bodies that apply to the Institute; and
• Any other law that requires JNIAS to collect, retain, or disclose information.

Where Applicable Law changes, this Policy will be read together with the amended law, and we will update it as described in Section 19.

4. Personal Data We Collect

We collect only the personal data that is needed for the purposes in Section 6. Depending on how you interact with us, this may include:

• Contact and enquiry details: name, email address, mobile number, city or district, the course or service you are enquiring about, and the message you send us.
• Admission and application details: date of birth, gender, address, parent or guardian details, educational qualifications and marks, category or reservation details where you choose to provide them, and documents you upload in support of your application.
• Account details: email address, encrypted password, one-time codes and verification records, and linked submission reference numbers for your My Privacy account.
• Consent and request records: the consent choices you make, the version of the privacy notice shown to you, the date and time of consent, and any access, correction, erasure, or grievance requests you make.
• Technical data: IP address, device and browser type, operating system, pages visited, referring page, date and time of access, and cookie identifiers (see Section 11).
• Communications: records of emails, calls, messages, and feedback exchanged between you and the Institute.

Certain details, such as photographs, identity numbers, caste or category certificates, or health-related information, may be needed only at the admission or enrolment stage. We will tell you when they are required and why. Please do not submit these through the general enquiry form.

We do not intentionally collect payment card, net-banking, or UPI credentials on the Platform. Where online payments are accepted, they are processed by authorised payment service providers under their own security and privacy terms.

5. How We Collect Personal Data

We collect personal data:

• Directly from you, when you fill in an enquiry, admission, contact, or feedback form, create or use a My Privacy account, upload documents, or write or call us;
• Automatically, through cookies, server logs, and similar technologies when you browse the Platform; and
• From others, where permitted by law, such as from your parent or guardian, your previous school or college, or the University in connection with admission and examinations.

The information you give us must be accurate and complete. You must not provide another person's personal data unless you are authorised to do so.

6. Purposes of Processing

We process personal data only for lawful purposes, namely:

• To respond to your enquiries and provide information about courses, fees, eligibility, scholarships, and campus facilities;
• To receive, evaluate, and process admission applications, and to communicate decisions and next steps;
• To create, secure, and manage your My Privacy account and to link your submissions to it;
• To record and honour your consent choices, and to handle your access, correction, erasure, and grievance requests;
• To send you updates, reminders, notifications, and admission-related communication you have asked for or consented to;
• To verify identity and eligibility and to prevent fraud, impersonation, and misuse of the Platform;
• To keep the Platform secure, diagnose technical problems, and improve its performance, accessibility, and content;
• To maintain records and share information with the University and regulators as required for affiliation, admission, and examination purposes;
• To comply with legal obligations, court orders, and lawful requests from authorities; and
• To establish, exercise, or defend legal claims.

We will not use your personal data for a purpose that is materially different from the one for which it was collected, unless we obtain fresh consent or the law permits it.

7. Consent and Lawful Grounds

Consent. We process personal data on the basis of your free, specific, informed, unconditional, and unambiguous consent, given by a clear affirmative action. Each consent request will be accompanied by a notice that describes the personal data to be processed, the purpose, how you can exercise your rights, and how to complain.

Language. On request, the notice will be made available in English or Malayalam, or in any other language specified in the Constitution of India that we reasonably support.

Withdrawal. You may withdraw consent at any time, as easily as it was given, through the My Privacy account, the Consent Preferences page, or by writing to our Grievance Officer. Withdrawal does not affect the lawfulness of processing done before it. After withdrawal, we will stop processing and, unless retention is required by law, erase the related personal data within a reasonable time. We will also ask our Data Processors to do the same.

Consequences of withdrawal. If you withdraw consent that is necessary for a service, such as processing an admission application, we may not be able to continue providing that service.

Other lawful grounds. Applicable Law also permits processing without consent for certain legitimate uses. These include processing for which you have voluntarily provided your data for a stated purpose and have not indicated that you object, compliance with a law or a court order, and responding to a medical emergency. We rely on these only where they apply.

Consent managers. Where you choose to use a registered consent manager, we will honour consent choices made through it in accordance with Applicable Law.

8. Children and Minors

Many applicants and visitors to the Platform may be under eighteen years of age. Before processing the personal data of a Child, we will obtain verifiable consent from the parent or lawful guardian, in the manner required by Applicable Law.

We do not undertake tracking or behavioural monitoring of Children, and we do not direct targeted advertising at them.

We do not process the personal data of a Child in any manner that is likely to cause a detrimental effect on the Child's well-being.

If you believe that a Child's personal data has been submitted without parental consent, please contact the Grievance Officer (Section 18) and we will take appropriate action, including erasure.

9. Sharing and Disclosure

We do not sell your personal data. We share it only where necessary and with appropriate safeguards, as follows:

• Within JNIAS: with the admissions office, departments, and authorised staff who need it to deal with your enquiry or application, on a need-to-know basis;
• Mahatma Gandhi University and regulators: for admission registration, examinations, affiliation, inspections, and statutory returns;
• Data Processors and service providers: such as website hosting, cloud storage, email and SMS delivery, analytics, payment, and technical support providers, who act only on our documented instructions and are bound by confidentiality and security obligations;
• Professional advisers: such as auditors and legal counsel, under duties of confidentiality;
• Law enforcement and authorities: where required by law, court order, or a lawful request, or to protect rights, property, and safety; and
• Successors: in the event of a restructuring or transfer of the Institute's operations, subject to the continued protection of your data.

We remain responsible for personal data processed on our behalf by a Data Processor, and we will engage a Data Processor only under a valid contract.

With your consent, we may display your name, image, or achievements in publications or on the Platform. You may withdraw that consent at any time.

10. Cross-Border Transfers

Our service providers may store or process data on servers located outside India. Where personal data is transferred outside India, we will do so only in accordance with Applicable Law, including any restrictions the Central Government may notify on transfers to particular countries or territories, and we will ensure comparable safeguards through contractual and technical measures.

11. Cookies and Similar Technologies

The Platform uses cookies and similar technologies. Essential cookies keep the site secure and working. Other cookies, such as analytics or preference cookies, are used only with your consent where the law requires it.

You can accept, reject, or change your choices through the cookie banner or Consent Preferences page, and through your browser settings. Details of the cookies we use are set out in our Cookie Policy.

Some browsers send a "Do Not Track" signal. As there is no common standard for it, the Platform may not respond to such signals, but you can control cookies as described above.

12. Data Retention and Erasure

We keep personal data only for as long as it is needed for the purpose for which it was collected, or as required by law. Indicative retention periods are:

• General enquiries that do not lead to an application: up to [12] months from the last communication;
• Unsuccessful or withdrawn applications: up to [12–24] months after the close of the admission cycle, unless you ask for earlier erasure;
• Admitted students' records: for the period required by the University, regulators, and academic and audit requirements, as set out in the student privacy notice;
• My Privacy account data: for as long as the account remains active, and for up to [90] days after closure to complete pending requests;
• Consent and request records: for as long as needed to demonstrate compliance and handle disputes, but not longer than [3] years from the last relevant event unless the law requires otherwise; and
• Server logs and cookies: for the periods stated in the Cookie Policy.

When the purpose is served, you withdraw consent, or you request erasure, we will erase the data and instruct our Data Processors to do the same, unless retention is necessary for compliance with law.

We may retain anonymised or aggregated information that does not identify you for statistical or institutional planning purposes.

13. Security Safeguards and Personal Data Breaches

We take reasonable security safeguards to prevent personal data breaches. These include access controls, encryption of data in transit and, where appropriate, at rest, password hashing, one-time-code verification for My Privacy sign-in, logging and monitoring, regular backups, and staff confidentiality obligations.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You should keep your login details confidential, use a strong password, and sign out of shared devices.

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected Data Principal in the form and within the time required by Applicable Law, describing the nature of the breach and the steps being taken.

14. Your Rights as a Data Principal

Subject to Applicable Law, you have the following rights:

• Right to information and access: to obtain a summary of the personal data we process about you, the processing activities, and the identities of the other Data Fiduciaries and Data Processors with whom it has been shared;
• Right to correction and completion: to have inaccurate or misleading personal data corrected and incomplete data completed;
• Right to erasure: to have your personal data erased, unless retention is required for a specified purpose or by law;
• Right to withdraw consent: at any time, as described in Section 7;
• Right of grievance redressal: to have your complaints heard and resolved within the prescribed period (Section 18); and
• Right to nominate: to nominate another individual who may exercise your rights in the event of your death or incapacity.

How to exercise your rights. You can make most requests through the My Privacy account. You may also write to the Grievance Officer. We may need to verify your identity before acting on a request, and we will not ask for more information than is reasonably necessary for that purpose.

Timelines. We will acknowledge your request with a reference number and respond within the period prescribed by Applicable Law, and in any case within [30] days where no period is prescribed. If we cannot comply, we will tell you why.

Fees. We do not charge a fee for ordinary requests. We may decline requests that are repeated without reason, that are impossible to carry out, or that are not permitted by law.

15. Your Duties as a Data Principal

Under the DPDP Act, you must:

• Comply with the provisions of all Applicable Law while exercising your rights;
• Not impersonate another person while providing your personal data;
• Not suppress any material information when providing personal data for a document, unique identifier, proof of identity, or proof of address issued by a public authority;
• Not register a false or frivolous grievance or complaint; and
• Furnish only verifiably authentic information when exercising the right to correction or erasure.

16. My Privacy Account

The My Privacy account lets you review enquiries and applications linked to you, view your consent choices and the notice version applicable to each, request correction or erasure, track the progress of a request, and download a copy of your data.

A submission appears in your account only after you verify the email address used on the form and link it. Until then, it is not accessible through any account.

You are responsible for the confidentiality of your password and for all activity under your account. Please inform us promptly at the Privacy Support page if you suspect unauthorised use.

17. Third-Party Links and Services

The Platform may contain links to, or embed content from, third-party websites and services, such as video platforms, maps, social media, and the University's website. We do not control and are not responsible for their privacy practices. We encourage you to read their privacy policies before sharing any personal data with them.

18. Grievance Redressal

If you have a concern about how we handle your personal data, or wish to exercise any of your rights, please contact our Data Protection Officer / Grievance Officer first:

We will acknowledge your complaint within [48 hours] and aim to resolve it within [7] days, and in any event within the period prescribed by Applicable Law.

If you are not satisfied with our response, or you receive no response in time, you may complain to the Data Protection Board of India, as provided under the DPDP Act. Under the Act, you are expected to first use our grievance process before approaching the Board.

19. Changes to This Policy

We may update this Policy from time to time to reflect changes in law, technology, or our practices. The "Last Updated" date at the top shows when it was last revised.

For material changes, we will give you prominent notice on the Platform and, where required, seek fresh consent. Your continued use of the Platform after a non-material change means you accept the updated Policy. Earlier versions are available on request.

20. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Subject to the right to approach the Data Protection Board of India and any other forum provided by law, the courts at [Idukki / Kattappana / Thodupuzha], Kerala shall have exclusive jurisdiction over disputes arising from this Policy.

If any provision of this Policy is held invalid or unenforceable, the remaining provisions will continue in full force.

Nothing in this Policy limits any right you have under Applicable Law that cannot be waived by agreement.

21. Contact Us

For any question about this Privacy Policy:

For privacy-specific matters, please write to the Data Protection Officer / Grievance Officer at the details in Section 18, or visit the Privacy Support page.