Privacy Policy

1.1 Applicability: This Policy explains how IICT processes personal data across our Website, Student Portal, AI Skill House, application portals (admissions, careers, tenders, incubation), and general communications. It applies to individuals both in India and abroad.

1.2 Legal Compliance: This serves as an official notice under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025. It should be read alongside our Website Terms of Use.

1.4 Consent: By using our platforms, you acknowledge you have read this Policy. Where explicit consent is required by the DPDP Act, we will request it separately.

IICT is the “Data Fiduciary” under the DPDP Act for data collected as per our privacy policy.

Where we use service providers to process data on our behalf and instructions, they act as “Data Processors”, and IICT remains responsible for that processing.

1. Email: contact@iict.org
2. Postal Address: 4th Floor, Phase II Building, NFDC Campus, 24, Pedder Rd, IT Colony, Cumballa Hill, Mumbai, Maharashtra 400026

We will acknowledge your grievance within 24-72 hours of receipt and try to resolve your grievance promptly, and in any case within 90 days from receipt, as required by the DPDP Rules. If you remain unsatisfied after our internal process, you may then approach the Data Protection Board of India through its official online portal.

4.2 Lawful basis: For most of the above, we rely on your free, specific, informed, unconditional and unambiguous consent given through a clear affirmative action. We may also process data where you voluntarily provided it for a stated purpose without objecting; where the law, a judgment or a court order requires it; or where it is necessary for employment purposes such as recruitment.

You can withdraw consent at any time (see Section 5). We only collect and keep the personal data we reasonably need for the purposes in this Policy.

5.1 Where we rely on your consent, it will be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. Before asking, we will tell you what data we are collecting and why.

5.2 You may give, refuse or withdraw consent at any time, as easily as you gave it. Withdrawing consent does not affect the legality of processing that already happened before withdrawal.

5.3 Once we act on your withdrawal, we will stop processing your data for that purpose within a reasonable time, unless the law requires or allows further retention.

5.4 To withdraw consent, contact our Grievance Officer (Section 2).

6.2 As noted in Section 3.3, applications submitted through linked third-party platforms (e.g., our incubation platform or the Government e-tendering portal) are collected by those third parties directly and not shared by us to them.

7.1 We primarily process data within India. Some service providers (e.g., our website host or Student Portal provider) may store or process data on servers outside India, so your data may sometimes be transferred to or accessed from abroad.

7.2 Any such transfer will follow the DPDP Act and any Central Government restrictions on transfers to specific countries, when notified.

7.3 Where we transfer data internationally, we take reasonable steps including contractual and security safeguards to ensure the recipient offers protection comparable to the DPDP Act.

In compliance with DPDP Rules, we retain personal data only as long as necessary to fulfill its collection purpose or to meet legal and regulatory obligations:

1. Admission Enquiries (No Enrollment): Retained for a reasonable timeframe to handle follow-up queries, then deleted or anonymized.
2. Enrolled Student Records: Kept for the duration of the course, and subsequently as required for issuing transcripts, certificates, or meeting audit and regulatory compliance.
3. Job Applications: Retained during the recruitment process and for a reasonable period thereafter, unless early deletion is requested.
4. Website Traffic & Security Logs: Kept for the strict minimum period prescribed under the DPDP Rules.
5. Purpose Completion / Consent Withdrawal: Data is promptly erased or permanently anonymized, unless a specific law mandates its continued retention.

1. We use cookies and similar technologies to enhance your browsing experience, analyze website usage, and measure advertising performance.
2. You can manage or disable cookies through your browser settings, though doing so may limit some website features.
3. In compliance with the DPDP Act, we will obtain your consent via a cookie banner before deploying any cookies that are not strictly necessary for the website to function.

Subject to the DPDP Act and its exemptions, you have the right to:

1. Access Information: get a summary of the personal data we hold about you and how we process it.
2. Correction and Erasure: ask us to correct inaccurate/incomplete data, or erase data no longer needed for its purpose, unless the law requires us to keep it.
3. Grievance Redressal: have your grievance addressed by IICT before escalating to the Data Protection Board of India.
4. Nominate: name another person to exercise your rights if you die or become incapacitated.
5. Withdraw Consent at any time (see Section 5).

Duties of Data Principals: while exercising these rights, the DPDP Act requires you not to impersonate anyone, not to hide material information when providing data for government identifiers, not to file false or frivolous grievances, and to give only verifiably authentic information when seeking correction or erasure.

How to exercise your rights: write to our Grievance Officer. We may need to verify your identity (or your nominee's/representative's) before acting and will respond within a reasonable time under the DPDP Rules. We may decline or limit requests that are clearly unfounded, excessive, repetitive, or not in line with the law.

While we use reasonable technical and organizational safeguards to protect your personal data, no internet transmission or electronic storage method is entirely secure, and data sent to us is at your own risk. In the event of a personal data breach, we will promptly notify the Data Protection Board of India and affected individuals, providing details on the nature of the breach, its likely impact, and the mitigation steps taken or planned.

12.1 Nothing here excludes or limits any right you have under applicable law (including the DPDP Act), or any liability that cannot legally be excluded or limited.

12.2 To the extent the law allows, IICT is not liable for indirect, incidental, consequential or punitive damages, including lost profits, data, goodwill or business opportunities arising from our processing of personal data.

12.3 IICT is not responsible for loss, damage or harm from unauthorised access, disclosure, alteration or destruction of data caused by factors beyond our reasonable control, or by acts/omissions of users or third parties we do not control, including where this happens despite our reasonable security safeguards.

The Website links to our Instagram, LinkedIn, X and YouTube pages, and our Careers and Tender pages may link to our external incubation platform or the Government e-tendering portal. When you use these links or platforms, third parties may collect or share data about you. We do not control, and are not responsible for, their privacy practices. Please read the privacy policy of any site or service you visit.

We may update this Policy from time to time to reflect changes in our practices, technology, legal obligations, or for other operational/legal/regulatory reasons. We will update the “Last Modified” date whenever we do. For material changes, we will give additional notice (e.g., on the Website) and, where required by law, seek your fresh consent. Please review this Policy periodically.

This Policy is governed by Indian law, including the DPDP Act and DPDP Rules. Subject to the DPDP Act's grievance-redressal process, courts in Mumbai, Maharashtra have exclusive jurisdiction over disputes relating to this Policy.