Privacy Policy

01

Overview

This Privacy Policy applies to gradmire.in and all related services. By using our website or submitting a form, you acknowledge that you have read and understood this policy. This policy is issued in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000.

02

Data we collect

We collect personal data only to the extent required to provide our services. The categories are:

• Identity data — name, date of birth (when relevant for eligibility checks)
• Contact data — email address, mobile number, city/state
• Academic data — exam scores (IELTS, TOEFL, GRE, GMAT), degree level, subject of study, graduation year
• Financial data — fee budget range (no payment card data is collected by us)
• Technical data — IP address, browser type, device OS, referring URL, pages visited, session duration (collected via server logs and analytics)
• Communications data — messages sent via our enquiry form, WhatsApp, or email
• Preferences data — destination countries and course types of interest

We do not collect sensitive personal data (as defined under DPDP Act 2023 Schedule I), except where you voluntarily provide disability or medical information solely for the purpose of disability-related scholarships, with your explicit consent.

03

Purpose of processing

We process your personal data only for clearly defined purposes. We do not sell your data to third parties under any circumstances.

• Service delivery — preparing university shortlists, application guidance, visa documentation support
• Communication — responding to your enquiries, scheduling consultations, sending application reminders
• Platform improvement — understanding how our tools (ROI Calculator, Deadline Tracker) are used so we can improve them
• Legal compliance — maintaining records required under Indian company law and the DPDP Act 2023
• Marketing (with consent only) — newsletters, scholarship alerts, and webinar invitations — only if you have opted in

We rely on the following lawful bases: (a) your consent for marketing communications; (b) contractual necessity for service delivery; (c) legitimate interest for platform analytics; and (d) legal obligation for compliance records.

04

Sharing & disclosure

We share your data only in these circumstances:

• Partner universities and institutions — with your explicit consent before any application is submitted on your behalf
• Service providers — cloud hosting (data stored in India or EEA-compliant jurisdictions), CRM, email delivery, and analytics. These providers are bound by data processing agreements and may not use your data for their own purposes
• Legal authorities — where required by a court order or Government directive under applicable Indian law

We never sell, rent, or exchange personal data with advertising platforms, data brokers, or any third party for commercial gain.

05

Retention

We retain personal data only as long as necessary for the stated purpose or as required by law:

• Active users — for the duration of your engagement with Gradmire and 3 years thereafter
• Marketing data — until you withdraw consent or request deletion
• Legal/tax records — 7 years as required by the Companies Act, 2013
• Technical logs — 90 days, then automatically purged

After the retention period expires, data is securely deleted or anonymised so that it can no longer be linked to you.

06

Your rights (Data Principals)

Under the DPDP Act 2023, you have the following rights as a Data Principal:

• Right to access — obtain a summary of the personal data we hold about you and our processing activities
• Right to correction — request that inaccurate or incomplete data be corrected or completed
• Right to erasure — request deletion of your personal data, subject to legitimate retention requirements
• Right to grievance redressal — raise a complaint with our Grievance Officer (see contact below) and, if unresolved, to the Data Protection Board of India
• Right to nominate — nominate another individual to exercise rights on your behalf in the event of your incapacity or death
• Right to withdraw consent — withdraw consent for marketing or any consent-based processing at any time without affecting prior processing

To exercise any right, use our data request form or email privacy@gradmire.in. We will respond within 30 days. Where verification is needed, we may ask you to confirm your identity.

07

Children & minors

Our services are primarily aimed at students aged 18 and above. However, we recognise that some students who are minors (below 18 years) may seek study-abroad guidance.

In compliance with Section 9 of the DPDP Act 2023:

• We do not knowingly collect personal data from individuals below 18 without verifiable parental or guardian consent
• Where we have reason to believe that a user is a minor, we will pause processing and request parental consent before proceeding
• Parents or guardians may contact privacy@gradmire.in to review, correct, or request deletion of a minor's data
• We do not process minor data for behavioural tracking, targeted advertising, or profiling

08

Cookies & tracking

gradmire.in does not set cookies. We use a small amount of browser storage:

• Essential: remembering your privacy choices, and data for tools you choose to use (such as your Deadline Tracker list)
• Preferences (opt-in): night mode and dismissed pop-ups
• Analytics (opt-in): none run today; any future analytics tool will load only with your consent

We do not use advertising or cross-site tracking. Full details and your choices are in our Cookie Policy.

09

Security

We implement appropriate technical and organisational safeguards to protect your data against unauthorised access, loss, or destruction. Measures include:

• HTTPS (TLS 1.2+) encryption in transit
• Access controls limiting who within Gradmire can view personal data
• Regular security reviews of third-party processors

In the event of a personal data breach that is likely to result in risk to your rights, we will notify the Data Protection Board of India and affected individuals within 72 hours of becoming aware of the breach.

10

Policy changes

We may update this policy from time to time to reflect changes in law or our practices. When we make material changes, we will:

• Update the effective date at the top of this page
• Display a notice on our homepage for 30 days
• Email registered users if the changes affect their rights

Continued use of our services after the effective date constitutes acceptance of the revised policy.

11

Contact our Data Protection Officer

For any privacy-related questions, data subject requests, or complaints, please contact our Data Protection Officer / Grievance Officer:

If your concern is not resolved to your satisfaction, you may escalate to the Data Protection Board of India once it becomes operational under the DPDP Act 2023.