1. Personal Information Collected: Full Name, Email Address, Contact Number, College/University, City, State, Motivation statement, and optional social links.
2. Application Evaluation: Assessing your academic profile, student eligibility, and campus leadership readiness.
3. Email Verification: Cryptographically generated 6-digit one-time passcode (OTP) to authenticate email ownership and prevent spam.
4. Account Creation & Local Storage: Provisioning your secure ambassador portal access, login credentials, and unique ID (e.g. AMBxxxx). Authenticated portal sessions store an authentication token (ambassadorAuth) in your browser's localStorage solely to keep you signed in across browser tabs and refreshes. No tracking cookies are used.
5. Authorized Data Processors: We engage trusted third-party service processors bound by statutory confidentiality:
- Hostinger International Ltd.: Cloud hosting infrastructure, secure database storage, and reverse-proxy routing.
- Razorpay Software Private Limited: Payment gateway processing for student course transactions and coupon validations.
- Transactional Mail Infrastructure: Secure delivery of verification OTPs and essential program notifications.
6. Ambassador Program Communication: Delivering onboarding guidelines, cohort training, administrative notices, and platform updates.
7. Referral & Performance Management: Generating your unique referral code, tracking verified student enrollments, and calculating performance reward payouts.
8. Data Retention (Purpose-Specific Schedule):
- Accounting Records & Commission Ledgers (8 Financial Years): On-platform referral attribution, discount transactions, and calculated commission earnings are retained for not less than 8 Financial Years under Section 128(5) of the Companies Act, 2013. Ambassador payouts are processed off-platform; where banking, UPI, or tax identification details are provided directly to Kangrew finance for payment disbursement, those accounting vouchers are secured separately and retained for 8 Financial Years. General ambassador profile data is decoupled and not retained under this rule.
- Payment Transaction Records (8 Financial Years): Gateway order IDs, invoice receipts, and transaction metadata are retained for 8 Financial Years for statutory financial audit and tax reconciliation. Card numbers and banking credentials are not collected or stored on Kangrew systems.
- Referral Attribution Records (3 Years): Referral tracking metrics, coupon usage, and lead counts are retained for 3 Years based on commercial reconciliation and contractual claim limitation periods (Articles 55 & 113, Limitation Act, 1963). This is an operational and evidentiary retention period, not a statutory DPDP minimum.
- Consent Audit Evidence (Processing Duration + 3 Years): Maintained for the duration of active processing plus 3 Years post-account closure or consent withdrawal to defend against legal disputes under Limitation Act, 1963 and Section 6(1) of the DPDP Act. This is an evidentiary defense standard, not a statutory DPDP minimum.
- Ambassador Profile Data (Active Term + 6 Months): Retained for active term + 180 days (six months) post-deactivation; pending applications are retained for 90 days (evaluation cycle); and rejected applications for 90 days from decision date, after which personal profile data is purged.
- Processing & Security Telemetry Logs: Processing logs, application security audit trails, reverse-proxy connection logs, and network telemetry are retained for one year (365 days) and then permanently deleted, in compliance with Rule 6(1)(e) and Rule 8(3) of the DPDP Rules, 2025. This one-year period satisfies and exceeds the 180-day regulatory floor established under CERT-In directions (Section 70B(6), IT Act, 2000).
When you close your account, request erasure, or withdraw consent, your personal profile data is purged within 30 days, with the explicit exception that processing logs, security audit logs, and minimum records required by applicable law are retained for their stated periods and deleted thereafter.
9. Children & Minor Protection (DPDP Act Section 9): The program is open to adults (18+) and students aged 16–17 with verified parental or lawful guardian authorization. Pursuant to Section 9 of the DPDP Act, behavioral monitoring, commercial tracking, and targeted marketing of minors are strictly prohibited, and marketing consent is automatically disabled for minors.
10. Data Principal Rights & Board Complaint Route: You have statutory rights to access personal data summaries (downloadable JSON export), request corrections, request erasure (with a 30-day grace period), designate a nominee (Section 14), and withdraw optional marketing consent at any time via your dashboard. If a privacy grievance is not resolved to your satisfaction through our internal redressal, you retain the legal right under Section 13(4) of the DPDP Act, 2023 to file a complaint directly with the Data Protection Board of India.
11. Privacy & General Support Contact: All privacy inquiries, rights requests, and statutory concerns are handled directly by Kangrew's designated Privacy Office at support@kangrew.com (acknowledgment within 24 hours, target resolution within 30 days, statutory cap 90 days under Rule 14(3)).
