Privacy Policy & Data Protection

1. Introduction and Scope

Kangrew Technologies Pvt. Ltd. ("Kangrew", "we", "our", or "us") provides practical technical skill-building courses, software engineering internship simulations, task evaluations, and verified credential services. We are committed to processing your personal data responsibly, transparently, and in alignment with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the notified Digital Personal Data Protection Rules, 2025.

This Privacy Policy governs personal data processed through our website (kangrew.com), student portals, application forms, and digital communication channels. It sets out the categories of personal data collected, lawful bases, processing purposes, retention criteria, security safeguards, and the statutory rights available to you as a Data Principal.

Statutory Context & Phased Commencement: Following enactment of the Digital Personal Data Protection Act, 2023 by the Parliament of India, statutory provisions and operational rules are notified and brought into force by the Central Government in phases:

• 13 November 2025: Initial administrative provisions and establishment of the Data Protection Board of India.
• 13 November 2026: Section 6(9), Section 27(1)(d), and Rule 4 (Consent Managers).
• 13 May 2027: Remaining scheduled substantive provisions (Sections 5, 6(1)–(8), 7, 8, 9, 10, 11–16) and Rules 3, 5–16, 22, and 23 (Notice, consent, security, breach reporting, children's data, and Data Principal rights).
• Section 9 & DPDP (Removal of Difficulties) Order, 2026: Section 9(1) of the DPDP Act, as clarified by the DPDP (Removal of Difficulties) Order, 2026, covers personal data of a child or of a person with a disability who has a lawful guardian; verifiable consent of the parent or lawful guardian is required. Behavioral monitoring and targeted advertising of children remain strictly barred. Kangrew proactively aligns with these requirements and honors Data Principal rights in advance of statutory commencement.

2. Identity and Contact Details of Kangrew as the Data Fiduciary

Under Section 2(i) of the DPDP Act, 2023, Kangrew Technologies serves as the Data Fiduciary, determining the purpose and means of processing personal data:

3. Categories of Personal Data Collected

We collect personal data directly from you when you register, apply for internship tracks, submit coursework, or communicate with our support team. Categories include:

• Account & Identity Data: Full name, student email address, contact phone number, cryptographically hashed passwords, and age verification / age confirmation declaration.
• Academic & Profile Data: College or educational institution affiliation, degree or qualification, graduation/passing year, city, state, country, optional gender (collected optionally without conditioning program access), LinkedIn profile URL, and GitHub repository links.
• Campus Ambassador Applicant & Representative Data: Full name, email address, mobile number, college/university affiliation, city, state, motivation statement, optional social profiles (LinkedIn, Instagram), unique referral code, attributed student enrollments, discount applied, calculated referral commission earnings, and affirmative consent logs.
• Coursework & Project Deliverables: Task code submissions, project milestone uploads, repository URLs, evaluation screenshots, mentor review notes, and performance metrics.
• Credential & Certification Records: Unique verifiable certificate identifiers, course completion dates, student names, and verification QR code hashes.
• Financial Transaction Metadata: Razorpay payment identifiers, order IDs, payment status, transaction amounts, currency, and timestamps. (Kangrew never collects or stores raw debit/credit card numbers, CVVs, net-banking credentials, or UPI PINs; all payment transactions are handled through Razorpay's secure checkout infrastructure).
• Technical & Operational Data: IP addresses for security rate-limiting and fraud prevention, browser user agent strings, session tokens, transaction tokens, and recorded privacy consent preferences.

4. Purposes of Processing

Kangrew processes personal data solely for specified, explicit, and lawful educational, administrative, and platform purposes. Each category of personal data collected maps to a concrete processing purpose:

• Identity & Account Data (Name, Email, Phone, Hashed Password, Age Confirmation): Authenticating student identity, managing secure platform sessions, confirming majority under Section 9 of the DPDP Act, and dispatching essential transactional notifications and security OTPs.
• Academic & Geographic Data (College, Qualification, Passing Year, City, State, Country): Processing internship applications, evaluating cohort prerequisites, and contextualizing practical coursework assignments.
• Demographic Information (Gender - Optional): Optional field provided voluntarily by applicants; not a precondition for admission or program access, and not utilized for automated profiling or differential evaluation.
• Campus Ambassador Data (Name, Contact Details, College, Statement, Referral Attributions): Evaluating ambassador applications, issuing unique referral codes, tracking campus outreach and discount redemptions, managing performance rewards, maintaining statutory consent logs, and communicating program opportunities.
• Coursework & Deliverables (Code Submissions, File Uploads, GitHub/LinkedIn URLs): Reviewing project assignments, conducting mentor feedback, assessing task revisions, and confirming completion prerequisites.
• Credential & Certification Records (Certificate ID, Issue Date, Student Name): Generating, issuing, and maintaining the permanent, publicly verifiable credential registry.
• Financial Transaction Metadata (Razorpay Order IDs, Payment IDs, Amounts, Currency, Timestamps): Verifying successful enrollment transactions, facilitating refunds, preventing financial fraud, and fulfilling mandatory statutory tax and accounting retention requirements under Indian law (Section 8(7)).
• Technical & Telemetry Data (IP Addresses, User Agent Strings, Consent Preferences): Enforcing defensive security rate-limiting, detecting automated intrusions, maintaining evidentiary logs of affirmative consent decisions under Section 6 of the DPDP Act, and diagnostic system monitoring.

5. Applicable Lawful Bases for Processing

Under Section 4(1) of the DPDP Act, 2023, Kangrew processes personal data only where a recognized lawful basis exists:

• Explicit Consent (Section 6(1)): For account creation, processing profile data, and optional communication preferences, processing is based on your free, specific, informed, unconditional, and unambiguous consent given through an affirmative action.
• Specified Purposes / Service Delivery (Sections 4 & 7): Processing strictly necessary to fulfill student-requested services, evaluate submitted assignments, track progress, and issue credentials under the educational agreement requested by the Data Principal.
• Compliance with Legal Obligations (Section 7): Processing required to comply with statutory accounting, tax, cyber security, or regulatory obligations under applicable Indian laws.

We maintain a strict distinction between voluntary consent and operational necessity: agreeing to optional marketing or non-essential cookies is never a precondition for accessing core educational services.

6. Notice and Consent Requirements

In compliance with Section 5 of the DPDP Act, 2023 and the DPDP Rules, 2025:

• Prior to or at the time of requesting consent, Kangrew provides an accessible notice identifying the personal data to be collected, the specific purpose of processing, and how the Data Principal may exercise statutory rights and lodge grievances.
• Consent requests are itemized and granular. Accepting this Privacy Policy does not constitute blanket consent for secondary or optional processing activities.
• Optional marketing communications require an explicit, unbundled opt-in and remain unselected by default.

7. Data Minimisation and Purpose Limitation

Under Section 6(1) and Section 8(1) of the DPDP Act, 2023, Kangrew limits the collection of personal data to what is strictly necessary for stated educational purposes. We do not process personal data for any purpose that is incompatible with the original reasons disclosed to you without obtaining renewed, explicit consent.

8. Data Accuracy and Correction

In accordance with Sections 8(3) and 12 of the DPDP Act, 2023:

• Kangrew takes reasonable steps to ensure that personal data processed is accurate, complete, and consistent, especially where data is used to make decisions affecting the Data Principal or is disclosed to authorized processors.
• Students may review, rectify, or update their profile data directly via the Student Portal or by submitting a correction request to support@kangrew.com.

9. Data Retention and Deletion

Under Section 8(7) and Section 8(8) of the DPDP Act, 2023, personal data must be erased as soon as the specified purpose for which it was collected is satisfied or upon consent withdrawal, save where retention is required by applicable law. Kangrew maintains a purpose-specific retention schedule:

• Accounting Books & Supporting Financial Records (8 Financial Years): Company books of account, student invoice records, Razorpay payment gateway audit logs, and transaction vouchers are retained for not less than eight financial years immediately preceding the current financial year pursuant to Section 128(5) of the Companies Act, 2013, read with Section 44AA of the Income-tax Act, 1961 and Section 36 of the Central Goods and Services Tax Act, 2017. General student and ambassador personal profile data is decoupled and not retained under this eight-year statutory rule.
• Ambassador Commission & Referral Records (8 Financial Years): On-platform referral counts, course attribution records, discount applied, and calculated commission earnings are retained for eight financial years as supporting financial audit records under Section 128(5) of the Companies Act, 2013. Ambassador payouts are administered off-platform; where banking, UPI, or tax identification details are collected by Kangrew finance personnel for disbursement and statutory tax reporting, those records are maintained separately in secure accounting archives for eight financial years.
• Payment Transaction Records (8 Financial Years): Razorpay gateway order IDs, transaction timestamps, invoice receipts, and currency audit records are retained for eight financial years for statutory tax and financial audit reconciliation. Payment card and account credentials are not handled or stored on Kangrew servers; transactions are processed directly through Razorpay's secure checkout infrastructure.
• Referral Attribution Records (3 Years): Referral click logs, lead tracking metrics, and non-financial coupon application history are retained for 3 years based on commercial reconciliation and the general 3-year limitation period for contractual claims (Schedule to the Limitation Act, 1963, Articles 55 and 113). This is an operational and evidentiary retention period, not a statutory DPDP minimum.
• Consent Audit Evidence (Processing Duration + 3 Years): Affirmative consent logs and withdrawal records are maintained for the duration of active processing plus 3 years following account closure or consent withdrawal to defend against legal disputes under Limitation Act, 1963 and Section 6(1) of the DPDP Act. This is an evidentiary defense standard, not a statutory DPDP minimum.
• Student & Ambassador Profile Information: Active student and ambassador profile data is retained for the lifetime of the active account + six months post-deactivation for administrative offboarding; pending applications are retained for 90 days (evaluation cycle); and rejected applications for 90 days from decision date, after which applicant personal profile data is purged. Verifiable credential registry hashes (Certificate IDs) remain available for permanent third-party validation as authorized by the student.
• Processing & Security Telemetry Logs (1 Year): Processing logs, application security audit trails, reverse-proxy connection logs, and network telemetry are retained for one year (365 days) and then permanently deleted, in compliance with Rule 6(1)(e) and Rule 8(3) of the DPDP Rules, 2025. This one-year period satisfies and exceeds the 180-day regulatory floor established under CERT-In directions (Section 70B(6) of the Information Technology Act, 2000).

When you close your account, request erasure, or withdraw consent, your personal data will be irreversibly purged within 30 days, with the explicit exception that processing logs, security audit logs, and the minimum records required by applicable law (such as financial vouchers and statutory consent evidence) are retained for their stated retention periods and deleted thereafter.

10. Reasonable Security Safeguards

Pursuant to Section 8(5) of the DPDP Act, 2023, Kangrew implements robust technical and organizational security safeguards to prevent personal data breaches, unauthorized access, alteration, or disclosure:

• Transport Encryption: HTTPS with Transport Layer Security (TLS) across all platform endpoints.
• Password Security: Cryptographic password hashing utilizing salted bcrypt algorithms with adaptive work factors.
• Authentication Security: Multi-factor authenticated administrative interfaces, cryptographically signed JSON Web Tokens (JWT), and time-limited HMAC-SHA256 OTP verification.
• Database Safeguards: Parameterized SQL queries preventing injection, role-based least-privilege database user access controls, and periodic encrypted database backups. Append-only database triggers prevent deletion or tampering of historical consent evidence.
• Perimeter Defense & Indian Jurisdiction Logging: Automated sliding-window rate limiting on authentication and registration endpoints to prevent brute-force attacks. Applicable ICT system logs and security access telemetry are maintained securely within Indian jurisdiction in compliance with statutory CERT-In directions.

11. Personal Data Breach Handling and Notification

In compliance with Section 8(6) of the DPDP Act, 2023 and the DPDP Rules, 2025:

• Kangrew maintains an Incident Response Protocol to identify, contain, assess, and remediate any potential unauthorized access, exposure, or destruction of personal data.
• In the event of a confirmed personal data breach, Kangrew will notify the Data Protection Board of India (DPBI) and each affected Data Principal without delay in the form and manner prescribed under Section 8(6) of the DPDP Act and applicable statutory rules.
• Breach notifications will set out the nature of the breach, personal data categories affected, estimated consequences, and mitigating actions taken.

12. Data Sharing and Third-Party Processors

Kangrew engages a minimal number of trusted third-party service processors operating under strict contractual and statutory confidentiality obligations:

• Hosting & Cloud Infrastructure: Hostinger International Ltd. provisions cloud hosting, application web servers, reverse-proxy routing, and database storage.
• System & Transactional Communications: Hostinger Business Email / secured transactional mail infrastructure dispatches security OTPs, enrollment acknowledgments, and password recovery communications.
• Payment Processing: Razorpay Software Private Limited processes enrollment payments and statutory checkout transactions.
• Campus Ambassador Referral Attribution: When you voluntarily enter or enroll through a campus ambassador referral code, limited masked transaction attribution details (your first name, masked email address e.g. a***@domain.com, enrolled course track, and enrollment date) are shared with the referring ambassador on their private dashboard. This data sharing is conducted strictly to enable discount validation, referral verification, and commission payout accounting, and never exposes your full name, full email address, or contact telephone number to the ambassador.
• Zero Data Brokerage: Kangrew does not sell, rent, monetize, or trade student personal data to third-party ad networks, data brokers, or commercial marketing agencies.
• Statutory Disclosures: Personal data may be shared with judicial or law enforcement authorities only when mandated by valid legal process or court order under Indian law.

13. Student and Minor Data Protection

Section 9(1) of the DPDP Act, as clarified by the DPDP (Removal of Difficulties) Order, 2026, covers personal data of a child or of a person with a disability who has a lawful guardian; verifiable consent of the parent or lawful guardian is required:

• Kangrew is committed to safeguarding minors (individuals under 18 years of age) and persons with disabilities who participate in practical learning programs.
• We do not engage in behavioral monitoring, tracking, targeted advertising, commercial profiling, or automated assessment of children.
• We strictly refrain from any processing of personal data that is likely to cause a detrimental effect on the physical, mental, or moral well-being of a child.
• Educational interactions, coursework milestone evaluations, and mentor feedback necessary for course completion are conducted solely for instructional delivery and are strictly insulated from behavioral profiling or commercial exploitation.

14. Parental or Guardian Consent Where Legally Required

Section 9(1) of the DPDP Act, as clarified by the DPDP (Removal of Difficulties) Order, 2026, covers personal data of a child or of a person with a disability who has a lawful guardian; verifiable consent of the parent or lawful guardian is required:

• Where personal data of a minor (under 18 years of age) or a person with a disability who has a lawful guardian is processed, verifiable consent of the parent or lawful guardian is required before account activation or processing begins.
• Our registration workflow incorporates a verified age gate. When an applicant indicates they are under 18, their registration is subject to parental or lawful guardian verification via a secure, single-use confirmation token sent to the parent/guardian's email, or enrollment is restricted until such authorization is completed.
• For all confirmed minor accounts, optional analytics, commercial profiling, and promotional marketing are permanently hard-disabled server-side.

15. Rights of Data Principals & Exercise Procedures

Under Chapter III of the DPDP Act, 2023, you are entitled to exercise the following statutory rights directly through our platform:

• Right to Access Information (Section 11): Right to obtain a summary of personal data processed by Kangrew, identities of processors with whom data was shared, and related processing information. Students can instantly download a complete, machine-readable JSON data export via the Student Profile under the "Privacy & Data Rights" section.
• Right to Correction & Updation (Section 12): Right to correct inaccurate personal data, complete incomplete records, and update outdated information via the self-service profile dashboard or by submitting a correction ticket.
• Right to Erasure (Section 12): Right to request complete erasure of personal data that is no longer necessary for educational delivery. Students can schedule account erasure directly in their profile with a 30-day statutory grace period, or request immediate purge upon re-authentication.
• Right to Nominate (Section 14): Right to nominate an individual who, in the event of death or incapacity, shall exercise your rights as a Data Principal. Students may designate or update their nominee (full name, relationship, email, and phone number) directly in the Student Profile under "Designated Nominee". In the event of death or incapacity, the nominee may exercise statutory rights upon furnishing valid legal documentation.

Identity Verification Means: To prevent unauthorized disclosures, requests submitted through the online Student Portal require active session token authentication and password confirmation. For requests submitted via email to support@kangrew.com, Kangrew requires verification from the registered student email address along with confirmation of enrollment identifiers (and, where necessary to prevent fraud, appropriate authentication safeguards).

16. Grievance Redressal Mechanism

In accordance with Section 13 of the DPDP Act, 2023 and Rule 14 of the DPDP Rules, 2025:

17. Withdrawal of Consent

Under Section 6(4) of the DPDP Act, 2023:

• You have the right to withdraw consent at any time as easily as consent was originally provided.
• Optional browser storage and cookie preferences can be modified or revoked immediately via the floating Cookie Settings button or the Privacy Preference Centre.
• Marketing and promotional email consent can be withdrawn by clicking the unsubscribe link in communications or by emailing support@kangrew.com.
• Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

18. Account Deletion and Data Erasure Requests

Pursuant to Section 12(3) and Section 8(7) of the DPDP Act, 2023:

• Students may initiate self-service deletion directly from the Student Profile page or by submitting an authenticated request to support@kangrew.com.
• Upon verification, your profile, coursework submissions, uploaded task files, and account credentials are scheduled for permanent erasure with a short grace window, completing within 30 days.
• Files stored on disk (screenshots, avatars, documents) are strictly purged with path traversal validation.
• Where digital certificates have been issued, public verification endpoints will reflect an anonymized "Record Erased" status rather than exposing student identities.
• Archival financial records strictly required for taxation and audit compliance are isolated with restricted access and retained only for the legally mandated period.

19. International Data Transfers, Where Applicable

In accordance with Section 16 of the DPDP Act, 2023:

• Kangrew's core application databases and student data repositories are hosted on secure cloud infrastructure provided by Hostinger International Ltd.
• Where cloud processing or support tools involve cross-border transfers, transfers are conducted only to territories that are not restricted by the Central Government of India, and are governed by equivalent security and confidentiality safeguards.

20. Cookies and Browser Storage

We distinguish between essential operational storage and optional convenience technologies:

• No Tracking HTTP Cookies: Kangrew does not deploy cross-site tracking HTTP cookies, advertising pixels, or third-party web beacons.
• Essential Storage: Browser localStorage and sessionStorage strictly required to maintain authenticated sessions, CSRF tokens, and application workflow state. Always active.
• Functional Storage: Optional client storage used to remember interface theme choices (light/dark mode) and cache client-side drafts.
• Analytics & Marketing Storage: Optional categories managed through our Privacy Preference Centre. Kangrew currently does not run third-party advertising tracking scripts.
• Global Cookie Controls: You can review or adjust your storage preferences at any time using the permanent floating Cookie Settings button on any page.

21. Privacy Policy Updates

We may update this Privacy Policy periodically to reflect service enhancements, infrastructure updates, or regulatory notifications under the DPDP Act, 2023 and DPDP Rules, 2025.

All modifications are recorded in our version-controlled privacy_policy_versions database. Material changes (such as new processing purposes, altered data categories, or changes in third-party processors) will be highlighted through prominent notices and will prompt existing students for renewed consent where legally required. The active policy version and effective date are displayed dynamically at the top of this notice.

22. Contact Details for Privacy-Related Requests

For inquiries, statutory rights requests, or feedback regarding our privacy practices: