Privacy Policy

INDIAN SCHOOL OF PUBLIC POLICY

Website Privacy Policy

Compliant with the Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025

Version	12-07-2026 (v2)	Effective	15 July 2026
Next review	By 11 July 2027, or on any material change in law or processing
Applies to	Personal data collected through ispp.org.in, apply.ispp.org.in and associated subdomains

1. Who We Are

ISPP programmes are delivered through a collaboration between the Foundation for Reinventing Governance and the Foundation for NextGen Governance.

For the personal data described in this policy, the Data Fiduciary is the Foundation for Reinventing Governance, operating as the Indian School of Public Policy – meaning it decides why and how your data is processed and is accountable to you for it under the DPDP Act, 2023.

Contact for all privacy matters: Shashi Kant Rai, Data Protection Officer / Contact Person · dpo@ispp.org.in

Neelam Kapoor, Compliance Lead – Data Protection · privacy@ispp.org.in · www.ispp.org.in/privacy

2. Scope

This policy applies only to personal data collected through ISPP’s websites.

It does not cover data collected during student enrolment and programme participation. That data is governed by a dedicated Participant Privacy Notice given to each scholar at enrolment (see Section 13).

A note on other laws. ISPP’s operations are based in India and this policy is built to comply with the DPDP Act, 2023. Where visitors reach us from the EU or UK, we make reasonable efforts to respect applicable rights under the GDPR and the UK Data Protection Act 2018. We do not claim these frameworks govern our Indian operations, and where they and the DPDP Act differ, this policy follows the DPDP Act.

Links to Other Sites

Our Service may contain links to external sites. We are not responsible for the privacy practices or content of those sites.

3. What We Collect and Why

We collect personal data only when you give it to us, or when it is generated automatically as you use the website.

3a. Information you give us

When you submit an enquiry form, apply for a programme, register for an event, or use our admissions chatbot (Neeti), we collect the information you choose to share – typically your name, email, phone number and academic background – to respond to you, process your application, and communicate with you about ISPP.

3b. Information collected automatically

When you visit, we automatically collect technical data: IP address, browser type and version, device type, pages visited, time on page, and referring URL. This keeps the site working, secure and improvable. We do not use it to identify you personally unless you have also submitted a form. This collection through non-essential cookies happens only after you consent (Section 4).

3c. Cookies and tracking

See Section 4.

4. Cookies and Tracking

Cookies are small files placed on your device when you visit a website. We use four categories.

Category	What it does	Consent
Essential	Session management, form security tokens, login state. The site cannot function without them.	Not required – strictly necessary
Analytics	Google Analytics (with IP anonymisation) and Zoho SalesIQ, to understand and improve usage.	Placed only after you consent
Advertising	Meta Pixel, Google Ads conversion tracking, LinkedIn Insight Tag, to show relevant programme information and measure campaigns.	Placed only after you consent; if you decline, these tags do not fire
Functional	Admissions chatbot, live chat, personalised content.	Placed only after you consent

A cookie consent banner appears on your first visit. You can accept all, reject all optional cookies, or choose by category – and rejecting is as easy as accepting. Update your choice anytime via the Cookie Settings link in the footer.

We may use tools like Google Analytics to monitor usage patterns. To opt out, install the Google Analytics opt-out browser add-on.

For more info: Google Privacy & Terms

5. How We Use Your Data

We use your personal data to:

• respond to your enquiry and send information you request;
• process and evaluate your application for an ISPP programme;
• communicate about your application status, offer letters and programme details;
• keep the website functional, secure and user-friendly;
• send you programme, event, scholarship and news updates – only where you have given separate marketing consent;
• comply with our obligations under the DPDP Act and other applicable laws;
• carry out internal analytics to improve admissions and outreach – through consented cookies or on aggregated, non-identifying data.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

6. Legal Basis for Processing

The DPDP Act recognises two lawful bases only: your consent (Section 6) and a closed statutory list of “certain legitimate uses” (Section 7).

Processing	DPDP basis
Enquiry, application, event registration, chatbot, marketing communications, analytics and advertising cookies	Consent (S. 6) – asked before collection; withdraw anytime at privacy@ispp.org.in
Responding to a lawful order, court judgment, or the requirement of any law	Legitimate use – S. 7(c) and 7(d)
Data you voluntarily provide for a purpose, where you have not indicated you object	Legitimate use – S. 7(b)
Essential cookies needed to deliver the website you asked for	Legitimate use – S. 7(a) (specified purpose voluntarily engaged)

On analytics specifically: ISPP treats analytics as consent-based – which is why analytics cookies fire only after you agree in the banner.

Withdrawing consent does not affect the lawfulness of processing done before you withdrew. It may mean ISPP can no longer provide a service that depended on that data; where so, we will tell you.

7. Data Sharing

We never sell your personal data.

We share data with service providers (Data Processors) who act only on our written instructions and only for the purposes in this policy. ISPP remains responsible to you for what they do. Each signs a Data Processing Agreement requiring them to process only on our instructions, apply the security safeguards in Rule 6 of the DPDP Rules, 2025, not subcontract without our written approval, and delete your data when the engagement ends.

Providers include technology platforms (Zoho, Moodle, SHL, Exotel, WATI), analytics and advertising platforms (Google, Meta, LinkedIn), hosting providers and payment processors. The current list is maintained at www.ispp.org.in/privacy/processors.

We disclose data to a court, government or regulator only where the law requires it, limited to what is strictly required, and – where the law permits – we will tell you.

8. Data Retention

ISPP, as a higher education institution, indefinitely retains all academic and other relevant non‑academic records related to individuals and entities that utilize one or more ISPP services.

Except for the above, ISPP stores personally identifiable information (PII), if any, only for as long as is strictly necessary to provide an improved and more relevant experience of ISPP services.

ISPP also retains aggregated and non‑identifying information about how users access and utilize ISPP services, solely to enhance and improve such services.

9. Children’s Data

Our website and programmes are intended for individuals aged 18 and above.

We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or lawful guardian, obtained in the manner set out in Section 9 of the DPDP Act and Rule 10 of the DPDP Rules, 2025. For any participant under 18 – such as in the YLAC High School Achievers programme – ISPP obtains verifiable parental or guardian consent before any data is collected, before any photograph or video is taken, and before any image or information is used in any communication.

For children, the Act also prohibits ISPP from: tracking or behavioural monitoring, and targeted advertising directed at the child. Advertising and tracking cookies are therefore never applied to anyone identified as under 18.

If you are a parent or guardian and believe a minor has given us data without your consent, write to privacy@ispp.org.in and we will delete it promptly.

10. Your Rights

Under the DPDP Act, 2023 you have the right to:

• Access (S. 11) – a summary of the data we hold about you, what we use it for, and who we have shared it with.
• Correction, completion, updating and erasure (S. 12) – fix inaccurate or incomplete data, and have data erased where it is no longer needed and no law requires us to keep it.
• Withdraw consent (S. 6) – at any time, as easily as you gave it; this does not affect processing already done.
• Grievance redressal (S. 13) – complain about how we handled your data (Section 15).
• Nominate (S. 14) – name someone to exercise your rights if you die or become incapacitated.

To exercise any right, write to privacy@ispp.org.in. We acknowledge within 48 hours and aim to resolve within 30 working days; the outer limit set by Rule 14 of the DPDP Rules, 2025 is 90 days. There is no fee. We may ask you to verify your identity using details we already hold – your registered email, phone or application reference – and will not demand documents we do not already have.

11. Data Security

ISPP applies the reasonable security safeguards required by Rule 6 of the DPDP Rules, 2025, including encryption of data in transit (TLS 1.2 or higher), role-based access controls, multi-factor authentication for staff accessing personal-data systems, access logging and monitoring, and backups for continuity. Access logs are retained for at least one year.

If a personal data breach occurs, ISPP will intimate affected individuals without delay and report to the Data Protection Board of India, providing the detailed report within 72 hours of becoming aware, as required by Rule 7 of the DPDP Rules, 2025 – and take immediate steps to contain the breach and prevent recurrence.

No internet transmission can be guaranteed fully secure. If you suspect your data with ISPP has been compromised, notify us at once at privacy@ispp.org.in.

12. International Users & Cross-Border Transfer

This policy is designed primarily to comply with Indian law, including the DPDP Act, 2023.

Cross-border transfer. Under Section 16 of the DPDP Act, ISPP may transfer personal data outside India except to any country or territory that the Central Government restricts by notification. Where we use overseas service providers, we ensure they are bound by our Data Processing Agreement and the safeguards in Rule 6, and we do not transfer to any restricted country.

If you access the website from the EU, UK or another jurisdiction with its own data protection law, we make reasonable efforts to respect your rights under those laws, to the extent they apply to our Indian operations.

13. Student Enrolment Data

Personal data collected during student enrolment and programme participation is governed by a separate DPDP-compliant framework and is distinct from website data. Enrolled scholars receive a dedicated Participant Privacy Notice and consent form at joining, setting out in full how their data is handled during and after their time at ISPP. Scholars may request a copy anytime at privacy@ispp.org.in.

14. Policy Updates

We may update this policy to reflect changes in law, technology or operations; the version and effective date above always show the current version. For material changes affecting how your data is used, we will notify you by email (if we hold your details) or by a prominent website notice before the change takes effect. Where a material change needs fresh consent, we will ask for it before processing your data in the new way. Continued use of the website is not consent to changes that affect your rights.

15. Grievance Redressal & Compliance Contact

ISPP has designated a Compliance Lead responsible for data protection across the organisation and reachable for all questions, rights requests and complaints:

Data Protection Officer	Shashi Kant Rai, dpo@ispp.org.in
Compliance Lead – Data Protection	Neelam Kapoor, privacy@ispp.org.in
Organisation	Indian School of Public Policy (Foundation for Reinventing Governance)
Web	www.ispp.org.in/privacy

We acknowledge within 48 hours and aim to respond fully within 30 working days (statutory outer limit 90 days). If you are not satisfied, you may escalate to the Data Protection Board of India; appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal.

This policy is written in plain language and is not legal advice. For a complex data-protection query, consult a qualified legal professional.