Welcome to the official Global Privacy & Data Protection Policy of the Deep Science & Technology Consortium (DSTC) — a registered business entity under the Ministry of Corporate Affairs (MCA), the MSME Udyam Portal, and the DPIIT / Startup India Bhaskar Registry (Bhaskar ID: OI-0826-9515YL), India. DSTC provides specialized scientific education, advanced computational workshops, research certifications, webinars, and R&D consultancy across Artificial Intelligence, Life Sciences, Nanotechnology, and Energy/Sustainability divisions.

This policy governs all personal data collected, processed, stored, and transferred through our website (dstc.org.in), Scholar Portal, Learning Management System (LMS), payment gateway, email communications, and affiliated digital properties. It applies to all registered scholars, workshop participants, webinar attendees, research mentors, institutional partners, and visitors worldwide.

1. Categories of Personal Data We Collect

DSTC collects only the personal data that is strictly necessary for delivering our academic services, issuing verified credentials, processing payments, and maintaining portal security.

2. Lawful Grounds & Purposes of Processing

Under GDPR Article 6 and the DPDP Act 2023, DSTC processes personal data on the following lawful bases:

You may withdraw consent at any time by writing to privacy@dstc.org.in. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

3. Payment Data & Razorpay Processing

All payments on dstc.org.in are processed exclusively through Razorpay Software Private Limited, a PCI-DSS compliant payment aggregator regulated by the Reserve Bank of India (RBI). DSTC does not store, transmit, or have access to your complete card number, CVV, UPI PIN, net banking credentials, or wallet passwords at any point.

When you initiate payment, you are redirected to Razorpay’s secure hosted payment page. Razorpay’s own Privacy Policy governs all data processed during that session: razorpay.com/privacy.

Proforma Invoices & Grant Letters: If you apply for institutional sponsorship or grant-based admission, we collect your institution name and postal address to generate a formal Proforma Invoice. This document is shared only with the specific institution or grant body you designate.

4. Learning Management System (LMS) & Course Data

DSTC uses Tutor LMS (by Themeum) integrated into our WordPress platform to deliver course content, track progress, and issue verifiable digital certificates. The following LMS-specific data practices apply:

• Progress Telemetry: Video watch percentage, quiz attempt history, module completion timestamps, and last-accessed position are recorded to enable resume functionality and to issue completion certificates when 100% progress is confirmed.
• Certificate Records: Upon course completion, a DSTC-issued digital certificate is generated containing your full name, course title, completion date, and a unique verification ID. This certificate data is retained indefinitely to support third-party verification requests from employers or academic institutions.
• Webinar Attendance Logs: For live webinars (hosted via Zoom or equivalent), registration name, email, and attendance duration are logged for certificate issuance. Webinar session recordings may be made available to registered participants only.
• Assessment Data: Quiz responses and scores are stored in encrypted form. Individual responses are not shared externally. Anonymised aggregate performance data may be used to improve course content quality.

5. Artificial Intelligence & Automated Processing

DSTC uses AI-assisted tools in limited, defined contexts. You have the right to be informed about and — where significant decisions are made — to contest automated processing.

Current AI Usage at DSTC

• Course Recommendation: AI-assisted recommendations suggest relevant courses or webinars based on your enrolled programmes and declared research area. No automated enrolment or pricing decisions are made by AI alone.
• Spam & Fraud Detection: Automated systems analyse registration patterns and payment behaviours to detect fraudulent accounts. Accounts flagged by automated systems are reviewed by a human administrator before any action is taken.
• Email Personalisation: AI-assisted personalisation may customise programme reminder emails based on your registration status and course progress. This does not involve profiling for marketing to third parties.
• Content Generation Assistance: DSTC may use AI tools to assist in drafting course descriptions or resource materials. All published content is reviewed and approved by subject-matter experts before publication.

Under GDPR Article 22 and DPDP Act principles, you may request human review of any decision that materially affects you by writing to privacy@dstc.org.in.

6. Authorised Third-Party Service Processors

DSTC engages carefully selected third-party processors under written data processing agreements (DPAs). These processors act only on DSTC’s documented instructions and may not use your data for their own purposes.

7. International Data Transfers

DSTC serves researchers and scholars globally. When personal data is transferred outside India or the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• For transfers from the EU/EEA: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission (2021/914) as the primary transfer mechanism. Where applicable, we additionally rely on adequacy decisions or Binding Corporate Rules.
• For transfers from India (under DPDP Act 2023): Data is transferred only to countries or entities approved by the Central Government of India, or where the transfer is necessary for contract performance, or where the data principal has explicitly consented.
• Data localisation: All primary data storage occurs on servers located within India (Hostinger India data centres). Backups and CDN edge caching may involve servers in Singapore or EU data centre regions.

8. Data Security & Retention Schedules

Security Measures

• Encryption in Transit: All data transmitted between your browser and dstc.org.in is encrypted using TLS 1.2/1.3 (HTTPS enforced site-wide).
• Encryption at Rest: Sensitive database fields (passwords, payment references) are encrypted at rest using AES-256.
• Access Controls: Scholar Portal data is accessible only to authenticated users. Administrative access is restricted by role-based permissions and protected by multi-factor authentication.
• Vulnerability Management: WordPress core, plugins, and theme updates are applied on a regular schedule. Critical security patches are deployed within 48 hours of release.
• Intrusion Detection: Server-level monitoring and rate limiting are implemented to detect and block brute-force, DDoS, and injection attacks.

Data Retention Schedule

After the applicable retention period, data is securely deleted or anonymised so that it can no longer be attributed to any individual.

9. Your Statutory Rights (DPDP Act 2023 & GDPR)

Depending on your jurisdiction, you are entitled to the following rights with respect to your personal data:

To exercise any of the above rights, submit a request to privacy@dstc.org.in with your registered email address and details of the right you wish to exercise. We will acknowledge your request within 72 hours and respond substantively within 30 days (extendable by a further 30 days for complex requests, with notice).

10. Cookie Policy & Tracking Technologies

dstc.org.in uses cookies and similar tracking technologies to operate core site functionality, measure performance, and improve user experience. A full and detailed Cookie Policy is available at dstc.org.in/cookie-policy/.

You can manage cookie preferences at any time through the consent banner displayed on your first visit. You may also opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout.

11. Children’s Privacy

DSTC’s programmes are designed exclusively for adult researchers, postgraduate students, and professionals. We do not knowingly collect personal data from individuals under the age of 18 years.

If we become aware that personal data of a minor has been collected without verified parental consent, we will delete such data promptly. If you are a parent or guardian and believe a minor has provided us with personal data, contact us at privacy@dstc.org.in and we will take immediate action.

Under the DPDP Act 2023, processing of personal data of a child (under 18) requires verifiable parental consent. DSTC’s registration systems are designed to prevent enrolment by individuals who indicate their age as below 18.

12. Policy Updates & Versioning

This Privacy Policy may be updated periodically to reflect changes in our data practices, legal requirements, or new services introduced by DSTC. All updates will be:

• Published on this page with an updated “Last Updated” date and version number.
• Notified to all registered scholars via email at least 14 days before material changes take effect.
• Archived — previous versions will remain accessible upon request by writing to privacy@dstc.org.in.

Continued use of our services after the effective date of a policy update constitutes acceptance of the revised terms. If you do not agree with material changes, you have the right to withdraw from our services and request erasure of your data.

13. Grievance Officer & Statutory Contact Information

In accordance with the IT Act 2000, IT Rules 2011, and the DPDP Act 2023, DSTC has designated a Grievance Officer for addressing data protection concerns: