Privacy Policy

This privacy policy explains how SJCE Mysore (sjcemysore.org) (“we”, “us”, “our”), the operator of SJCE Mysore at sjcemysore.org, collects, uses, stores and protects your personal data when you read our articles, contact us, create an account or buy one of our independent services. SJCE Mysore is an independent information resource about SJCE Mysuru’s heritage, engineering education and student life in Mysuru. It is not the website of Sri Jayachamarajendra College of Engineering, JSS Science and Technology University or JSS Mahavidyapeetha, and none of those institutions receives or controls the data described here.

1. Scope of this policy

This policy covers personal data processed through sjcemysore.org, including the articles, heritage archive, contact form, WooCommerce shop and customer accounts, and the emails we exchange with you about them. It does not cover websites we link to, such as official university, KEA or COMEDK portals, or payment gateways and couriers. Each of those has its own privacy policy.

We wrote this policy to meet the main laws that apply to our audience:

• India: the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (notified on 13 November 2025, with most obligations commencing in phases up to May 2027); the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“IT Rules 2011”), as long as they remain in force; and the Consumer Protection (E-Commerce) Rules, 2020 for our online sales.
• European Union and United Kingdom: the General Data Protection Regulation (EU) 2016/679 (“GDPR”), and the UK GDPR together with the Data Protection Act 2018, when you visit us from those regions or we offer services to you there.
• United States: the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), to the extent it applies to us, and other US state privacy laws where relevant.

Where these laws differ, we try to apply the more protective standard to everyone, whatever their location.

2. Who we are and how to contact us

The Data Fiduciary (India) and controller (EU/UK) for this website is SJCE Mysore (sjcemysore.org), Mysuru, Karnataka, India. You can contact us about privacy by email at hello@sjcemysore.org or by phone on (phone available on request via the contact form). Please put “Privacy request” in the subject line so we can route it quickly. Our Grievance Officer’s details are in section 14.

SJCE, JSS Science and Technology University (JSS STU) and JSS Mahavidyapeetha do not operate this site or process your data through it. For official matters, use jssstuniv.in, and do not send official documents to us.

3. Personal data we collect

3.1 Data you give us

• Contact form: your name, email address, phone number (optional), subject and message, and a record that you ticked the consent checkbox. Submissions are stored in our WordPress database and emailed to us. Spam is stopped by a hidden “honeypot” field, not a third-party CAPTCHA.
• Customer account and orders (WooCommerce): your name, email, phone number, billing address and, for the physical IoT project kit, your shipping address. We also keep what you bought, your order notes (for example, preferred session times), your order history and, for accounts, your username and a password hash. Passwords are never stored in readable form.
• Service delivery information: for a counselling session, bootcamp, mentoring or tour, you may choose to share information such as your entrance exam rank range, preferred branches, academic background or a draft paper. Please share only what we need. Never send Aadhaar numbers, original certificates, bank passwords or medical records.
• Payment information: third-party payment gateways handle online payments. We receive only the transaction reference, status, amount and sometimes the instrument type or last digits. We never receive or store your full card number, CVV, UPI PIN or net-banking credentials. For bank transfers, we see the remitter details on our bank statement. For cash on delivery, we record the cash payment.
• Correspondence: emails, correction requests, copyright notices and any other messages you send us.

3.2 Data collected automatically

• Security and firewall data (Wordfence): IP addresses, browser user agents, requested URLs, timestamps, login attempts (successful and failed) and blocked requests. We use this only to protect the site against attacks, brute-force logins and spam.
• Server logs: our hosting server keeps standard access and error logs (IP address, date and time, page requested, referring URL, browser type and HTTP status code) for security, troubleshooting and capacity planning.
• Cookies: WordPress, WooCommerce, CookieYes and Wordfence set a small number of cookies. Almost all of them are strictly necessary for login, the shopping cart, security or remembering your consent choice. They are listed with their durations in our Cookie Policy.
• Local storage on your device: our theme saves a few preferences in your browser’s localStorage: dark mode, text size and the articles you bookmark in your reading list. This data stays on your device. It is never sent to our server, and you can clear it at any time through your browser settings.
• Consent record: the CookieYes banner stores your cookie choice in a cookie named “cookieyes-consent” so that it does not ask you again on every page.

3.3 What we do not collect

• We do not run Google Analytics or any other analytics tool by default. We have no advertising networks, social-media tracking pixels or session-recording tools.
• We do not load Google Fonts or any third-party CDN. All assets are self-hosted, so reading a page does not pass your IP address to font or CDN providers.
• We do not knowingly collect sensitive personal data such as health information, biometric data, caste or religion, sexual orientation or financial account passwords. Please do not send it to us.

4. Why we use your data and our legal basis

The table below lists each purpose and the legal ground we rely on. Under the DPDP Act, we process personal data either with your consent or for a “certain legitimate use” under section 7, for example where you have voluntarily provided data for a specific purpose and have not said you object. Under the GDPR/UK GDPR, we rely on the bases in Article 6.

Purpose	Data used	India (DPDP Act)	EU/UK (GDPR)
Replying to contact form messages and emails	Name, email, phone, message	Consent (checkbox) / voluntarily provided data	Consent; legitimate interests
Processing orders, delivering digital downloads, scheduling sessions and shipping kits	Account, billing, shipping, order data	Voluntarily provided for the specified purpose; consent	Performance of a contract
Payments, invoices, GST and accounting records	Order and transaction data	Compliance with law; legitimate use	Legal obligation
Website security, fraud and spam prevention	IP address, logs, login attempts	Legitimate use / legal obligations on reasonable security safeguards	Legitimate interests (keeping the site secure)
Remembering your cookie choice	Consent cookie	Consent record-keeping	Legal obligation (proof of consent)
Handling refund, correction, copyright and privacy requests	Request details, contact data	Compliance with law; voluntarily provided data	Legal obligation; legitimate interests
Optional newsletters or marketing emails (only if we offer them and you opt in)	Email, name	Consent	Consent

We make no solely automated decisions with legal or similarly significant effects, and we build no advertising profiles.

5. Who we share data with

We share personal data only when needed, and only with:

• Payment gateways, which process online payments under their own regulatory obligations and privacy policies;
• Courier partners, for physical IoT kits only. They receive your name, shipping address, phone number and parcel details;
• Hosting and email providers, acting as data processors under confidentiality and security obligations;
• Wordfence’s threat-intelligence service, which may receive limited security data, such as IP addresses involved in attacks, to identify and block malicious traffic;
• Video-conferencing providers, when you join a live online session;
• Professional advisers and authorities, under confidentiality or where Indian law requires it, or to establish or defend legal claims;
• A successor operator if the site is transferred. It would have to honour this policy.

We do not sell personal data, and we do not share it with SJCE, JSS STU, JSS Mahavidyapeetha, KEA, COMEDK, any college or coaching institute, advertisers or data brokers.

6. Software that touches personal data

The site runs on self-hosted WordPress. WooCommerce handles the cart, checkout, orders and accounts, and keeps that data in our own database. Wordfence provides the firewall, malware scanning and login security (see section 3.2). WP Hide & Security Enhancer hardens default WordPress paths and collects no visitor data. Yoast SEO generates metadata and sitemaps and collects no visitor data. CookieYes runs the consent banner. Our theme’s contact form stores messages in our database and emails them to us, with a honeypot instead of a third-party CAPTCHA.

7. Images and external content

Creative Commons images from Wikimedia Commons are credited and hosted on our own server, so viewing them does not send your IP address to Wikimedia. When you follow an external link, the site you visit receives your IP address and browser information under its own policy.

8. How long we keep data

Data	Retention period
Contact form messages and general correspondence	Up to 24 months after our last exchange, then deleted, unless the message relates to an order or a legal matter
Order, invoice and payment records	For as long as Indian tax, GST and accounting laws require (generally up to eight years), then deleted or anonymised
Customer accounts	Until you ask us to delete the account, or after 3 years of inactivity, subject to the order-record retention above. We will notify you before deleting an inactive account where the law requires it.
Service-delivery materials (for example, mentoring drafts you send)	Up to 6 months after the service ends, unless you ask us to delete them sooner
Security, firewall and server logs	One year, in line with the minimum log retention set by the DPDP Rules, 2025, then deleted, unless a log is needed longer to investigate a specific incident
Cookie consent record	Up to 12 months, after which the banner asks again
Local storage preferences	On your device until you clear them. We never hold them.

9. Your rights under Indian law (DPDP Act 2023)

As a Data Principal under the DPDP Act, you have the right to:

• Access information: obtain a summary of the personal data we process about you, the processing activities, and the identities of other Data Fiduciaries and Data Processors we have shared it with.
• Correction, completion, updating and erasure: ask us to correct inaccurate data, complete incomplete data, update it, or erase data that is no longer needed, unless we must keep it by law.
• Withdraw consent: withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing that happened before it.
• Grievance redressal: have your complaint handled by us, and escalate it to the Data Protection Board of India if you are not satisfied.
• Nomination: nominate another person to exercise your rights if you die or become incapacitated.

We respond within the period set by the DPDP Rules, 2025 (no more than 90 days), and usually much sooner. Data Principals also have duties under section 15 of the Act, such as not filing false complaints or impersonating others.

10. Your rights under the GDPR and UK GDPR

If you are in the EU, the European Economic Area or the UK, you have the right to:

• access your personal data and receive a copy;
• have inaccurate data rectified;
• have data erased (“right to be forgotten”) in certain circumstances;
• restrict processing in certain circumstances;
• receive data you provided in a portable, machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data protection supervisory authority, or with the Information Commissioner’s Office (ICO) in the UK.

We respond to GDPR requests within one month. We may extend this by two further months for complex requests, and if we do, we will tell you why.

International transfers: we are based in India (courts of Mysuru, Karnataka), and our providers may process data in India or elsewhere. For transfers of EU/UK data to countries without an adequacy decision, we rely on recognised safeguards such as Standard Contractual Clauses (with the UK Addendum), or on legal derogations such as contractual necessity.

11. Notice to California residents (CCPA/CPRA)

To the extent the CCPA/CPRA applies to us: in the last 12 months we collected identifiers (name, email, phone, IP address), customer records (billing and shipping address), commercial information (purchases), internet activity (security logs) and, only if you volunteered it, education information (such as an entrance-exam rank range). We collected it from you, from your device and from payment gateways (payment status only), for the purposes in section 4.

• We do not sell personal information and do not share it for cross-context behavioural advertising, including that of consumers under 16. We do not use sensitive personal information in ways that give rise to a right to limit.
• You have the right to know and access, delete and correct your personal information, and not to be discriminated against for exercising your rights. You may use an authorised agent. We may verify the agent’s authority and your identity.
• If we ever begin selling or sharing, we will honour Global Privacy Control signals as opt-out requests.

We respond to verifiable requests within 45 days, extendable once by 45 days with notice.

12. How to exercise your rights

1. Email hello@sjcemysore.org with the subject “Privacy request” and say which right you want to exercise.
2. Tell us the email address you used with us and, for order-related requests, your order number.
3. We may ask for a little more information to verify your identity. This stops someone else from obtaining your data. We will not ask for more than we need.
4. We will acknowledge your request promptly and reply within the time the applicable law allows.

Exercising your rights is free. We may refuse or charge a reasonable fee only where the law allows, for example for manifestly unfounded or repeated requests, and we will explain why. If you have an account, you can view and edit most of your details yourself under My Account. You can change cookie choices at any time through the “Cookie settings” link in the footer, clear dark-mode, text-size and reading-list data by clearing site data in your browser, and unsubscribe from any marketing email using its link.

13. Children and young users

Many engineering aspirants are under 18, and the DPDP Act requires verifiable consent from a parent or lawful guardian before a child’s personal data is processed. Anyone may read the site, but users under 18 should not create an account, place an order or submit the contact form without a parent or guardian. Orders for services used by a minor, such as a counselling session for a Class 12 student, must be placed by the parent or guardian, who consents to the processing of the child’s data, and we may ask them to confirm this. We do not track children, monitor their behaviour or show them targeted advertising. If we learn that we hold a child’s data without the required consent, we will delete it.

14. Grievance Officer

As required by the Information Technology Act, 2000 and the rules made under it, and by the Consumer Protection (E-Commerce) Rules, 2020, and consistent with the DPDP Act, 2023, we have designated a Grievance Officer. Their contact details are:

We will acknowledge your grievance within 48 hours and aim to resolve it within one month of receiving it, in line with the IT Rules 2011 and the E-Commerce Rules. Where the DPDP Rules set a different period, we meet the stricter one. If you are not satisfied, you can escalate a personal-data complaint to the Data Protection Board of India after using our grievance process. Consumer complaints may also be raised through the National Consumer Helpline.

15. How we protect your data

We use HTTPS across the whole site, the Wordfence firewall, malware scanning and login security (including two-factor authentication options for administrators), WP Hide & Security Enhancer hardening, salted password hashes, least-privilege administrator access, regular updates and backups, and self-hosted assets with no third-party trackers.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and the affected Data Principals as the DPDP Rules require (including a detailed report to the Board within 72 hours of becoming aware of it, unless the Board allows longer). Where the GDPR applies, we notify the supervisory authority within 72 hours where required, and affected individuals when the risk to them is high.

16. Changes to this policy

We will update this policy when our practices or the law change, including as the remaining DPDP provisions come into force by May 2027. The “last updated” date shows the current version. We will notify you of significant changes and ask for fresh consent where the law requires it.

17. Related policies

Read this policy together with our Cookie Policy, Terms and Conditions, Refund Policy and Disclaimer. For any question, contact us or email hello@sjcemysore.org.