Data Security

Introduction

Mascot Techcrib Private Limited ("EduCrib," "we," "us," or "our") operates the online education discovery platform at www.educrib.com. We connect students, parents, institutions, tutors, consultants, and job seekers across India.

This Data Privacy & Security Policy ('Policy') explains how we collect, use, store, share, and protect your personal data. It is drafted in accordance with India's Digital Personal Data Protection Act, 2023 ('DPDP Act'), the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

By accessing or using EduCrib, you consent to the practices described in this Policy. If you do not agree, please discontinue use of the platform.

1. Who This Policy Applies To

All data in transit between your device and EduCrib is encrypted using TLS 1.2 or higher. Data at rest is encrypted using industry-standard AES-256 on our managed cloud storage.

2. What Personal Data We Collect

2.1 Data You Provide Directly

• Account Registration: Full name, email address, phone number, password, and profile photo
• Institutional Profiles: Organisation name, address, contact person details, registration/accreditation numbers
• Tutor/Consultant Profiles: Qualifications, experience, subject expertise, fee structures, identity documents for verification
• Enquiry Forms: Contact details and messages submitted to institutions or tutors via EduCrib
• Job/Internship Applications: Resume, cover letter, educational history, references
• Payments: Billing name and address; card/UPI details are processed by PCI-DSS- compliant third-party gateways — EduCrib does not store payment card data
• User-Generated Content: Reviews, ratings, article comments, and forum posts

2.2 Data Collected Automatically

When you use EduCrib, we automatically collect technical and behavioural data including:

• IP address, browser type, operating system, and device identifiers
• Pages visited, time spent, links clicked, and search queries entered
• Referring URLs and exit pages
• Geographic location (city/state level, derived from IP)
• Session duration and frequency of visits
• Crash reports and platform performance logs

2.3 Data from Third Parties

We may receive data about you from:

• Social Login (Google, Facebook): Name, email, and profile photo when you use OAuth sign-in
• Analytics Providers: Aggregated behavioural data from Google Analytics and Meta Pixel (see Section 6)
• Verification Partners: Confirmation of institutional accreditation or tutor credentials

2.4 Sensitive Personal Data

Under India's SPDI Rules, 2011, certain categories of data are classified as 'Sensitive Personal Data or Information' (SPDI). EduCrib may collect the following SPDI only where necessary:

• Financial information (for payment processing — handled by third-party gateways only)
• Identity documents (for tutor/consultant verification)

3. Why We Collect Your Data — Purpose & Legal Basis

EduCrib processes personal data only for lawful purposes recognised under applicable Indian law, including consent, voluntary provision for a specific service requested by the user, compliance with legal obligations, and uses reasonably necessary for platform security, fraud prevention, and service operation, subject to the Digital Personal Data Protection Act, 2023and the Rules:

4. How We Share Your Data

EduCrib does not sell your personal data. We share data only in the following circumstances:

4.1 With Institutions, Tutors & Consultants

When you submit an enquiry, your name, contact details, and message are shared with the relevant listing partner to enable them to respond to you. By submitting an enquiry, you consent to this sharing. Partners are contractually bound not to use your data for any purpose other than responding to your enquiry.

4.2 With Technology & Service Providers

We engage trusted third-party vendors who help us operate the platform. These include:

• Cloud Hosting: Server infrastructure providers (e.g., AWS, Google Cloud)
• Payment Gateways: Razorpay, PayU, or equivalent — PCI-DSS compliant
• Email & SMS Delivery: Transactional communication services
• Customer Support: Help desk and ticketing platforms

All service providers are bound by Data Processing Agreements (DPAs) and may only process your data on EduCrib's documented instructions.

4.3With Analytics & Advertising Partners

EduCrib uses third-party analytics and advertising tools. These tools may collect data about your behaviour on our platform through cookies and tracking pixels:

4.4 For Legal & Regulatory Requirements

We may disclose personal data to law enforcement, regulatory bodies, or courts when required by law, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of EduCrib, our users, or the public.

4.5 During Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, user data may be transferred to the acquiring entity. We will notify affected users before any such transfer and ensure the acquirer is bound by equivalent privacy protections.

5. Cookies & Tracking Technologies

5.1 Types of Cookies We Use

5.2 Managing Cookies

On your first visit, EduCrib will display a cookie consent banner. You may accept all, reject non- essential, or customise your preferences. You can change your preferences at any time via the Cookie Preference Centre in the website footer. Please note: disabling certain cookies may impact platform functionality, such as personalised recommendations or saved searches.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required by law.

7. Your Rights Under the DPDP Act, 2023

Under India's Digital Personal Data Protection Act, 2023, you have the following rights as a 'Data Principal':

To exercise any of these rights, email us at [email protected]with the subject line "Data Rights Request." We will acknowledge your request within 72 hours and respond fully within 30 days.

8. Children's Data & Minor Users

8.1 Current Position

EduCrib does not knowingly collect personal data from children under the age of 13. For users aged 13 to 17, EduCrib recommends that a parent or guardian supervise use of the platform and, where registration is completed by a minor, a parent or guardian must provide verifiable consent.

8.2 DPDP Act Requirements for Children

Under India's DPDP Act, 2023, a 'child' is defined as a person under 18 years of age. The Act imposes strict obligations on Data Fiduciaries when processing children's data:

• Verifiable parental or guardian consent must be obtained before collecting any personal data from a child
• Processing must not cause detrimental effects on the child's well-being
• Behavioural monitoring, targeted advertising, and tracking of children is prohibited
• Children's data must be processed with heightened security measures

8.3 EduCrib's Commitments

Regardless of the final policy decision on minor registrations, EduCrib commits that:

• No targeted advertising or personalised ad tracking will ever be applied to users identified as minors
• Meta Pixel and Google Ads conversion tracking will be configured to exclude minors
• If a child's data is collected without proper consent, it will be deleted immediately upon discovery
• A parent or guardian may contact us at [email protected] to request deletion of their child's data at any time

9. Data Security Measures

EduCrib implements administrative, technical, and physical safeguards to protect your personal data from unauthorised access, disclosure, alteration, or destruction, as required under the IT (SPDI) Rules, 2011 and the DPDP Act, 2023.

9.1 Technical Safeguards

• Encryption in Transit: All data transmitted between your browser and EduCrib servers is encrypted using TLS 1.2 or higher (HTTPS)
• Encryption at Rest: Sensitive data stored on EduCrib servers is encrypted using AES- 256
• Access Controls: Role-based access controls (RBAC) ensure staff can only access data necessary for their function
• Authentication: Passwords are hashed using bcrypt. Two-factor authentication (2FA) is available for partner accounts
• Vulnerability Management: Regular security audits, penetration testing, and patch management cycles
• Firewall & DDoS Protection: Web application firewalls (WAF) and DDoS mitigation are deployed on all production infrastructure

9.2 Organisational Safeguards

• All EduCrib employees with data access receive mandatory data privacy training
• Data access is granted on a need-to-know basis and reviewed quarterly
• Third-party vendors are assessed for security compliance before onboarding
• A Data Protection Officer (DPO) / Grievance Officer is appointed as required under the DPDP Act

9.3 Incident Response

In the event of a personal data breach, EduCrib will:

• Contain and assess the breach within 24 hours of detection
• Notify the Data Protection Board of India within 72 hours where required by law
• Notify affected users without undue delay, with details of the data involved and steps taken
• Conduct a post-incident review and implement corrective measures

10. Data Localisation & Cross-Border Transfers

EduCrib stores and processes all user data primarily on servers located within India, in accordance with applicable data localisation requirements.

Where we engage international third-party service providers (such as cloud platforms), data transfers are governed by appropriate contractual safeguards including Standard Contractual Clauses (SCCs) or equivalent mechanisms, and are only made to countries notified by the Government of India as providing adequate data protection.

11. Grievance Officer & Data Protection Contact

In compliance with the DPDP Act, 2023 and IT Act, 2000, EduCrib has appointed a Grievance Officer to address data privacy concerns:

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India, once established under the DPDP Act, 2023.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in law, technology, or our services. When material changes are made:

• Registered users will be notified via email at least 14 days before the change takes effect
• A notice will be posted prominently on the EduCrib website
• The "Effective Date" at the top of this document will be updated

Continued use of EduCrib after the effective date of any change constitutes your acceptance of the revised Policy. We recommend reviewing this Policy periodically.