1. Introduction, scope and contact
This Privacy Policy explains how ChitraYantra Technologies Private Limited ("ChitraYantra", "we", "us" or "our") handles personal data through this website and while providing Ed-Tech and SportTech software, reporting and support services. It applies to visitors, enquiry contacts, Institute representatives and data processed for an Institute engagement. It does not replace a signed MOU, Work Order or data-processing schedule; where one applies, that document governs the particular engagement.
Our registered office is Basunagar, Madhyamgram, Kolkata - 700129, West Bengal, India. Our Privacy Contact and Grievance Officer may be contacted at info@chitrayantra.com.
2. Applicable framework
We seek to handle personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and rules made under it, and the Digital Personal Data Protection Act, 2023 and rules made under it, as and when applicable. This Policy is not a waiver of any right or obligation under applicable law.
3. Institute data and our role
For Institute services, the Institute determines the purpose and lawful basis for its student, participant, faculty, staff or other institutional data. ChitraYantra does not independently collect, own, sell or use that data. We may access or process it only as necessary to perform a signed MOU, Work Order, purchase order or other written Institute engagement and documented instructions from an authorised Institute representative.
The Institute is responsible for having the necessary authority, notices and, where applicable, valid consent or other legal basis to provide the data to us. ChitraYantra remains responsible for its own legal and contractual obligations for data in its possession or control. Any data-processing schedule in the MOU or Work Order should identify the permitted purpose, data categories, security arrangements, authorised access, deletion or return, incident cooperation and any approved subcontractor.
4. Categories, purposes and limits of Institute processing
Depending on the engagement, Institute data may include identifiers, academic or participation records, submitted responses, performance inputs and data needed to produce the agreed output. We process only the minimum data needed to deploy or support the software, produce the agreed report, respond to Institute requests, maintain security, or comply with law.
We do not use student or participant data for advertising, independent profiling, sale, rental, training unrelated products or any separate commercial purpose. We do not make final academic, sporting, administrative, disciplinary or other decisions about an individual.
5. Deployment, access and retention
Our software is ordinarily deployed on the Institute's server or premises, where the Institute controls its environment and source data. If temporary access, transfer or support processing is needed, it is limited to the agreed scope. After report delivery or hand-over, we delete or return temporary copies and credentials under our control unless the MOU, Work Order, other written engagement or law requires otherwise.
Deletion does not require removal from backups before their ordinary rotation. We may retain the minimum business, security, audit, financial or legal records needed for the stated purpose, legal compliance or dispute resolution. Data remaining solely on Institute-controlled systems remains under the Institute's control.
6. Website enquiries, analytics and security
When you contact us or request a demo, we process the information you submit, such as name, work email, message and preferred demo time. We use it to respond, arrange a demonstration, maintain an enquiry record and protect our services. Enquiry messages are delivered through Resend. We process IP address and technical request information briefly to rate-limit and prevent abuse of forms.
We use optional analytics only after you accept through our website notice. These may include Google Analytics and Cloudflare Analytics. You may reject analytics without losing access to the public website. We may use Google reCAPTCHA or Cloudflare Turnstile to protect a form from spam and abuse; where used, its purpose is disclosed before submission. These providers may process cookies, online identifiers, IP address, device/browser, referrer, page and event information under their own policies. Do not submit student, participant, health, biometric, examination or other sensitive personal data through public website forms.
7. Sharing, transfers and disclosures
We do not sell or rent Institute data. We disclose it only to authorised personnel or service providers strictly necessary to perform the written engagement, on the Institute's written instruction, or where required by applicable law or a lawful request of a competent authority. Website enquiry data is disclosed to Resend for email delivery and to Google or Cloudflare when their analytics or form-security services are used.
Google, Cloudflare and Resend may process limited website information outside India. We use them subject to applicable law and appropriate contractual or technical safeguards. We do not disclose data merely on an informal request; we evaluate requests and disclose only where legally required or authorised.
8. Payments
Where an approved gateway is used, Razorpay, PayU or PayPal processes payment information under its own privacy policy and terms. We do not store full card or gateway payment credentials. For bank transfers and cheques, we process the limited payer and transaction information needed to reconcile payment, maintain financial records and meet legal obligations. We do not accept cash payments.
9. External links
Our website may link to third-party websites or services, including social networks and payment providers. Their privacy practices, content and security are governed by their own policies. We are not responsible for those third-party practices, and you should review their policies before providing information to them.
10. Security and incident handling
We use reasonable technical, organisational and access-control measures designed to protect information under our control. Measures are selected according to the engagement, deployment and risk. No transmission, system or storage environment can be guaranteed completely secure. We will investigate suspected incidents affecting data under our control and cooperate with the Institute as required by the applicable written engagement and law.
11. Your rights, choices and grievances
For website information, you may contact us to request access, correction, deletion, withdrawal of consent for optional analytics, or to raise a grievance, subject to applicable law. You can reject optional analytics in the website notice; this does not affect necessary security or service operations. For student or participant data held by an Institute, contact the Institute first because it controls the data and deployment. We will assist the Institute where required by the MOU, Work Order or applicable law.
Write to our Privacy Contact and Grievance Officer at info@chitrayantra.com, including enough information to identify the request. We may need to verify identity and authority before acting.
12. Children's data and safety
We do not seek to collect children's personal data directly through this website and do not ask children to submit personal data through public forms. If an Institute provides data relating to a child as part of an authorised engagement, the Institute is responsible for the permissions, notices and supervision required by applicable law and the written engagement.
We do not use children's Institute data for advertising, behavioural marketing or unrelated profiling. A child, parent, guardian, teacher or Institute representative who believes data has been submitted to us through the public website in error may contact our Grievance Officer so that we can review and take appropriate action.
13. Updates to this Policy
We may update this Policy when our services, technology or legal obligations change. The current version and its last-updated date will be published on this page. Material changes to an active Institute engagement will be addressed through the applicable MOU or Work Order where required.