Privacy Policy

International Educational Gateway Private Limited (“Univariety”) · Version 3.0 · Effective [8 Oct 2026] · Replaces the policy dated 5 December 2024

This policy explains what personal data we process, why, on what basis, who we share it with, how long we keep it, and the rights you have under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025. It applies to univariety.com, the Univariety alumni and student engagement platform, its subdomains and mobile applications (together, the “Platform”).

1. Who we are and who is responsible for your data
2. Who this policy covers
3. Personal data we process
4. Where your data comes from
5. Purposes and legal basis
6. How consent works on the Platform
7. Children and parents
8. Who we share data with
9. Where your data is stored
10. How long we keep it
11. How we protect it
12. Your rights and how to use them
13. Your duties as a Data Principal
14. Cookies and similar tools
15. Users outside India
16. Changes to this policy
17. Grievance Officer and the Data Protection Board
18. Governing law and contact

1. Who we are and who is responsible for your data

The Platform is owned and operated by International Educational Gateway Private Limited, a company incorporated under the Companies Act, 2013, with its registered office at H. No. 8-2-624, Suite 301, Sri Durga Towers, Road No. 10, Banjara Hills, Hyderabad, Telangana 500034, India (“Univariety”, “we”, “us”).

Univariety licenses the Platform to schools, colleges and universities (each an “Institute”) so that they can stay connected with their students and alumni. The DPDP Act distinguishes between a Data Fiduciary, who decides why and how personal data is processed, and a Data Processor, who processes it on the Fiduciary’s behalf.

• Your Institute is the Data Fiduciary for your alumni, student or parent record: it decides the purposes (alumni engagement, student guidance, institutional reporting) and authorises Univariety in writing.
• Univariety is the Data Processor for that record: we host, clean, update and operate it on the Institute’s instructions under a written contract, as section 8(2) of the DPDP Act requires.
• Univariety is a Data Fiduciary in its own right only for two activities we design and run ourselves: refreshing alumni profiles from public and licensed sources, and calculating the engagement indicators described in section 4. For those, the obligations in this policy fall on Univariety directly.
• For visitors to univariety.com and for Institute representatives who enquire about or buy our services, Univariety is the Data Fiduciary.

2. Who this policy covers

3. Personal data we process

3.1 Alumni and students on the Platform

Not every item applies to every person. Your own profile shows exactly what is held about you and where each item came from.

• Identity and contact: name, gender, date of birth, email addresses, mobile number, country and city, photograph, and social-profile links you have shared.
• Education history: your programme and years at the Institute; school, undergraduate, postgraduate and doctoral institutions, departments and years; scholarships received; entrance examinations and ranks; other institutions applied to; current study status and highest qualification.
• Career history: current and up to three previous employers with designation, years, industry, functional area, seniority and employment type; working status; descriptive attributes of those employers.
• Achievements, skills and interests: achievements you record, skills and proficiency, interest in upskilling, higher studies, jobs or internships and the preferences you enter.
• Giving back and networking preferences: what you have offered to students or the Institute, benefits you are interested in, networking preferences.
• Your relationship with the Institute: event and session participation, recognition, positions held, scholarships or benefits received, donations, pledges, recruitment and admission referrals, interactions with Institute staff, feedback and reviews you have given, and family members who also attended.
• Communication and Platform activity: responses to campaigns, calls, surveys and messages; activity in Institute groups; logins, profile updates, messages, profile views, job posts and albums; topics you engage with.
• Standing and public profile: indicators drawn from your career record and public sources such as leadership or board roles, founder status, years of experience, time abroad, media mentions, public listings and public roles.
• Engagement indicators calculated by Univariety: scores summarising how connected, recognised and engaged you are with the Institute and your likely interest in mentoring, recruiting and giving; a communication profile used to decide how and when the Institute reaches you; career track and age bracket. Each indicator is explained on the Platform and can be reviewed and corrected on request.
• Account records: profile status and completion, dates created and updated, any grievance raised, and a marker used to stop all communication when the Institute informs us that a person has passed away.
• Session recordings where a mentorship, guidance or counselling call is recorded, which we tell you before the call starts.

3.2 Visitors and Institute representatives

• Enquiry form details: name, email, phone, designation, institution and city.
• Technical and usage data: IP address, approximate location, device and browser details, pages visited and time spent, collected through cookies and similar tools in line with your cookie choices (section 14).
• For Institutes buying our services: the representative’s name, role and contact details, and invoicing details. Payment processing is handled by the Institute’s or our payment provider; we do not store card or bank account numbers.

3.3 Data we do not process

We do not process biometric data, government identity numbers, or financial account numbers of alumni, students or parents. Payment status for Institute-charged fees reaches us only as a status flag through the Institute’s systems.

4. Where your data comes from

• From you, when you sign up, complete or update your profile, respond to the Institute, or take part in Platform activities.
• From your Institute, which provides its records of your time there and any details it already holds.
• From public sources: professional profiles you have made public yourself, company filings and other public records. Personal data that you have made publicly available yourself is outside the DPDP Act under section 3(c)(ii); we still show you its source and let you correct it.
• From licensed professional-contact databases, used to refresh contact and work details of adult alumni whose Institute has authorised outreach. Such data is treated as fully within the DPDP Act and is used only to send you the notice in section 6 and, if you consent, to keep your record current. It is never used for anyone under 18.
• From Institute staff or fellow alumni, where the Institute records an observation about a person.
• Calculated by Univariety: the engagement indicators in section 3.1, derived from the data above.

5. Purposes and legal basis

We process personal data only for the purposes below. Each purpose is shown separately on the Platform and can be switched off separately.

Univariety does not use alumni, student or parent data to market Univariety’s own or any third party’s products. Marketing of Univariety’s services is directed only at Institutes and their representatives, and only with their consent.

6. How consent works on the Platform

• Consent is given by a clear affirmative action — ticking the consent box at sign-up or selecting purposes in your privacy settings — after you have been shown a notice that itemises the data and purposes involved. Browsing or using the Platform is not consent.
• Consent is purpose-level. You can switch each purpose in section 5 on or off independently.
• Withdrawal is as easy as consent. You can withdraw any or all consent from your privacy settings or by emailing care@univariety.com. Withdrawal takes effect within [7] days and does not affect processing already carried out lawfully.
• Records created before this policy. If you consented under an earlier version of this policy, we will send you a notice under section 5(2) of the DPDP Act describing what we hold and your controls. Your earlier consent continues until you change or withdraw it.
• Records created from Institute lists or public sources. If your Institute has asked us to reconnect with you and you have not yet consented, we hold a preliminary record only to send you a notice. It is not shown to Institute staff and no outreach beyond that notice takes place until you choose. If you do not respond, the preliminary record is deleted after [180 days].
• Consent decisions are logged with the date, channel and version of the notice you saw, and the log is available to you on request.

7. Children and parents

A child under the DPDP Act is any person under 18. Where a school gives students under 18 access to the Platform:

• The school is the Data Fiduciary for the student and obtains verifiable consent from a parent or lawful guardian through its own systems before any student account is created. Univariety receives the consent status through the school’s systems and creates an account only where it is present.
• Only the consenting parent or guardian is given parent access to the Platform. Parents can exercise every right in section 12 on the child’s behalf.
• We do not carry out behavioural monitoring or tracking of children, do not show children targeted advertising, and do not calculate engagement indicators, create markers or refresh data from external sources for anyone under 18. Student records contain participation information (attended, watched, asked) only.
• Any use of a student’s or parent’s testimonial or image in school marketing requires the parent’s specific consent.
• A student’s record is deleted when they leave the school, unless they are 18 or over and choose, on their own consent, to keep it as an alumni record.

Alumni and student accounts on college and university platforms are for persons aged 18 and over. If you are under 18 and not covered by a school arrangement, please do not create an account.

8. Who we share data with

• Your Institute, which is the Data Fiduciary for your record and sees your activated profile and the indicators described in section 3.1.
• Fellow alumni and students, only to the extent you choose to make parts of your profile visible or to message others on the Platform. Students’ contact details are never shown to alumni.
• Service providers (sub-processors) that act on our written instructions under contracts that meet section 8(2) of the DPDP Act, in these categories: cloud hosting and backups; email, SMS and WhatsApp delivery; cloud telephony; video-conferencing and recording; engagement and analytics tooling; professional-contact and web-data services (adult alumni only); AI services that receive pseudonymised profiles identified only by a system reference, never by name or contact details; identity sign-in providers; and design tools used only for content you have consented to feature in. The current list is available to Institutes in their administrator portal and to any person on request to the Grievance Officer.
• Authorities, where a court, regulator or law-enforcement agency lawfully requires it.
• A successor business, if Univariety is merged, acquired or reorganised, in which case this policy continues to apply to your data and you will be notified.

We do not sell personal data, do not share one Institute’s data with another, and do not pass alumni contact details to employers or partner companies. Recruitment and donation conversations take place through the Platform or through Institute staff and Univariety’s outreach team.

9. Where your data is stored

The Platform and its databases and backups are hosted in India. Some service providers in section 8 process data outside India. The DPDP Act permits this except to countries the Central Government restricts by notification; we do not transfer personal data to any restricted country and we bind every provider by contract to the same protections that apply in India.

10. How long we keep it

Erasure means the data is removed from live systems by cryptographic erasure and can no longer be used to identify you. Aggregated statistics that no longer identify anyone may be retained.

11. How we protect it

• Univariety’s information security management system is certified to ISO/IEC 27001:2022 for its alumni management, engagement, guidance, fundraising, marketing-support and counselling activities.
• Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256); access is role-based on a need-to-know basis with multi-factor authentication for Institute administrators; access is logged; systems are penetration-tested at least annually.
• We maintain incident-response, business-continuity and data-retention policies. If a personal data breach occurs we will notify affected persons and the Data Protection Board of India in the manner and time the DPDP Rules require.
• Please keep your login credentials confidential and tell us at once at care@univariety.com if you suspect unauthorised use of your account.

12. Your rights and how to use them

Email requests go to care@univariety.com. We may ask you to verify your identity before acting. We acknowledge requests within [7 days] days and complete them within [15 days] days; the DPDP Rules set a maximum of 90 days. Where your Institute holds your data as Data Fiduciary, we act on your request in coordination with it and tell you what has been done. Requests are free of charge.

13. Your duties as a Data Principal

Section 15 of the DPDP Act asks every person to: comply with applicable law when exercising their rights; not impersonate another person; not suppress material information when providing identity or address details; not register a false or frivolous grievance with us or the Data Protection Board; and provide only verifiably authentic information when asking for correction or erasure.

14. Cookies and similar tools

univariety.com uses cookies and similar technologies in four categories. Strictly necessary cookies are always on; the other three are off until you choose to allow them in the cookie banner, and you can change your choice at any time from the “Cookie preferences” link in the footer. Your choice is stored for six months.

Marketing cookies are used only on univariety.com for audiences of Institute decision-makers. They are not used in the logged-in alumni or student Platform, and no advertising or behavioural tracking is directed at accounts belonging to persons under 18.

15. Users outside India

Because the Platform is operated and your data is processed in India, the DPDP Act applies to your data wherever you live, and every right in section 12 is available to you. If the law of your country of residence gives you additional rights, write to us and we will apply them to the extent that law reaches us.

16. Changes to this policy

We will publish any change to this policy here with a new version number and effective date. If a change adds a purpose, a category of data or a category of recipient, we will notify you on the Platform or by email before it takes effect and, where the DPDP Act requires it, ask for your consent. Continued use of the Platform is not treated as consent to a change.

17. Grievance Officer and the Data Protection Board

18. Governing law and contact

This policy is governed by the laws of India. Courts at Hyderabad, Telangana have jurisdiction, without prejudice to your right to approach the Data Protection Board of India. General questions about this policy can be sent to care@univariety.com.