1. Introduction & Scope
CrestSow Private Limited ("CrestSow", "we", "us", or "our") is committed to protecting your privacy and ensuring transparency in all personal data processing activities. This Privacy Policy applies to all users of our central website, Learning Management System (LMS), digital certification portals, internship verification registries, and associated public services available at crestsow.com.
This policy is formulated in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable electronic communication laws of the Republic of India.
2. Information We Collect
In strict accordance with the principle of data minimization, we only collect personal information that is strictly necessary to deliver, authenticate, issue, and verify academic certifications and educational services. The categories of information collected include:
A. Student, Intern & Participant Identifiers
When applying for verified internship certificates, attending webinars, or creating an LMS account:
- Full legal name (rendered verbatim on official tamper-proof certificates).
- Official email address (used for credential dispatch, verification links, and account recovery).
- Contact telephone number (used for verification communications and urgent support).
- Academic institution, college or university name, department, roll number / USN, and program duration.
B. Digital Certification & Credential Verification Data
Upon issuance of a digital credential, we record:
- Unique cryptographically assigned Certificate Code and Verification Token (e.g.
CS-INT-2026-XXXX). - Issue date, expiration date (where applicable), and program performance track.
- Public QR verification payload linked directly to crestsow.com/verify.
C. Payment & Transaction Metadata (Processed via Razorpay)
For fee-based certifications or course enrollments:
- Razorpay Order ID, Payment ID, transaction currency, amount paid in INR (₹), and timestamp.
- Card & Banking Secrets: CrestSow NEVER collects, stores, or handles raw credit/debit card numbers, CVVs, expiry dates, UPI PINs, or net banking passwords. All financial transactions are securely tokenized and handled directly by Razorpay Software Private Limited in compliance with Reserve Bank of India (RBI) and PCI-DSS Level 1 standards.
D. Technical, Session & Security Telemetry
To safeguard our portals from credential stuffing, unauthorized scraping, and examination malpractice:
- Browser type, operating system version, and IP address.
- Cryptographic device identifier (
crestsow_device_id) stored locally to prevent session hijacking and multiple simultaneous exam logins. - Interface theme preferences (
holotrack_theme) and UI state parameters.
3. Legal Grounds & Purposes of Processing
We process personal data under Section 4 and Section 6 of the DPDP Act 2023 on the grounds of:
- Affirmative Consent: Freely given, specific, informed, and unambiguous consent provided when submitting application forms, contact inquiries, or enrollment requests.
- Contractual & Service Fulfillment: Generating, digitally signing, dispatching, and hosting authentic academic credentials, certificates of completion, and webinar participation verifications.
- Legal Obligations & Fraud Prevention: Retaining financial transaction records for statutory accounting periods and safeguarding against educational credential forgery.
4. Third-Party Data Sharing & Sub-Processors
CrestSow does not sell, rent, monetize, or trade your personal information to third-party advertisers, marketing agencies, or data brokers. Personal data is shared strictly with the following technical sub-processors solely for operational fulfillment:
| Processor | Purpose | Location & Compliance |
|---|---|---|
| Razorpay Software Pvt Ltd | Payment checkout processing & HMAC signature verification | India • PCI-DSS Level 1 & RBI compliant |
| MongoDB Atlas (AWS / GCP) | Encrypted database storage for user records and certificate index | Encrypted at rest (AES-256) & in transit (TLS 1.3) |
| Cloudinary Inc. | Secure cloud storage for generated certificate templates & assets | SOC 2 Type II certified cloud infrastructure |
| Standard SMTP & Email Gateways | Automated delivery of PDF certificates and verification receipts | Encrypted TLS mail delivery |
5. Data Retention & Deletion Practices
We retain personal data strictly for periods justified by the nature of educational credentials and statutory requirements:
- Official Certificate & Verification Registry: Retained permanently. Because employers, academic registrars, and government institutions verify certificate authenticity months or years after course completion, deleting a valid certificate record would render the student's credential unverifiable.
- LMS Accounts & Inactive Logs: Retained during the active enrollment period and archived or anonymized after two (2) years of prolonged inactivity unless retention is requested by the partner institution.
- Financial & Invoicing Records: Retained for minimum seven (7) years as mandated under Indian tax, corporate, and audit regulations.
To request deletion of eligible non-mandatory personal data, please visit our Data Deletion Request Page.
6. Your Rights under the DPDP Act 2023
As a Data Principal under Indian law, you are entitled to the following rights:
7. Children's Data Policy (Section 9 DPDP Act)
CrestSow educational programs and technical certification workflows are designed for college students, university graduates, and adult software engineering candidates (individuals aged 18 and older). We do not knowingly collect personal data from individuals under 18 without verifiable parental/guardian consent, nor do we perform behavioral tracking or targeted advertising directed at minors.
8. Grievance Officer & Contact Information
In compliance with the DPDP Act 2023 and the Information Technology Act, 2000, CrestSow has appointed a designated Grievance Officer to address data privacy inquiries, corrections, and complaints:
Entity: CrestSow Private Limited
Designation: Data Protection & Grievance Redressal Desk
Email: founder@crestsow.com
Telephone: +91 8143024204
Acknowledgement: Within 48 hours • Resolution within thirty (30) calendar days