01
Overview
Gradmire Education Pvt. Ltd. ("Gradmire", "we", "us") is committed to protecting your personal data. This policy explains what we collect, why, how long we keep it, and the rights you can exercise at any time.
This Privacy Policy applies to gradmire.in and all related services. By using our website or submitting a form, you acknowledge that you have read and understood this policy. This policy is issued in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000.
02
Data we collect
We collect personal data only to the extent required to provide our services. The categories are:
- Identity data — name, date of birth (when relevant for eligibility checks)
- Contact data — email address, mobile number, city/state
- Academic data — exam scores (IELTS, TOEFL, GRE, GMAT), degree level, subject of study, graduation year
- Financial data — fee budget range (no payment card data is collected by us)
- Technical data — IP address, browser type, device OS, referring URL, pages visited, session duration (collected via server logs and analytics)
- Communications data — messages sent via our enquiry form, WhatsApp, or email
- Preferences data — destination countries and course types of interest
- Google Sign-In data (if you choose it) — your Google account's unique subject identifier, verified email address, and the name Google shares with us
When you use Google Sign-In, Google sends us a signed identity token containing these basic profile details. We verify the token and use the details to sign you in, create your Gradmire account when you request one, or link your verified Google identity to an existing account. We do not receive your Google password, and we do not store the identity token after sign-in.
We do not collect sensitive personal data (as defined under DPDP Act 2023 Schedule I), except where you voluntarily provide disability or medical information solely for the purpose of disability-related scholarships, with your explicit
consent.
03
Purpose of processing
We process your personal data only for clearly defined purposes. We do not sell your data to third parties under any circumstances.
- Service delivery — preparing university shortlists, application guidance, visa documentation support
- Account access — verifying your identity and creating, accessing, or linking your account when you choose Google Sign-In
- Communication — responding to your enquiries, scheduling consultations, sending application reminders
- Platform improvement — understanding how our tools (ROI Calculator, Deadline Tracker) are used so we can improve them
- Legal compliance — maintaining records required under Indian company law and the DPDP Act 2023
- Marketing (with consent only) — newsletters, scholarship alerts, and webinar invitations — only if you have opted in
We rely on the following lawful bases: (a) your consent for marketing communications; (b) contractual necessity for service delivery; (c) legitimate interest for platform analytics; and
(d) legal obligation for compliance records.
04
Sharing & disclosure
We share your data only in these circumstances:
- Partner universities and institutions — with your explicit consent before any application is submitted on your behalf
- Service providers — cloud hosting (data stored in India or EEA-compliant jurisdictions), CRM, email delivery, and analytics. These providers are bound by data processing agreements and may not use your data for their
own purposes
- Legal authorities — where required by a court order or Government directive under applicable Indian law
We never sell, rent, or exchange personal data with advertising platforms, data brokers, or any third party for commercial gain.
Google Sign-In is provided by Google. Your use of Google's sign-in service is also subject to Google's Privacy Policy. We use Google Sign-In data only to authenticate you and operate your Gradmire account; we do not use it for advertising or sell it. We do not request access to your Google Drive, contacts, or other Google services.
05
Retention
We retain personal data only as long as necessary for the stated purpose or as required by law:
- Active users — for the duration of your engagement with Gradmire and 3 years thereafter
- Google Sign-In data — the linked Google identifier and basic profile details are retained with your account until you request account deletion, subject to legal retention requirements
- Marketing data — until you withdraw consent or request deletion
- Legal/tax records — 7 years as required by the Companies Act, 2013
- Technical logs — 90 days, then automatically purged
After the retention period expires, data is securely deleted or anonymised so that it can no longer be linked to you.
06
Your rights (Data Principals)
Under the DPDP Act 2023, you have the following rights as a Data Principal:
- Right to access — obtain a summary of the personal data we hold about you and our processing activities
- Right to correction — request that inaccurate or incomplete data be corrected or completed
- Right to erasure — request deletion of your personal data, subject to legitimate retention requirements
- Right to grievance redressal — raise a complaint with our Grievance Officer (see contact below) and, if unresolved, to the Data Protection Board of India
- Right to nominate — nominate another individual to exercise rights on your behalf in the event of your incapacity or death
- Right to withdraw consent — withdraw consent for marketing or any consent-based processing at any time without affecting prior processing
To exercise any right, use our data request form or email privacy@gradmire.in. We will respond within 30 days. Where verification is needed, we may ask you to confirm your identity.
07
Children & minors
Our services are primarily aimed at students aged 18 and above. However, we recognise that some students who are minors (below 18 years) may seek study-abroad guidance.
In compliance with Section 9 of the DPDP Act 2023:
- We do not knowingly collect personal data from individuals below 18 without verifiable parental or guardian consent
- Where we have reason to believe that a user is a minor, we will pause processing and request parental consent before proceeding
- Parents or guardians may contact privacy@gradmire.in to review, correct, or request deletion of a minor's data
- We do not process minor data for behavioural tracking, targeted advertising, or profiling
08
Cookies & tracking
Most pages do not require cookies. When you sign in, we set a strictly necessary, HttpOnly session cookie to keep your account session secure; it is cleared when you sign out or expires. We also use a small amount of browser storage:
- Essential: remembering your privacy choices, and data for tools you choose to use (such as your Deadline Tracker list)
- Preferences (opt-in): night mode and dismissed pop-ups
- Analytics (opt-in): none run today; any future analytics tool will load only with your consent
We do not use advertising or cross-site tracking. Full details and your choices are in our Cookie Policy.
09
Security
We implement appropriate technical and organisational safeguards to protect your data against unauthorised access, loss, or destruction. Measures include:
- HTTPS (TLS 1.2+) encryption in transit
- Access controls limiting who within Gradmire can view personal data
- Regular security reviews of third-party processors
In the event of a personal data breach that is likely to result in risk to your rights, we will notify the Data Protection Board of India and affected individuals within 72 hours of becoming aware of the breach.
10
Policy changes
We may update this policy from time to time to reflect changes in law or our practices. When we make material changes, we will:
- Update the effective date at the top of this page
- Display a notice on our homepage for 30 days
- Email registered users if the changes affect their rights
Continued use of our services after the effective date constitutes acceptance of the revised policy.