Privacy Policy

For the purposes of the DPDP Act, Career Sutras acts as the Data Fiduciary that determines the purpose and means of processing your personal data. Our contact and grievance details are set out in Section 13.

When you engage our services, you are the Data Principal (under the DPDP Act) and, where applicable, the Data Subject (under the GDPR).

We practise data minimisation: we collect only what is necessary to deliver a precise, bespoke admissions advisory. Depending on your engagement, this may include:

• ◆Identity and contact data: name, email address, telephone/WhatsApp number, city and country of residence.
• ◆Academic and candidacy data: examination ranks and scores, category and quota eligibility, board affiliations, target institutions, and academic history provided by you.
• ◆Engagement data: tier selected, session schedules, communications, and the strategic materials we prepare for you.
• ◆Transaction data: records of payments made through our third-party payment gateways. We do NOT collect or store your full card numbers, CVV, UPI PIN, or bank credentials — these are handled directly by PCI-DSS compliant gateways.
• ◆Technical data: IP address, browser type, device information, and analytics data collected via cookies and similar technologies (see Section 9).

We do not knowingly collect special-category or sensitive data beyond what you voluntarily provide for the purpose of your advisory.

Some applicants we advise are below the age of 18. In compliance with the DPDP Act, where the Data Principal is a child, we process personal data only with the verifiable consent of a parent or lawful guardian. We do not undertake any processing likely to cause detrimental effect to a child, nor do we conduct behavioural tracking or targeted advertising directed at children. If you are under 18, you must engage our services through a parent or guardian.

We process your data only for specified, lawful purposes, on the basis of your consent and, where applicable, for the performance of our contract with you and to meet legal obligations. Our purposes are:

• ◆To deliver personalised admissions intelligence, diagnostics, roadmaps, and advisory services.
• ◆To process payments and maintain transaction records.
• ◆To communicate with you regarding your engagement, scheduling, and deliverables.
• ◆To comply with legal, regulatory, accounting, and tax obligations under Indian law.
• ◆To protect our legal rights, prevent fraud, and ensure the security of our Platform.

We will not use your data for any new purpose without first notifying you and, where required, obtaining fresh consent.

Where processing relies on your consent, that consent is free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action. You may withdraw your consent at any time by contacting our Grievance Officer. The withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. Where you withdraw consent necessary to deliver a service, we may be unable to continue providing that service.

Career Sutras does not sell, rent, or trade your personal data. We share data only with the following categories of recipients, and only to the extent necessary:

• ◆Payment processors (such as Cashfree and Razorpay) to process your transactions securely.
• ◆Infrastructure and analytics providers (such as our hosting and website-analytics vendors) acting as Data Processors under binding contractual obligations.
• ◆Professional advisors (legal, accounting) where required.
• ◆Law enforcement, regulators, or courts where disclosure is required by applicable law or to protect our legal rights.

Every processor we engage is bound by contract to apply appropriate security safeguards and to process your data only on our documented instructions.

We are based in India and primarily process data within India. Where you are an international, NRI, or OCI client, or where our service providers process data outside India, such transfers are carried out in accordance with the DPDP Act and applicable cross-border transfer rules, and — for data subject to the GDPR — under recognised safeguards such as adequacy decisions or Standard Contractual Clauses.

We retain your personal data only for as long as necessary to fulfil the purposes set out in this Policy, including any legal, accounting, or reporting requirements. As a general rule:

• ◆Active engagement data is retained for the duration of your advisory and for the admission cycle to which it relates.
• ◆Transaction and tax records are retained for the period mandated by Indian financial and tax law.
• ◆Once retention is no longer necessary, your personal data is securely erased or irreversibly anonymised.

Our Platform uses essential cookies for functionality and limited analytics cookies to understand site usage and improve our service. You can control or disable non-essential cookies through your browser settings. Where required by law, we will request your consent before placing non-essential cookies.

We implement reasonable security safeguards appropriate to the sensitivity of the data, including encryption in transit, access controls, and confidentiality obligations on all personnel. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines required by the DPDP Rules, 2025.

Subject to applicable law, you hold the following rights over your personal data:

• ◆Right to access — to obtain a summary of the personal data we process and the processing activities undertaken.
• ◆Right to correction and updating — to have inaccurate or incomplete data corrected or completed.
• ◆Right to erasure — to request deletion of data no longer necessary for the purpose for which it was collected.
• ◆Right to withdraw consent — as described in Section 5.
• ◆Right to grievance redressal — to a readily available means of raising concerns (see Section 13).
• ◆Right to nominate — to nominate another individual to exercise your rights in the event of death or incapacity.

International clients may, depending on jurisdiction, hold additional GDPR rights including data portability and the right to object to or restrict processing. To exercise any right, contact our Grievance Officer; we will respond within the timelines prescribed by applicable law.

We may update this Policy from time to time to reflect changes in law, regulation, or our practices. The “Last Updated” date above indicates when this Policy was last revised. Material changes will be notified through our Platform or by direct communication where appropriate.

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000, you may contact our Grievance Officer for any question, request, or complaint regarding your personal data:

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India or, for GDPR-covered individuals, your local supervisory authority.