How Asset Chain Techlligence Private Limited, trading as TruScholar, collects, uses, discloses, retains and protects personal data.
1.1 This Privacy Policy (“Policy”) explains how Asset Chain Techlligence Private Limited, trading as TruScholar (“TruScholar”, “we”, “us”, “our”), collects, uses, discloses, retains and protects Personal Data.
1.2 This Policy applies to:
1.2.1 the website at truscholar.io and any subdomain thereof;
1.2.2 the TruScholar platform and administrative console;
1.2.3 the TruScholar mobile applications;
1.2.4 the TruScholar application programming interfaces; and
1.2.5 any related service, together the “Services”.
1.3 This Policy should be read together with the Terms of Use and, where applicable, the Data Processing Agreement. Our use of cookies and similar technologies is described in section 14.
1.4 Summary of key positions. This summary does not replace the detailed provisions below:
1.4.1 where an institution issues Credentials through the Services, that institution determines the purposes and means of Processing and we act on its instructions;
1.4.2 we do not sell Personal Data;
1.4.3 only a cryptographic hash is written to a distributed ledger, and no Personal Data is written on-chain; and
1.4.4 rights of access, correction and erasure remain fully exercisable.
2.1 Legal entity: Asset Chain Techlligence Private Limited, incorporated under the Companies Act, 2013.
2.2 Registered office: 3rd Floor, Nanda Motors, Nawathe Square, Amravati 444606, Maharashtra, India.
2.3 Corporate Identity Number: U93090MH2019PTC334696.
2.4 Contact for privacy matters: info@truscholar.io, or by post to the registered office address.
3.1 Processor role. Where an institution, employer or other organisation (“Customer”) issues Credentials through the Services:
3.1.1 the Customer is the Controller, and the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023;
3.1.2 the Customer determines what Credentials are issued, to whom, and what data those Credentials contain;
3.1.3 TruScholar acts as Processor and Processes such Personal Data only on the Customer’s documented instructions, pursuant to the Data Processing Agreement; and
3.1.4 a Data Subject wishing to exercise rights in respect of Credential data should address their request to the issuing Customer in the first instance. Requests received by TruScholar will be forwarded to the Customer without undue delay.
3.2 Controller role. TruScholar acts as Controller in respect of:
3.2.1 website visitors and marketing contacts;
3.2.2 account administration, billing and contract management for Customers;
3.2.3 learner accounts created directly with TruScholar independently of any Customer;
3.2.4 security, fraud prevention and service integrity; and
3.2.5 applicants for employment, partnership and programme participation.
3.3 Where a provision of this Policy applies to only one role, that is stated expressly.
4.1 Personal Data provided directly to us:
4.1.1 Account Data — name, email address, telephone number, organisation, role and authentication credentials;
4.1.2 Enquiry Data — the content of communications, demonstration requests and applications;
4.1.3 Billing Data — billing contact, organisation details and tax identifiers. Payment card data is Processed by PCI-DSS compliant payment service providers and is not stored by TruScholar; and
4.1.4 Application Data — information submitted in connection with employment, partnership or programme applications.
4.2 Personal Data provided by Customers relating to Credential recipients:
4.2.1 Identity Data — name, enrolment or roll number, date of birth and photograph, where supplied;
4.2.2 Academic Data — programme, grades, marks, credits, issue and completion dates and Credential status;
4.2.3 Contact Data — email address and telephone number; and
4.2.4 Employment Data — where career or placement modules are used.
4.3 Personal Data collected automatically:
4.3.1 Technical Data — internet protocol address, device type, operating system, browser and language settings;
4.3.2 Usage Data — pages accessed, features used, and date and time of access; and
4.3.3 Log Data — server logs recording access, error and security events.
4.4 Special categories of Personal Data. The Services do not require special categories of Personal Data as defined under Article 9 of the GDPR. Customers are contractually prohibited from uploading such data absent prior written agreement.
5.1 TruScholar Processes Personal Data for the purposes and on the lawful bases set out below. Each purpose is stated with its basis under the General Data Protection Regulation and, where different, under the Digital Personal Data Protection Act, 2023.
5.1.1 Provision of the Services and issuance of Credentials. Necessary for performance of a contract under Article 6(1)(b), or Processed on the Controller’s documented instructions under Article 28. Under the DPDP Act, consent or a certain legitimate use, as established by the Data Fiduciary.
5.1.2 Account creation and administration. Necessary for performance of a contract under Article 6(1)(b). Under the DPDP Act, provision of the service requested.
5.1.3 Verification of Credentials upon request. Necessary for the legitimate interests of TruScholar and of Verifiers under Article 6(1)(f), verification being the purpose for which a Credential exists. Under the DPDP Act, a legitimate use.
5.1.4 Service communications and notifications. Necessary for performance of a contract under Article 6(1)(b), and for legitimate interests under Article 6(1)(f). Under the DPDP Act, a legitimate use.
5.1.5 Customer support. Necessary for performance of a contract under Article 6(1)(b). Under the DPDP Act, a legitimate use.
5.1.6 Billing, collection and tax compliance. Necessary for performance of a contract under Article 6(1)(b) and for compliance with a legal obligation under Article 6(1)(c). Under the DPDP Act, compliance with a legal obligation.
5.1.7 Security, fraud prevention and abuse detection. Necessary for legitimate interests under Article 6(1)(f) and, in part, for compliance with a legal obligation under Article 6(1)(c). Under the DPDP Act, a legitimate use.
5.1.8 Product improvement and analytics. Necessary for legitimate interests under Article 6(1)(f), or carried out with consent under Article 6(1)(a) where consent is required. Under the DPDP Act, consent where required.
5.1.9 Marketing to business contacts. Carried out with consent under Article 6(1)(a), or for legitimate interests under Article 6(1)(f) subject always to the right to object. Under the DPDP Act, consent.
5.1.10 Compliance with legal obligations and defence of legal claims. Necessary for compliance with a legal obligation under Article 6(1)(c) and for legitimate interests under Article 6(1)(f). Under the DPDP Act, compliance with a legal obligation.
5.2 Legitimate interests assessment. Where TruScholar relies on legitimate interests, it has carried out a balancing assessment. Details are available on request at info@truscholar.io.
5.3 Restrictions on use. TruScholar shall not:
5.3.1 sell Personal Data;
5.3.2 use Credential data relating to learners for advertising purposes; or
5.3.3 use Customer Personal Data to train models made available to third parties.
6.1 Each Credential is anchored by writing a cryptographic hash to a distributed ledger.
6.2 A cryptographic hash is a fixed-length value derived from the Credential. It is computationally infeasible to reverse the hash to reveal the underlying content.
6.3 No Personal Data is written to any distributed ledger. Names, marks, grades, dates of birth and contact details remain within the platform database.
6.4 The consequence of clause 6.3 is that rights of correction and erasure remain fully exercisable. A Credential may be corrected and re-anchored, and Personal Data may be erased, while the anchored hash remains without meaning in isolation.
7.1 TruScholar discloses Personal Data to the following categories of recipient:
7.1.1 Sub-processors engaged to provide the Services, each bound by a written data processing agreement. A current list is set out in Annex 1 to the Data Processing Agreement;
7.1.2 Issuing Customers, in respect of Credentials they have issued;
7.1.3 Verifiers, limited to the Credential data a Data Subject has elected to share. Credentials cannot be browsed or enumerated; verification requires the specific Credential identifier;
7.1.4 Government platforms, being DigiLocker, the National Academic Depository and the Academic Bank of Credits, where a Customer instructs delivery;
7.1.5 Payment service providers compliant with PCI-DSS;
7.1.6 Professional advisers, including legal, audit and insurance advisers, under obligations of confidentiality;
7.1.7 Competent authorities, where required by law, court order or a valid legal request. TruScholar assesses each request, challenges requests that are overbroad, and notifies the affected Customer save where legally prohibited; and
7.1.8 An acquirer, in connection with a merger, acquisition or transfer of assets, subject to the acquirer being bound by this Policy or giving prior notice of any material change.
8.1 Customer Personal Data is hosted on Amazon Web Services (AWS) cloud infrastructure. Data residency options are available, and the hosting region is confirmed in writing for institutional Customers.
8.2 Where Personal Data is transferred outside the jurisdiction of collection, TruScholar relies upon one or more of the following:
8.2.1 Standard Contractual Clauses adopted by the European Commission pursuant to Decision (EU) 2021/914;
8.2.2 the United Kingdom International Data Transfer Addendum;
8.2.3 an adequacy decision of the European Commission or the United Kingdom Secretary of State; or
8.2.4 a mechanism permitted under Section 16 of the Digital Personal Data Protection Act, 2023, subject to restrictions notified by the Central Government.
8.3 TruScholar carries out transfer impact assessments where required and implements supplementary measures where necessary.
8.4 Copies of the transfer mechanisms relied upon are available on request.
9.1 Personal Data is retained for the periods set out below, or for such longer period as is required by applicable law.
9.1.1 Account Data — for the term of the account and for 90 days thereafter, so that data may be exported.
9.1.2 Credential data Processed in the capacity of Processor — in accordance with the Customer’s instruction and the Data Processing Agreement.
9.1.3 Credentials held within a learner wallet — until deleted by the Data Subject, the wallet being the property of the Data Subject.
9.1.4 Billing and tax records — 8 years, as required under Indian law.
9.1.5 Support correspondence — 3 years from resolution.
9.1.6 Marketing contact data — until objection is received, following which a suppression record is retained to give effect to that objection.
9.1.7 Server and audit logs — 12 months.
9.1.8 Cookie consent records — 12 months.
9.1.9 Application Data relating to employment, partnership or programme applications — 12 months, unless the applicant requests a longer period.
9.2 On expiry of the applicable period, Personal Data is deleted or irreversibly anonymised.
10.1 Subject to applicable law, you have the following rights:
10.1.1 Access — to obtain confirmation of Processing and a copy of your Personal Data;
10.1.2 Rectification — to have inaccurate Personal Data corrected and incomplete data completed;
10.1.3 Erasure — to obtain deletion where no overriding lawful basis for retention applies;
10.1.4 Restriction — to restrict Processing in defined circumstances;
10.1.5 Portability — to receive your Personal Data in a structured, commonly used, machine-readable format;
10.1.6 Objection — to object to Processing based on legitimate interests, and to direct marketing at any time and without qualification;
10.1.7 Withdrawal of consent — where Processing is based on consent, without affecting the lawfulness of prior Processing;
10.1.8 Nomination — pursuant to Section 14 of the Digital Personal Data Protection Act, 2023, to nominate a person to exercise your rights in the event of death or incapacity; and
10.1.9 Grievance redressal — pursuant to Section 13 of that Act, to have a grievance addressed by TruScholar using the contact details at clause 18.
10.2 Rights under United States state privacy laws. Where applicable state law confers rights to know, delete, correct, or opt out of sale or sharing of personal information, such rights may be exercised using the contact details at clause 18. TruScholar does not sell or share personal information as those terms are defined under such laws, and will not discriminate against any individual for exercising a right.
10.3 Exercising rights.
10.3.1 Where a Credential was issued by a Customer, the request should be addressed to that Customer in the first instance.
10.3.2 In all other cases, requests should be addressed to info@truscholar.io.
10.3.3 TruScholar responds within thirty (30) days, extendable by a further sixty (60) days for complex requests, with notice of any extension.
10.3.4 TruScholar may require verification of identity before acting on a request.
10.3.5 No fee is charged save where a request is manifestly unfounded or excessive, in which case a reasonable fee may be charged or the request refused, with reasons.
11.1 TruScholar maintains the following certifications, subject to independent audit: CMMI Level 3, ISO/IEC 27001 and SOC 2 Type II.
11.2 Technical and organisational measures include:
11.2.1 encryption of Personal Data in transit and at rest;
11.2.2 role-based access control, single sign-on and multi-factor authentication;
11.2.3 append-only audit logging of issuance, amendment, revocation and access events;
11.2.4 periodic penetration testing and vulnerability management;
11.2.5 secure development lifecycle practices;
11.2.6 backup, disaster recovery and business continuity arrangements, periodically tested; and
11.2.7 confidentiality obligations and data protection training for authorised personnel.
11.3 TruScholar does not disclaim responsibility for failures of its own security measures. Where a Personal Data Breach arises from a failure to implement appropriate measures, TruScholar’s obligations under applicable law apply in full.
12.1 Where a Personal Data Breach is likely to result in a risk to the rights and freedoms of Data Subjects, TruScholar shall:
12.1.1 notify the competent supervisory authority within seventy-two (72) hours of becoming aware, where the GDPR applies;
12.1.2 notify the Data Protection Board of India as required under the Digital Personal Data Protection Act, 2023;
12.1.3 notify affected Data Subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms; and
12.1.4 where acting as Processor, notify the affected Customer without undue delay and in any event within forty-eight (48) hours, in accordance with the Data Processing Agreement.
12.2 Notifications shall include the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point.
13.1 Customers may issue Credentials to individuals under the age of eighteen (18).
13.2 Where clause 13.1 applies:
13.2.1 the Customer is responsible for establishing a lawful basis, including obtaining verifiable parental or guardian consent where required under Section 9 of the Digital Personal Data Protection Act, 2023, Article 8 of the GDPR, or the Children’s Online Privacy Protection Act, as applicable;
13.2.2 TruScholar Processes such Personal Data solely on the Customer’s instructions;
13.2.3 TruScholar does not undertake behavioural advertising or tracking directed at children; and
13.2.4 TruScholar does not knowingly create direct accounts for individuals under eighteen (18) absent appropriate consent.
13.3 Any person believing that a child’s Personal Data has been provided without appropriate consent should contact us at info@truscholar.io, and TruScholar shall investigate without undue delay.
14.1 TruScholar uses cookies and similar technologies when you visit truscholar.io or use the Services. A cookie is a small text file placed on your device that lets a website remember things about your visit, such as whether you are signed in or what preferences you have set.
14.2 Similar technologies work in comparable ways, and references to cookies in this section include them:
14.2.1 Local storage and session storage — data held in your browser, used to keep you signed in and remember preferences;
14.2.2 Pixels and tracking beacons — small image files that record whether a page or an email has been opened; and
14.2.3 Software development kits (SDKs) — code within our mobile applications that performs similar functions to cookies.
14.3 Categories. We use the following categories of cookie:
14.3.1 Strictly necessary — required for the website and platform to function, including keeping you signed in, protecting against fraudulent requests, load balancing and recording your cookie preferences. They cannot be switched off and do not require consent;
14.3.2 Functional — remember choices you make, such as your language, region or display preferences. The site works without them;
14.3.3 Analytics and performance — help us understand which pages are visited, how long people stay, where errors occur and which features are used. The data is aggregated and helps us improve the product; and
14.3.4 Marketing and advertising — track visits across websites to measure campaign performance and show relevant advertising. They may be set by advertising partners through our site.
14.4 Cookies we use. The following cookies are set across our website and platform. This list reflects the cookies actually in use and is reviewed whenever our tooling changes:
14.4.1 Session cookie — Strictly necessary. Maintains your signed-in session so you are not asked to authenticate on every page. Expires when you close your browser. Set by TruScholar.
14.4.2 Consent preference cookie — Strictly necessary. Records the cookie choices you have made, so we do not ask you again on every visit. Retained for 12 months. Set by TruScholar.
14.4.3 Security token cookie — Strictly necessary. Protects against cross-site request forgery, an attack in which another site attempts to act using your session. Expires when you close your browser. Set by TruScholar.
14.4.4 Preference cookie — Functional. Remembers your language, region and display settings. Retained for 12 months. Set by TruScholar.
14.4.5 Analytics cookie — Analytics. Measures how the site is used — which pages are visited, how long people stay, and where errors occur — so we can improve it. Retained for 12 months. Set by [analytics provider].
14.4.6 Campaign measurement cookie — Marketing. Measures the performance of our campaigns. Retained for 12 months. Set by [advertising provider].
14.5 Third-party cookies. Some cookies are set by third parties whose services we use, including analytics providers, advertising and campaign partners, embedded content such as video players, maps and social media embeds, and support and chat tools. We do not control these cookies, and their use of any data collected is governed by their own privacy policies.
14.6 Your choices.
14.6.1 When you first visit, you are asked to accept or reject non-essential cookies. You can accept all, reject all non-essential cookies, or choose by category. Strictly necessary cookies run regardless, because the site cannot function without them.
14.6.2 Preferences may be varied at any time via the “Cookie settings” control in the footer of each page. Your choice is recorded and applies to future visits from the same browser.
14.6.3 Most browsers let you block or delete cookies through their settings. Blocking all cookies will prevent parts of the platform from working, including staying signed in.
14.6.4 We honour Global Privacy Control signals where your browser sends them. Browser “Do Not Track” settings are not consistently defined across the industry; we act on GPC signals rather than DNT headers.
14.6.5 Device-level advertising controls are available in your operating system settings — “Limit Ad Tracking” on iOS and “Opt out of Ads Personalisation” on Android.
14.7 Consent and legal basis. Where required by law, we place non-essential cookies only after you consent, and record that consent. Strictly necessary cookies are placed on the basis of legitimate interest, as they are required to deliver a service you have requested. For visitors in the European Economic Area, the United Kingdom and Switzerland we apply the GDPR and the ePrivacy Directive, and for visitors in India the Digital Personal Data Protection Act, 2023.
14.8 Retention. Session cookies are deleted when you close your browser. Persistent cookies remain for the periods shown in clause 14.4. Cookie consent records are retained for 12 months, as set out in clause 9.1.8, so we can demonstrate the basis on which cookies were placed.
14.9 Where our use of cookies changes materially, we will ask for your consent again rather than relying on a previously given one.
15.1 The Services contain links to websites operated by third parties. This Policy does not apply to such websites.
15.2 TruScholar exercises no control over, and accepts no responsibility for, the content or privacy practices of third-party websites.
16.1 TruScholar does not take decisions producing legal effects concerning a Data Subject, or similarly significantly affecting them, based solely on automated Processing.
16.2 Where features of the Services employ automated analysis, including career recommendation functionality, such analysis is advisory only and does not determine any outcome without human involvement.
17.1 TruScholar may amend this Policy from time to time. The version reference and effective date at the head of this document identify the current edition.
17.2 Where an amendment is material, TruScholar shall give notice by email to account holders, by notice within the Services, or both, before the amendment takes effect.
17.3 Where an amendment requires consent under applicable law, such consent shall be sought before the amendment is applied.
17.4 Previous versions are available on request.
18.1 Contact for privacy matters: info@truscholar.io.
18.2 TruScholar acknowledges complaints within two (2) business days and responds substantively within thirty (30) days.
18.3 A Data Subject dissatisfied with TruScholar’s response may lodge a complaint with:
18.3.1 India — the Data Protection Board of India;
18.3.2 European Economic Area — the supervisory authority of the member state of residence, place of work or place of the alleged infringement;
18.3.3 United Kingdom — the Information Commissioner’s Office; or
18.3.4 other jurisdictions — the applicable regulatory authority.
18.4 The right to lodge a complaint with a supervisory authority may be exercised without first contacting TruScholar.