Privacy Policy

Effective from: 21 October 2026 · Last updated: 25 October 2026

In short: we collect only what you choose to send us through our forms, use it only to reply and to arrange services you ask about, never sell it, keep it for a limited time, and you can see, correct or erase it, or withdraw your consent, at any time. We acknowledge every request within 72 hours and resolve it within 30 days.

This policy is our notice under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). Until the DPDP Act fully replaces them, it also follows the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they apply. A Tamil version is available on request: email grievance@cretowin.in.

1. Who we are, and our role

Cretowin Private Limited, a company incorporated in India (“Cretowin”, “we”, “us”), is the data fiduciary for personal data collected through cretowin.in: we decide why and how it is used.

When we provide services to a college or university (for example IT care, hosting or a DPDP assessment), the institution is the data fiduciary for its students’ and staff’s data, and Cretowin acts as its data processor. In that role we process data only on the institution’s written instructions, under a data-processor agreement that commits us to encryption in transit and at rest, role-based access, access logs and audit trails, prompt breach notification to the institution, and deletion or return of data when the contract ends. Questions about how a college uses your data should go to that college’s own Grievance Officer.

Address: No 9, 6/2A1/2, Montfort School Main Road, Singaram Nagar, Kattur, Tiruchirappalli, Tamil Nadu 620019
Email: grievance@cretowin.in · Phone: +91 909 222 1930

2. What we collect, and why

We collect only the personal data listed below, and only for the purposes stated next to it.

Personal data	When we collect it	Specific purpose
Name, role, institution, city, email address, phone number	When you submit the contact form, send your DPDP readiness-check results, or make a data request	To reply to you, arrange a free assessment, prepare a quote, or handle your request
Your answers, score and gap list from the DPDP readiness check	Only if you submit the board-report form or press “Send my detailed result to Cretowin”	To prepare for your assessment and recommend a suitable plan
Your message, area of interest and request type	When you include them in a form	To understand and answer your question or request
A one-way scrambled (hashed) form of your IP address, and the date and time of your submission	When you submit any form	To prevent spam and abuse, and to keep the security logs the DPDP Rules require. We cannot recover your IP address from the hash.

We do not ask for, and you should not send us through this website, student records, Aadhaar numbers, bank or card details, or health information.

3. Data that stays on your device

The DPDP readiness check saves your answers and language choice in your own browser (local storage) so you can continue later. This stays on your device and is not sent to us unless you choose to send your results. You can delete it with “Start again” or by clearing your browser data. If you use “Send the 12 to our IT in-charge”, your answers (never your name or contact details) travel inside the link itself, after the # sign, which browsers do not send to our server. Anyone you share the link with can see those answers. We do not use advertising or tracking cookies.

The chat assistant on every page runs entirely in your browser and does not send your messages to us or to anyone else. So that a conversation can continue as you move between pages, it is kept in your browser’s session storage for that tab only, and it is deleted when you close the tab or choose “Clear chat”. If you type an email address or a phone or ID number, the assistant hides it and does not keep it. Messages reach us only if you choose to contact us through WhatsApp, email, a phone call or one of our forms.

4. Your consent

We process the personal data you send through our forms on the basis of your consent, which you give by ticking the consent box before you submit. Your consent is free, specific to the purposes in section 2, and you can withdraw it at any time.

Withdrawing consent is as easy as giving it: use the data request form and choose “Withdraw consent”, or email grievance@cretowin.in. We will then stop using your data and erase it within a reasonable time, unless a law requires us to keep it. Withdrawal does not affect anything we lawfully did before it.

5. Who processes data for us

We do not sell, rent or trade personal data. We use the following service providers (data processors) under contract, only to run this website and our communications:

Cloudflare, Inc.: website hosting, security, and the database that stores form submissions.
Hostinger: our email service, when you email us or we reply.
Discord: internal alerts to our team about new enquiries (name, institution and contact details only).
WhatsApp (Meta): only if you choose to message us on WhatsApp.

We host this website’s fonts ourselves, so loading a page does not send your IP address to a font provider.

We may also disclose personal data where Indian law requires it, for example to comply with a lawful order.

6. Where your data is stored

Form submissions are stored in a Cloudflare database in Cloudflare’s Asia-Pacific region (Singapore), which is outside India. Transfers outside India are permitted under the DPDP Act except to countries the Government of India restricts by notification; Singapore is not restricted at the date of this policy. We will move or stop the transfer if that changes.

7. How long we keep it

Data	How long
Enquiries and readiness-check results	Up to 24 months after our last contact with you, then erased. If you become a customer, we keep what our contract, tax and accounting laws require.
Security logs (hashed IP address, submission time)	At least 1 year, as required by the DPDP Rules for detecting and investigating misuse, then erased with the related enquiry
Records of data-rights requests and grievances	3 years, as a record of how we handled them

We erase data earlier if you withdraw consent or ask us to, unless a law requires us to keep it.

8. Your rights

Under the DPDP Act, you have the right to:

Access: a summary of the personal data we hold about you, how we use it, and who we have shared it with;
Correction and completion: have inaccurate or incomplete data corrected or updated;
Erasure: have your data erased when it is no longer needed for the purpose, or when you withdraw consent;
Withdraw consent at any time (see section 4);
Nominate another person to exercise your rights if you die or become unable to;
Grievance redressal: raise a complaint with us about how we handle your data.

How to make a request: use the data request form, or email grievance@cretowin.in with the subject “Data request”, or write to our address above. To protect you, we may ask you to confirm your identity, usually by replying from the email or phone number you used with us.

Our response time: we acknowledge every request within 72 hours, and resolve it as soon as possible and in any case within 30 days. This meets both the one-month limit in the IT (Reasonable Security Practices) Rules, 2011 and the 90-day limit in the DPDP Rules, 2025.

If you are not satisfied: after using our grievance process, you can complain to the Data Protection Board of India through its official online platform.

9. Security

We take reasonable security safeguards, including: encryption of data in transit (HTTPS); access to submissions limited to authorised Cretowin staff with a password; spam and abuse controls; security logs kept for at least one year; and contracts with our service providers that require them to protect personal data.

10. Personal data breaches

If a breach affects your personal data, we will inform you without delay, in plain language, describing what happened, the likely consequences, what we are doing about it and what you can do to protect yourself. We will also inform the Data Protection Board of India without delay and send it a detailed report within 72 hours, as the DPDP Rules require.

Where a cybersecurity incident must be reported under the CERT-In Directions issued under the Information Technology Act, 2000, we report it to CERT-In within 6 hours of noticing it.

11. Children

This website is meant for staff of institutions and adult learners. We do not knowingly collect personal data from anyone under 18 through it. If you believe a child has sent us data, contact us and we will erase it.

12. Grievance redressal: three levels

Cretowin is not a Significant Data Fiduciary, so the law does not require us to appoint a Data Protection Officer. Our Grievance Officer answers all questions about personal data.

Level 1Grievance Officer: Devastalin

Email grievance@cretowin.in (subject “Grievance”) or call +91 909 222 1930. Acknowledged within 72 hours; resolved within 30 days.

Level 2Management escalation

If you are not satisfied, or have no answer within 30 days, email grievance@cretowin.in with the subject “Escalation” and your reference. A company director reviews it.

Level 3Data Protection Board of India

If our process does not resolve your grievance, you can complain to the Data Protection Board of India. Details are published through official channels, including MeitY’s data protection framework page.

Devastalin, Grievance Officer
Cretowin Private Limited
No 9, 6/2A1/2, Montfort School Main Road, Singaram Nagar, Kattur, Tiruchirappalli, Tamil Nadu 620019
Email: grievance@cretowin.in · Phone: +91 909 222 1930

13. Official sources

You can read the law and verify your statutory rights directly on official Government of India websites. These open in a new tab:

Linking to these sites does not imply any government affiliation or endorsement of Cretowin. This policy explains how Cretowin handles personal data; it is not legal advice. See our legal disclaimer.

14. Changes to this policy

We will update this page when our practices or the law change, and show the new date at the top. If a change affects how we use data you have already given us, we will tell you and, where needed, ask for your consent again.