Privacy Policy

KollegeApply.com - INDO INTERNET PRIVATE LIMITED
Effective date: 12 September 2026 | Last updated: 12 September 2026

1. Introduction

KollegeApply.com and its mobile applications (the "Platform") are owned and operated by INDO INTERNET PRIVATE LIMITED ("KollegeApply", "we", "us" or "our").

Registered office: 6th Floor, Good Earth City Centre, Vikas Marg, Pocket H, Nirvana Country, Sector 50, Gurugram, Haryana 122018.

We respect your privacy. This Privacy Policy explains what personal data we collect, the purposes for which we process it, how we obtain and record consent, who may receive it, how long we retain it, the safeguards we apply, and how you may exercise your rights.

The Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") are being brought into force in phases. We apply this Policy in accordance with provisions currently in force and are implementing the measures required for provisions scheduled to commence later. Where the DPDP Act applies, KollegeApply acts as a Data Fiduciary and the individual to whom the personal data relates is the Data Principal.

2. Scope and sources of personal data

This Policy applies to personal data processed through the Platform, our enquiry and registration forms, counselling and support channels, authorised landing pages, and communications connected with the services requested by you. It does not apply to an institution or other third party acting independently under its own privacy policy.

3. Sharing of Information

3.1 Information you provide

• Full name
• Mobile number and email address
• Date of birth, used to determine whether the student is under 18
• City, state and other location information you choose to provide
• Course, stream, examination and college or university preferences
• Examination scores, rank, board results and academic qualifications where required for a tool, counselling or admission-assistance service selected by you
• Account credentials and profile information, where an account is created
• Parent or lawful guardian name, relationship, contact details, adult or guardian verification details and consent record, where applicable
• The content and records of your enquiries, counselling interactions, requests and communications with us
• Consent, communication preference, withdrawal and grievance records

3.2 Information collected automatically

When you use the Platform, we may collect IP address, device and browser type, operating system, pages viewed, session activity, referring URL, cookie or device identifiers, and security and processing logs. Non-essential analytics or advertising technologies are handled as described in Section 14.

3.3 Data minimisation

We seek to collect only personal data that is reasonably necessary for the specified service or purpose. Please do not provide bank account details, payment card numbers, government identification numbers, health information, religion, caste, political views or other information that we have not specifically requested. If reliable identity or age details are required solely to verify a parent or lawful guardian, we process only the minimum information reasonably necessary for that verification and compliance purpose.

4. Notice and consent at the lead form

At the first step of a lead, enquiry or registration form where we capture personal details, we display a short notice before submission. The notice is intended to be understandable independently of this full Policy and states:

The form identifies the personal data requested and the service or purpose for which it will be processed. Submission is treated as the user's clear affirmative action for the purposes stated in that notice. We do not use a pre-ticked box to obtain optional consent.

Consent to receive general promotional communication that is unrelated to the specific enquiry, or to receive information from institutions not selected by the user, is obtained separately where required and is not a condition for accessing general Platform content or tools.

We maintain appropriate evidence of notice and consent, including the form or page, notice version, date and time, affirmative action, specified purpose, communication channels, institution selected or affirmatively chosen, age outcome where relevant, and any subsequent withdrawal or preference change. Applicable telecommunication and commercial-communication requirements, including TRAI requirements, are handled separately from consent under the DPDP Act.

You may withdraw consent or change your communication preferences through the mechanism offered with the relevant form, account or communication, or by emailing grievance@kollegeapply.com. Withdrawal does not affect processing lawfully carried out before withdrawal. We and our processors will cease consent-based processing within a reasonable time unless continued processing is authorised or required by applicable law.

5. How we use personal data

We process personal data for one or more of the following specified purposes, depending on the service requested:

• Create, authenticate and maintain an account or profile
• Provide college, course, examination and admission information
• Operate predictor, comparison, shortlist and application-support tools selected by you
• Respond to an enquiry and provide admission guidance or counselling
• Contact you by the channels identified in the applicable form notice regarding that enquiry
• Share relevant details with a college or university that you selected or in which you affirmatively expressed interest, so it may communicate with you about admission
• Verify age and, where necessary, obtain and record verifiable consent from a parent or lawful guardian
• Maintain consent, withdrawal, grievance, audit and security records
• Protect the Platform, prevent fraud or misuse, investigate incidents and comply with applicable law
• Measure and improve the Platform using aggregated or anonymised information, and personal data only where a lawful ground applies
• Send general promotional information only where the required separate permission has been obtained or another lawful ground applies

We do not process personal data for a new purpose that is incompatible with the notice provided to you. Where a new purpose requires consent, we provide an appropriate notice and obtain fresh consent before processing.

6. Who we share personal data with

6.1 Information you provide

Where you select, apply to, request information about, or affirmatively choose a college or university from recommendations shown to you, we may share the data reasonably required for that institution to respond to your admission-related enquiry. Depending on the enquiry, this may include your name, contact details, city, course preference, academic information and enquiry details.

We do not treat passive browsing alone as permission to transfer your personal data to an institution. If you have not selected or affirmatively expressed interest in a specific institution, we will not share your identifiable lead details with that institution without first presenting the proposed sharing to you and recording your choice, unless disclosure is otherwise authorised or required by law.

A recipient institution ordinarily acts as an independent Data Fiduciary for its subsequent processing. Our arrangements require recipient institutions to use the data for the disclosed admission-related purpose, apply appropriate safeguards and not disclose it onward except as permitted by law. You should also review the institution's privacy information. Where personal data will be disclosed to another Data Fiduciary or used to make a decision affecting you, we take reasonable steps to ensure that it is complete, accurate and consistent.

6.2 Data Processors and service providers

We may engage authorised providers for hosting, cloud storage, CRM, telephony, email, SMS, WhatsApp messaging, analytics, customer support, cybersecurity, backups and counselling operations. They process personal data on our behalf under written contracts, confidentiality requirements, security obligations, purpose limitations and applicable deletion or return requirements. KollegeApply remains responsible for processing undertaken on its behalf.

6.3 Legal, corporate and protective disclosures

We may disclose personal data where required or authorised by applicable law, a court order or a lawful government request; where reasonably necessary to establish, exercise or defend legal claims; or in connection with a merger, acquisition, restructuring or transfer of business, subject to appropriate confidentiality and privacy safeguards.

We do not disclose personal data to unrelated third parties for their independent general marketing. Institution sharing and service-provider processing occur only as described in this Policy and the applicable notice. Commercial arrangements with institutions do not expand the purposes for which your personal data may be used.

7. Children and individuals represented by lawful guardians

7.1 Students under 18

A person who has not completed 18 years is a child under the DPDP Act. We use the date of birth field as an age gate. If the date of birth shows that a student is under 18, the ordinary enquiry, counselling, communication and institution-sharing workflow is paused or restricted until verifiable consent of the parent or lawful guardian has been obtained and recorded, except to the limited extent processing is permitted by applicable law.

For this purpose, we may collect the parent or lawful guardian's name, relationship, mobile number or email address, confirmation that the individual is an adult, and the minimum reliable identity or age information necessary to verify the person giving consent. Verification may use reliable details already available to us, details voluntarily provided by the adult, or another method permitted under applicable law. We record the consent and verification method.

We do not knowingly undertake processing likely to cause a detrimental effect on the well-being of a child. We do not track or behaviourally monitor a child for advertising or direct targeted advertising at a child. Essential and contextual functions that do not depend on behavioural profiling may continue where permitted by law.

A verified parent or lawful guardian may exercise applicable rights in relation to the child's personal data by contacting the Grievance Redressal Officer under Section 13. If valid parental consent is withdrawn, we cease the related consent-based processing and cause our processors to do so, subject to lawful retention requirements.

7.2 Persons with disability who have a lawful guardian

Where a person with disability is represented by a lawful guardian and verifiable guardian consent is required, we take reasonable steps to verify that the guardian has been appointed by a court, designated authority or local level committee under the applicable guardianship law before relying on that consent.

8. Retention and erasure

We retain personal data only for as long as reasonably necessary to serve the specified purpose, respond to an active request, demonstrate consent and compliance, protect legal rights, maintain security, or meet a retention obligation under applicable law. Retention is reviewed by data category and purpose.

When consent is withdrawn or the specified purpose is no longer served, whichever applies earlier, we erase or anonymise the relevant personal data and instruct our Data Processors to do the same, unless continued processing or retention is authorised or required by applicable law. Data that has been irreversibly anonymised is no longer personal data.

9. Security

We implement reasonable technical and organisational safeguards designed to protect personal data in our possession or control, including data security measures such as encryption, masking or tokenisation where appropriate; role-based and restricted access; authentication controls; logging, monitoring and review; backups and continuity measures; incident detection and response; employee confidentiality and training; and contractual security requirements for Data Processors. Safeguards are reviewed and adjusted having regard to the nature and risks of the processing.

No system can be guaranteed to be completely secure. If a personal data breach occurs, we investigate, take steps to contain and remediate it, and notify affected Data Principals and the Data Protection Board of India in the form and time required by applicable law.

10. Your rights

Where the DPDP Act applies to the processing of your personal data, and subject to its conditions and exceptions, you may have the following rights:

• Right to access information. Request a summary of the personal data being processed and processing activities, and the identities of Data Fiduciaries and Data Processors with whom it has been shared together with a description of the personal data shared, subject to applicable exceptions.
• Right to correction, completion and updating. Ask us to correct inaccurate or misleading data, complete incomplete data, or update personal data.
• Right to erasure. Ask us to erase personal data that is no longer necessary for the specified purpose, unless retention is necessary for that purpose or required or authorised by applicable law.
• Right to withdraw consent. Withdraw consent at any time, with ease comparable to the method used to provide it.
• Right to manage communications. Opt out of general promotional communications and change available channel preferences.
• Right to grievance redressal. Raise a grievance concerning our processing or handling of a rights request.
• Right to nominate. Nominate another individual to exercise applicable rights in the event of your death or incapacity, in the manner prescribed.

To exercise a right, email grievance@kollegeapply.com from your registered email address or identify yourself using the mobile number, email address, account ID or enquiry reference associated with your request. We may request proportionate verification to protect your data. We aim to respond within 30 days.

11. Your choices and withdrawal

You may decline optional processing or optional promotional consent without losing access to general information on the Platform. If you withdraw consent that is necessary to provide a requested personalised service, we may be unable to continue that service and will explain the relevant consequence. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We provide notices and consent requests in clear and plain language. Where required under applicable law, you may access them in English or a language listed in the Eighth Schedule to the Constitution through the language options made available for the relevant form or service.

12. Duties of Data Principals

When the relevant provisions of the DPDP Act apply, you must comply with applicable duties, including to:

• not impersonate another person while providing personal data;
• not suppress material information when providing personal data for a State-issued document, identifier, proof of identity or proof of address;
• not register a false or frivolous grievance or complaint;
• provide only verifiably authentic information when seeking correction or erasure; and
• comply with applicable law while exercising your rights.

13. Grievance redressal and privacy contact

KollegeApply has appointed a Grievance Redressal Officer to receive privacy questions, consent-withdrawal requests, rights requests and grievances.

Where the DPDP Act provides a right to complain to the Data Protection Board of India, you may approach the Board after first giving us a reasonable opportunity to resolve the grievance, in accordance with the applicable law and process.

14. Cookies and similar technologies

We may use cookies and similar technologies for the following categories:

• Essential: security, session management, form operation and core Platform functionality.
• Functional: remembering choices and improving convenience.
• Analytics and performance: understanding usage and improving the Platform.
• Advertising and attribution: measuring campaigns, limiting repetition and, where permitted, personalising advertising.

Essential technologies operate because they are needed to provide or secure the Platform. Where consent is required for non-essential analytics, personalisation or advertising technologies, we seek an affirmative choice through the available cookie or privacy preference mechanism before using them. You may change available preferences later. Browser settings may also block cookies, but doing so can affect Platform functions.

We do not knowingly use tracking or behavioural monitoring of children, or direct targeted advertising at children. When a user is identified as under 18, non-essential profiling and targeted-advertising technologies are disabled or restricted as required by law.

15. Cross-border processing

Some authorised service providers may process or store personal data outside India. Where this occurs, we apply contractual and organisational safeguards and comply with restrictions or requirements imposed by the Central Government or other applicable law concerning transfers or access outside India.

16. Third-party links

The Platform may contain links to external websites, including those of educational institutions. Their independent collection and use of personal data are governed by their own privacy notices. We are not responsible for external content or privacy practices, and we encourage you to review the relevant policy before providing personal data directly to a third party.

17. Existing data and changes to this Policy

Where required by the DPDP Act in relation to consent obtained before the relevant provisions commenced, we will provide an appropriate notice describing the personal data being processed, the purposes, the means of exercising rights and the grievance mechanism. Processing will continue only as permitted by applicable law and may be withdrawn where it is based on consent.

We may update this Policy to reflect changes in law, technology, services or processing. We display the current effective date at the top. If a change materially alters a specified purpose or otherwise requires consent, we provide an appropriate notice and obtain fresh consent before the new consent-based processing begins.

18. Contact

INDO INTERNET PRIVATE LIMITED

6th Floor, Good Earth City Centre, Vikas Marg, Pocket H, Nirvana Country, Sector 50, Gurugram, Haryana 122018

Privacy, consent and grievance requests: grievance@kollegeapply.com

General enquiries: contact@kollegeapply.com

Website: https://www.kollegeapply.com

Grievance Officer: Govind Mahara

Grievance Email: grievance@kollegeapply.com