Privacy Notice
Aassaan Accreditation Private Limited (Aassaan, also Aassaan eduCare). Version 1.0, 21 October 2026.
This notice covers all Aassaan software: the Aassaan KPI Portal (kpi.aassaan.com), Aassaan ID (id.aassaan.com) and this website (aassaan.com). It is written for India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. It is part of the Terms of Service of the KPI Portal and of the Aassaan staff terms.
1. Who decides what
- An educational institution decides what it asks its own people for (their names, designations, employee IDs, answers, evidence and documents) and why. For that data Aassaan runs the KPI Portal on the institution's behalf. Ask your institution first about this data. Where the law treats Aassaan as the fiduciary of any of it, Aassaan accepts the duties the law gives it.
- Aassaan decides why and how it handles the data it needs to run and protect the sites: account and sign-in details, mobile numbers given for sign-in codes, device and country records, the audit trail, support messages, and the details of people who register or write to Aassaan. It also holds the details of its own staff.
2. What is collected, and about whom
| About | What | Why |
|---|---|---|
| People at institutions (KPI Portal) | Name, official email address, role, department, designation, employee ID; date of birth (asked at the first sign-in of people invited by name); a backup email if you add one; a mobile number if you add one for sign-in codes (kept encrypted, with the time you agreed); answers, evidence notes, publication details (DOIs), supporting documents, the Head of Department's checks, signatures on reports. | To run the questionnaires, checks, reports and sign-off, and to identify you. |
| Aassaan staff (Aassaan ID and the KPI Portal) | Name, employee number, designation, department, who you report to, organization, work email, work mobile (kept encrypted), first and last working day, access rights and the history of changes to them, date of birth if given. | Employment or engagement, giving and removing access, security. |
| Everyone who signs in | Password (kept only as a one-way hash), authenticator app secret (encrypted), passkeys, recovery codes (hashed); the internet address and time of each recorded action (sign-ins, changes, downloads, signatures); your browser and the country of the address at each sign-in, and the places and devices you have signed in from; notes of attempts to copy, print or take a screenshot of protected pages. | To sign you in, keep the sites secure, tell you about a sign-in from somewhere new, and keep a reliable record of who did what. |
| People who write to Aassaan | Name, email, institution, role and what you choose to write. Mail sent to Aassaan's support address is received through Amazon's email service. | To answer you. |
| Visitors to this website | Your internet address is read to apply a country restriction, and only a count of visits per country per day is kept. Like any website, the servers keep ordinary logs (address, time, page). | Security and keeping the sites working. |
Aassaan does not ask for bank or card details, government ID numbers, photographs, precise location, or advertising identifiers. (A document you upload could contain such things; the Terms ask institutions to black them out.) The sites load no analytics, no advertising and no code from other companies.
3. Why Aassaan uses it, and who sees it
Aassaan uses personal data to provide and secure the sites, to keep a reliable record, to send the emails the sites need to send (invitations, sign-in codes, notices), to give support, to meet legal duties and to defend legal claims. It relies on the uses the DPDP Act allows (for example employment, legal duties, and data you give voluntarily for a purpose). Where the law needs your consent, Aassaan asks for it separately and plainly, for example when you add a mobile number for sign-in codes. Aassaan does not sell personal data and does not use it for advertising.
Who sees it: you; the people at your institution whose role allows it; a small number of Aassaan people who run the service and give support, through pages that record who looked and when; the service providers in section 4, which store or carry data for Aassaan; and a court or authority where the law requires it. People at other institutions are not shown your institution's data.
4. Where it is kept
| Provider | What | Where |
|---|---|---|
| Amazon Web Services | The web application and the database: everything above. | Mumbai, India |
| Amazon Simple Email Service | The emails the sites send, and delivery and bounce reports. | Mumbai, India |
| Cloudflare (R2 storage) | Encrypted copies of the database. Aassaan encrypts them before they leave its servers and holds the key; Cloudflare holds only unreadable files. | A place Cloudflare chooses; Aassaan does not select a country, so this may be outside India |
| Cloudflare (domain names) | Domain names only. | Worldwide network |
| Backblaze (B2 storage) | Supporting documents uploaded to the KPI Portal. | United States (US East) |
| Meta (WhatsApp) and Amazon messaging | Only if you choose sign-in codes by WhatsApp or text message: your mobile number and the code message. | May be outside India |
| Crossref | Only a DOI that you paste, to look up a publication. Nothing else is sent. | A public service |
Aassaan sends personal data outside India only to the extent the DPDP Act allows. If Aassaan changes a provider or a place, this notice is updated.
5. How long it is kept
- Deleted automatically after days or months: sign-in codes, used or expired links, rate counters, ended sessions, notes of email attempts and bounces (90 days), single sign-on tickets, and sign-in places not used for about 13 months.
- Kept while the institution uses the service, and afterwards as long as needed for the integrity of the record, for the institution's purposes, and for legal reasons: accounts, saved questionnaire versions, reports, signatures and the audit trail. They are chained so that any later change shows, so they cannot simply be edited or deleted.
- Supporting documents are kept for six years from upload and then removed by the storage provider's own rule. For the first 90 days the provider will not delete them.
- Backups of the database are kept for a limited time (every backup of the last 30 days, then about one every three months, none kept for more than about a year; a storage rule removes anything older than 400 days as a backstop).
- Staff records are kept while you work for Aassaan and afterwards as long as needed for employment records, security investigations, tax and employment law, and legal claims.
6. Your rights
Under the DPDP Act you may ask for a summary of your personal data and who it is shared with; ask for it to be corrected, completed or updated; ask for it to be erased; ask for help with a complaint; and name a person to act for you if you die or cannot act. You may withdraw your consent for a purpose. Ask your institution first about data it decides on, or write to Aassaan (section 8). Aassaan may need to check who you are, and answers within the time the law allows. Erasure has limits: Aassaan keeps what the law requires it to keep, and the records described in section 5 that must stay whole for the integrity of the record (it will then deactivate the account and limit use of the data as far as the law requires). Data inside a backup ages out by itself.
7. Cookies
Aassaan uses only the cookies the sites need to work and to be secure. There are no advertising or analytics cookies.
| Cookie | What it does | How long |
|---|---|---|
| __Host-kpi_session | Keeps you signed in on one site. | Until you close the browser; also after 30 minutes of no use, and after 12 hours at most |
| __Host-kpi_csrf | Protects forms from being filled in by another site. | Up to one year |
| __Host-kpi_td | Only if you tick "Remember this device": lets you skip the emailed code on that device. Not available to every role. | 30 days |
| __Host-kpi_human | Shows that this browser passed a quiet check against automated tools. | 30 minutes |
| __Secure-kpi_sso_hint, __Host-kpi_sso_n, __Host-kpi_sso_tried | Aassaan staff only, and only if single sign-on between the Aassaan sites is switched on: a hint that a staff member has signed in in this browser (it carries no name), and two short-lived values for the hand-over between sites. | The hint: until you close the browser; the others: a few minutes |
8. Contact and grievances
Grievance Officer, Aassaan Accreditation Private Limited. Email: info@aassaan.in (write "Grievance" in the subject). Post: Aassaan Accreditation Private Limited, Sri Sai Subhodaya Apartment, 66 East Coast Road, Netaji Nagar, Thiruvanmiyur, Chennai 600041, Tamil Nadu, India. For help with the sites, write to kpi.support@aassaan.com. Aassaan acknowledges a request promptly and answers it within the time the law allows. If you are not satisfied, you may complain to the Data Protection Board of India, as the DPDP Act allows.
9. Children, and changes to this notice
The sites are for adults who work at an institution or at Aassaan. They are not meant for anyone under 18.
Aassaan may change this notice. The date and version at the top show when, and Aassaan announces a material change on the sites. The Terms of Service and the Aassaan staff terms say how a change to them reaches you.