Privacy Policy

1. Introduction & Scope

Cozmic.in operates an artificial-intelligence-powered, cloud-based Enterprise Resource Planning (ERP) and Governance platform tailored for higher education institutions in India. In providing these services, Cozmic acts primarily as a "Data Processor" under the DPDP Act, 2023. The respective college, university, or educational group licensing the platform is the "Data Fiduciary" determining the purpose and means of data processing.

This Privacy Policy explains how we process data when you access or interact with Cozmic.in, its subdomains, desktop console nodes, and mobile applications (including those for students, parents, and faculty). By using our services, or having your data provisioned onto our platform by your licensing educational institution, you acknowledge the processing patterns defined in this document.

2. Information We Collect

We process different categories of data necessary to provide a comprehensive administrative ERP and campus intelligence system. This includes:

A. Personal Identifiable Information (PII)

Names, roll numbers, enrollment designations, gender, official and personal email addresses, mobile numbers, postal addresses, and official government identifiers (such as Aadhaar Card number, PAN Card number, or Voter ID where necessary for regulatory or scholarship registry integrations).

B. Sensitive Personal Data and Information (SPDI)

• Authentication Secrets: Cryptographic password hashes.
• Financial and Payment Data: Bank account numbers, UPI handles, transaction IDs, fee payment records, and ledger balances collected to handle fee transactions.

C. Biometric Data

For campus security and automated roll-marking via our Stellar module, we process biometric data in the form of mathematical facial mapping vectors. Raw photos or video files captured by local hardware nodes are processed on edge devices to generate these vectors and are not stored in our central databases.

D. Academic, Operational, and Transport Data

• Academic Logs: Scores, grades, exam schedules, hall tickets, Choice-Based Credit System (CBCS) courses, and curriculum milestones.
• Hostel & Campus Logs: Hostel allotment logs, gate-pass records, and mess fee logs.
• Transport Data: GPS coordinates, transport routes, and real-time transit telemetry logs for vehicle tracking.

E. Usage and Telemetry Data

IP addresses, device logs, operating system metrics, browser parameters, access timelines, and authentication token logs collected automatically when accessing our servers.

3. Methods of Data Collection

We collect personal data through three primary mechanisms:

• Institutional Provisioning: The licensing educational institution (Data Fiduciary) directly uploads student, parent, and faculty rosters to initiate portal access.
• Direct User Input: Users input data directly into the platform (e.g., submitting assignments, updating contact forms, uploading profile photos, or entering payment details for tuition fees).
• Automated Telemetry: Real-time hardware integrations, such as GPS devices on campus buses or AI facial recognition cameras at entry checkpoints.

4. Purpose of Processing

Data processed by Cozmic is used strictly for the following operational and legal purposes:

• To deliver, configure, and maintain the campus ERP modules (academics, grading, hostel, transport, finance).
• To process financial transactions, verify fee reconciliation logs, and issue official invoices.
• To compile and update academic records, choose CBCS courses, and generate official grade sheets.
• To automate campus attendance marking and manage gate controls.
• To track and transmit school/college transport vehicles via real-time GPS telemetry for student security.
• To generate analytical dashboards for institutional leaders, deans, and administrative heads.

5. Legal Basis for Processing

Under the Digital Personal Data Protection Act, 2023, and Rule 6 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, our processing operations are justified by:

6. Data Sharing & Disclosures

Cozmic does not sell, rent, trade, or monetize student or institutional databases under any circumstances. Data sharing is strictly confined to:

• The Licensing Institution: All personal data, grades, and records are directly shared with the respective Data Fiduciary (the licensing college/university administration).
• Service Providers (Data Processors): Third-party partners who operate under strict contract terms, including cloud hosting providers (e.g., AWS India servers), payment processors (e.g., Razorpay/BillDesk), and SMS gateway providers.
• Legal & Regulatory Authorities: We disclose data only under valid statutory requests from government or law enforcement agencies, in compliance with Section 91 of the Code of Criminal Procedure / corresponding provisions of the Bharatiya Nagarik Suraksha Sanhita (BNSS), and the DPDP Act, 2023.

7. Data Security Measures

Cozmic maintains reasonable security practices and procedures in compliance with Section 43A of the IT Act, 2000, and Section 8 of the DPDP Act, 2023. Our security standards include:

• Encryption protocols: AES-256 encryption at rest for all database partitions and TLS 1.3 encryption for data in transit.
• Access Control: Zero-trust role-based access controls ensuring strict database compartmentalization.
• Biometric Protection: Irreversible local hashing of facial landmarks; raw face photos are processed instantly and never logged.
• Compliance Benchmarks: We are currently working towards achieving SOC 2 Type II audits and ISO/IEC 27001 security standards, and are GDPR compliant where cross-border data processing is applicable.

8. Data Retention

Cozmic retains personal data only for as long as necessary to fulfill the operational requirements of the licensing institution, or as required under applicable Indian laws.

Upon expiration or termination of the institutional license agreement, all corresponding databases, user profile records, and transaction logs are deleted, purged from server nodes, or anonymized within 90 days, subject to standard statutory compliance parameters and system backup cycles.

9. Rights of Data Principals

Under Section 11, 12, and 13 of the DPDP Act, 2023, Indian citizens (students, faculty, parents) possess specific rights:

• Right to Access: The right to obtain a summary of the personal data currently being processed.
• Right to Correction & Erasure: The right to correct inaccuracies, complete incomplete records, or request erasure of personal data. Since Cozmic is a Data Processor, such requests must be routed through your licensing college or university administration.
• Right to Grievance Redressal: The right to address grievances regarding data processing directly with our Grievance Officer.

10. Cookies & Tracking Technologies

We use technical session cookies, authorization headers, and local storage tokens. These tokens do not track behavior across external websites; they are used strictly to maintain secure authentication states, compile usage load telemetry, and preserve user UI preferences.

11. International Data Transfers

All core databases, ledger entries, and biometric hashes are stored locally on cloud servers located within the territory of India (specifically the AWS Asia Pacific region in Mumbai).

If any minor data processing operations require cross-border transfers (e.g., utilizing global analytical utilities or email SMTP relays), such transfers are executed in strict compliance with Section 16 of the DPDP Act, 2023, ensuring that the destination countries maintain equal or greater privacy protection standards.

12. Children's Data / Student Data Protection

In compliance with Section 9 of the DPDP Act, 2023:

• Processing of personal data belonging to minors (individuals under 18 years of age) is carried out only after obtaining verified consent from parents or lawful guardians.
• Cozmic strictly prohibits any automated tracking, profiling, or behavioral monitoring of minors on the platform.
• No targeted advertising or marketing content is served to minors using our applications.

13. Changes to this Privacy Policy

We reserves the right to amend this Privacy Policy to ensure alignment with technological updates or regulatory changes under the DPDP Act, 2023. Material changes will be communicated via institutional administrator circulars, portal banners, or email alerts at least 30 days prior to the implementation of the updated policy.

14. Contact & Grievance Officer details

In accordance with Rule 3(11) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, the details of the designated Grievance Officer are provided below: