This notice explains who is responsible for your personal data when you sign in to an organization's apps on this platform, and what happens to your account when you leave or delete it. It is given under India's Digital Personal Data Protection Act 2023 (DPDP Act) and the Digital Personal Data Protection Rules 2025 (DPDP Rules).
1. Your organization is responsible for your data
The organization whose apps you use (your employer, or the company whose website or app you signed up to) is the Data Fiduciary for your personal data, including your sign-in. Its own privacy notice applies, and is linked from its sign-in page.
Centre for Advanced Practical Project Management (“CAPPM”, “we”) runs the sign-in and the apps as that organization's Data Processor. We process your data only on its instructions, and do not use it for any purpose of our own.
2. If you use more than one organization
You have one sign-in for every organization you use. Each organization is responsible for your account within its own apps, and what one organization does (removing you, say) does not affect the others. We keep your sign-in only while at least one organization uses it.
3. Your rights
To see, correct or erase your data, or to raise a grievance, contact your organization: its privacy notice gives its contact and grievance officer. If you contact us instead, we pass your request to the organization (or each organization concerned) within 3 working days and help it answer. You can see and correct your account details on your account page, and you may complain to the Data Protection Board of India.
4. Deleting your account
Your organizations have asked us to let you delete your account yourself, from your account page. The deletion takes effect 14 days later; you can cancel until then. Each organization you belong to is told on the day you ask. When it takes effect, you are removed from every organization and your account is erased: your sign-in, sessions, security keys and authenticators, memberships, and your records in the platform's apps.
On your organizations' behalf, we keep only the following:
| What | How long | Why |
|---|---|---|
| A minimal security record (your account identifier, the organizations and roles you had, your recent sessions with device and IP address, the dates your account was created, asked to be deleted and erased, and any reason you gave), and the access logs of your account | One year, then deleted | To detect and investigate unauthorised access, as the law requires (DPDP Rules 2025, Rule 6(1)(e) and Rule 8(3) read with the Seventh Schedule). Kept in an isolated store only our security staff can read. |
| Copies in our backups | Up to 35 days | Backups expire on that cycle; if one is ever restored, your account is erased again. |
Records an organization keeps about you are its own, under its own retention rules. Your employer may keep its employment and payroll records about you for the purposes of employment (DPDP Act, Section 7(i)) and as Indian tax and labour laws require (Section 8(7)(b)); ask it about them.
5. Leaving an organization, or being removed
Leaving an organization, or being removed from it, ends your access to it and its apps. If you then belong to no organization and no app, your account is erased 14 days later, as in section 4; we tell you by email first, and nothing is erased if you join an organization again in the meantime.
6. If your organization's domain is no longer verified
If your organization stops proving that it controls the domain of your email address, your access to that organization may be suspended until it proves it again or moves your account to another address. Your account and data are not deleted for this reason, and your access to other organizations is not affected.
7. If an organization you belong to is deleted
We tell you 30 days before an organization you belong to is deleted, and on the day. Its data, including any employee records about you, is deleted and cannot be recovered. If you belong to no other organization, your account is erased too.
8. Changes
We may update this Privacy Notice from time to time. When we make material changes, we will update the effective date below and notify you by email or through your account page.
Effective 27 October 2026.