Privacy Policy & Data Protection

Rudram Softech Pvt. Ltd. (operating as "Rudram Softech", "We", "Us", or "Our") is dedicated to protecting the fundamental privacy rights and data sovereignty of all individuals. This Global Privacy Policy governs all processing activities across our corporate website (rudramsoftech.com), customer portals, demonstration sandboxes, APIs, and our entire enterprise software suite, including EduSec (Higher Education ERP), VheTM (Training Management Platform), Rudram CRM, Rudram Accounting, Rudram Invoice, and Rudram Payroll & HRMS.

Under international data protection legislation, we operate in two distinct legal capacities:

• Rudram Softech as a Data Controller / Data Fiduciary: We act as a Data Controller (under EU/UK GDPR Article 4(7)) or Data Fiduciary (under the Indian DPDP Act, 2023 Section 2(i)) for personal data gathered directly from visitors to our website, sales and demo inquirers, job applicants, and commercial signatories for subscription contracting and invoicing.
• Rudram Softech as a Data Processor / Service Provider: When universities, colleges, training academies, or enterprises deploy our software platforms, the client organization is the primary Data Controller / Data Fiduciary. In this capacity, Rudram Softech acts strictly as a Data Processor (under GDPR Article 28) or Service Provider (under US CCPA), processing institutional, student, faculty, and employee records solely on the documented instructions of the client pursuant to our Master Services Agreement and Data Processing Addendum (DPA).

We collect personal data strictly in a proportionate, transparent, and purposeful manner:

Under the Indian DPDP Act, 2023 (Sections 4, 6, and 7), EU/UK GDPR (Article 6), and global privacy frameworks, we process personal data exclusively under verified lawful grounds:

• Contractual Performance: To provision ERP tenant instances, fulfill technical support SLAs, configure database schemas, and process recurring subscriptions;
• Explicit Consent: Where you provide voluntary, specific, informed, and unambiguous consent (such as subscribing to technical whitepapers or newsletters). Consent may be withdrawn at any time without detriment;
• Legitimate Business Interests: To detect and thwart cyber threats, prevent fraudulent transactions, analyze system availability, and enhance application performance, balanced strictly against individual fundamental privacy rights; and
• Legal & Regulatory Compliance: To comply with statutory tax rules (GST/Income Tax filings), lawful court orders, and mandatory cybersecurity incident directives issued by authorities (such as CERT-In).

Pursuant to the California Consumer Privacy Act (CCPA) as amended by the CPRA, we state unequivocally: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Because our flagship platforms EduSec and VheTM power universities, colleges, schools, and academies globally, we maintain specialized protocols regarding student personal records:

• Minors under the DPDP Act 2023: In compliance with Section 9 of the Indian DPDP Act, 2023, personal data of individuals under eighteen (18) years of age is processed solely with verifiable parental or institutional consent, and we never undertake targeted tracking, behavioral monitoring, or directed advertising targeting minors;
• FERPA & COPPA Alignment: For clients operating in or enrolling students from the United States, Rudram Softech acts as an authorized "School Official" under the Family Educational Rights and Privacy Act (FERPA, 34 CFR § 99.31) with legitimate educational interests, maintaining student education records under the direct institutional control of the contracting school or university; and
• Strict Institutional Sovereignty: Student records are isolated in segregated database schemas or encrypted multi-tenant partitions accessible solely to authorized school administrators, teachers, and verified student/parent portals.

Rudram Softech enforces comprehensive Technical and Organizational Measures aligned with Rule 8 of the Information Technology (SPDI) Rules 2011, Section 8 of the DPDP Act 2023, and Article 32 of GDPR:

• Encryption in Transit: All HTTP traffic is secured via Transport Layer Security (TLS 1.3 / TLS 1.2) utilizing modern cipher suites with HSTS enforced;
• Encryption at Rest: Core database volumes, encrypted snapshots, and document attachments are protected using Advanced Encryption Standard (AES-256) encryption;
• Access Control & Authentication: Role-Based Access Control (RBAC), multi-factor authentication (MFA) on administrative portals, and bcrypt cryptographic password hashing with adaptive salt rounds;
• Application Security: Built-in defenses against OWASP Top 10 vulnerabilities, including prepared parameter-bound SQL statements (preventing SQL injection), CSRF verification tokens on all mutating POST requests, and strict XSS output encoding;
• DDoS & Edge Protection: Edge security, automated Web Application Firewall (WAF) filtering, and volumetric DDoS defense managed through enterprise Cloudflare infrastructure; and
• Hosting Environment: Hosted in world-class Tier-4 datacenter facilities provided by Amazon Web Services (AWS) featuring biometric facility access, redundant power arrays, and continuous environmental monitoring.

As a global enterprise software company, Rudram Softech headquarters are located in India, while cloud infrastructure may be provisioned in regions designated by enterprise clients (including India, the European Union, and North America):

• Transfers from the European Union / UK: When personal data originating in the European Economic Area (EEA) or United Kingdom is accessed or processed by our engineering teams in India, such transfers are governed by the European Commission's approved Standard Contractual Clauses (SCCs) (Controller-to-Processor / Processor-to-Processor modules) pursuant to Article 46(2)(c) of GDPR, supplemented by the UK International Data Transfer Addendum (IDTA);
• Indian DPDP Act Cross-Border Transfer: Transfers of personal data outside India comply strictly with Section 16 of the DPDP Act, 2023 and notifications issued by the Central Government; and
• Enterprise Regional Residency: For institutional clients requiring complete geographic data residency, we provide dedicated cloud deployments residing entirely within their chosen national borders.

We retain personal information only for the duration strictly necessary to fulfill the operational purposes for which it was gathered:

• Website Inquiries & Marketing: Retained for twenty-four (24) months following your last active engagement, or until you exercise your right to unsubscribe or withdraw consent;
• Active ERP Customer Data: Retained for the duration of the contracted Subscription Term. Upon contract termination, data remains available for extraction for thirty (30) days, after which it is irreversibly purged;
• Statutory Financial Records: Invoices, transaction vouchers, and GST tax filings are preserved for seven (7) years to comply with statutory accounting and tax audits under Indian and international company law; and
• Sanitization Method: All hardware or logical storage deletions adhere to NIST SP 800-88 Rev. 1 Guidelines for Media Sanitization (Cryptographic Erase / Overwrite).

Regardless of your physical location, Rudram Softech honors comprehensive legal privacy rights across global jurisdictions:

* To exercise any right regarding institutional student or employee records where Rudram Softech serves as a Data Processor, please direct your request directly to your university or employer. For direct website or marketing data, contact our Data Rights Desk at info@rudramsoftech.com.

This section applies to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy legislation:

• Non-Discrimination Covenant: We will never discriminate against you (by denying goods, charging differential rates, or lowering quality) for exercising any privacy right under applicable state law;
• California Shine the Light: Under California Civil Code § 1798.83, California residents may request information regarding our disclosure of personal information to third parties for direct marketing purposes. We confirm we do not disclose personal information to third parties for their direct marketing purposes; and
• Authorized Agent: You may designate an authorized agent registered with the Secretary of State to submit CCPA requests on your behalf, accompanied by verified written authorization.

We engage carefully audited third-party service providers who adhere to strict data processing agreements:

Our website uses strictly limited cookie technologies:

• Strictly Necessary Cookies: Cryptographic PHP session cookies (`PHPSESSID`) and anti-tampering CSRF tokens (`_csrf`) essential to secure form submissions and maintain active logins;
• Security Telemetry: Cloudflare edge security cookies used exclusively for bot mitigation and challenge validation; and
• Analytics: Aggregated, privacy-respecting website metrics to evaluate navigation flow without storing intrusive third-party cross-site advertising cookies. You may disable cookies via your browser preferences without losing access to public pages.