What personal data CampusDex collects, why we collect it, who it reaches, and the rights you have over it.
Version 0.1-draft · Effective: Not yet in force
This document is not final. The sections below are structure only — the notes under each heading describe what the finished clause has to say. Nothing here has been reviewed by a lawyer and none of it is binding yet.
Name the operating entity as the Data Fiduciary under the DPDP Act, with its registered address and contact. Make clear that CampusDex, not the college, decides how student data is processed on this platform.
Identity: full name, roll number, username, email, mobile number, avatar and banner images, college, department, course, year, semester and batch. Participation: event registrations, attendance timestamps, volunteer applications and their outcome, feedback, poll votes and team membership. Derived: XP, level, rank tier, reputation, streaks, wallet balance, coin transactions, badges and achievements. Activity: sign-in history, device sessions and in-app activity logs, including records of profile views. Device: web push subscription endpoints tied to a specific browser.
List each purpose separately rather than bundling them into one blanket consent — the DPDP Act requires itemised purposes. Separate the operational purposes (running events, recording attendance, issuing certificates) from the optional ones (leaderboards, notifications, analytics).
Explain what consent is taken at signup, how a student withdraws it, and what stops working when they do. Note which processing continues on a legal or contractual basis after withdrawal, such as attendance records an institution must retain.
Name every processor and its role: Supabase (database and authentication), Cloudflare (hosting), ImageKit (image storage and delivery), Google Gemini (AI event report generation), Resend via Supabase (email delivery) and web push services (browser notifications). Also state that event organisers and administrators can see participant contact details and export them.
Identify which processors store or handle data outside India, and the basis for those transfers. The AI report generator sends participant names, departments and roll numbers abroad.
State a retention period for each category, including activity and audit logs, and what happens on account closure. The DPDP Act expects erasure once the purpose is served, so name a window you can actually enforce.
Access, correction, erasure, grievance redressal, and nomination — the right to name someone to exercise these rights on your behalf if you die or become incapacitated. Describe how to exercise each one and the response time.
Explain how accounts belonging to users under 18 are handled, how parental consent is obtained and verified, and confirm that behavioural tracking and targeted advertising are not carried out for those accounts.
Describe the security measures in plain terms: encrypted transport, access controls, row-level database policies, audit logging, and how a personal data breach is reported to the Data Protection Board and to affected users.
List what is stored in the browser — session cookies, theme preference, push subscription state — what each is for, and how to clear them.
Describe how changes are announced and where the version history lives.
Publish the Grievance Officer’s name, email and postal address here as well as on the Grievance Redressal page, with the 24-hour acknowledgement and 15-day resolution commitment.
Questions about this document: campusdex1@gmail.com