Privacy Policy

1. Who we are and what this policy covers

1.1 Us. The Path Saathi platform is operated by Path Saathi Private Limited (CIN U58110MH2026PTC469991), registered office 5th Floor - 501, Interface 11, Off Malad Link Road, Near Malad West, Malad West, Mumbai, Mumbai Suburban, Maharashtra 400064 ("Path Saathi", "we", "us").

1.2 Scope. This Privacy Policy explains how we process the digital personal data of every individual ("you", a "Data Principal") who uses any Path Saathi product. This includes the Centre Operating System, the Learning Platform, the Career Platform, the Startup Platform, our websites and mobile apps, and the shared account, notification, document, payment and reporting services behind them. It also covers personal data we collect offline and later digitise, such as paper admission forms entered at a centre.

1.3 One account, one policy. You have a single Path Saathi identity across all products. This single policy applies to all of them. Where a product or programme processes data in a way not described here, we will give you a specific notice before collecting that data.

2. Our role: Data Fiduciary or Data Processor

The DPDP Act distinguishes between the organisation that decides why and how data is processed (the Data Fiduciary) and the organisation that processes data on its behalf (the Data Processor). Our role depends on how you reach us:

Where we act as a Data Processor, we process your data only under our contract with the Organisation, and the Organisation's privacy notice also applies to you. We will help that Organisation respond to your requests. You may also contact us directly, and we will pass your request on.

3. Personal data we collect

We collect only the personal data that is necessary for the purposes in section 4. What we collect depends on the products you use and the programmes you join.

3.1 Sensitive data. The DPDP Act treats all personal data under one regime, but we apply extra safeguards to data that could cause greater harm if misused: identity numbers, biometric-derived data, photographs used for verification, precise location, financial details, disability status, social category, and all data about children. This data is encrypted, visible only to people whose role requires it, masked on screen by default, and never used for advertising.

4. Why we process your data and on what legal basis

Under the DPDP Act we may process personal data either with your consent (section 6 of the Act) or for certain legitimate uses (section 7 of the Act). The table below sets out our main purposes.

4.1 Consent that means something. Where we rely on consent, we will ask through a clear, stand-alone notice. It will list the data being collected and the specific purpose, and will be available in English and, on request, in any language in the Eighth Schedule to the Constitution of India. We never use pre-ticked boxes. We ask for separate consent for optional purposes, such as promotions or sharing your profile with employers, so that saying "no" to them does not stop you using the core service.

4.2 Withdrawing consent. You can withdraw consent at any time, as easily as you gave it, through your Account settings or by writing to the Data Protection Officer (section 17). Withdrawal does not affect processing already done. It may mean we can no longer provide the related feature; for example, if you withdraw consent to employer matching, we will stop sharing your profile with employers. Once you withdraw, we (and our Data Processors) will stop processing that data and erase it within a reasonable time, unless the law requires us to keep it.

4.3 Consent Managers. Once Consent Managers registered with the Data Protection Board are available, you will be able to give, manage and withdraw your consent to us through them.

5. Children and persons with disabilities

5.1 Who is a child. Under the DPDP Act, a "child" is anyone under 18. Many of our learners in vocational programmes may be under 18.

5.2 Verifiable parental consent. Before processing a child's personal data, we will obtain the verifiable consent of a parent or lawful guardian, using the methods set out in the DPDP Rules. These include checking the parent's identity and age against reliable details already available to us, or against details or a virtual token issued by an authorised entity (for example through DigiLocker). Where a person with a disability has a lawful guardian, we obtain that guardian's verifiable consent in the same way.

5.3 What we never do with children's data. We do not track or monitor children's behaviour, and we do not show targeted advertising to children. The only exception is monitoring permitted by law for their education or safety, as described in section 5.4. We never process children's data in a way likely to harm their well-being.

5.4 Educational and safety purposes. Where we operate as, or on behalf of, an educational institution or vocational training centre, the DPDP Rules allow certain processing of children's data, including limited attendance and location tracking, without separate parental consent. This applies only to the extent necessary for educational activities or for the safety of enrolled children. We rely on this exemption only within those limits, and we tell parents and guardians about it at enrolment.

6. Aadhaar and other identity numbers

We collect Aadhaar only where a government programme or law requires it for eligibility, benefit delivery or verification, and always in line with the Aadhaar Act, 2016 and its regulations. Wherever the law permits, you may give an alternative identity document or offline Aadhaar verification instead. We do not store your full Aadhaar number unless the law allows it. Where storage is permitted, it is kept in a secured vault, and it appears masked (last four digits only) wherever it is displayed. We do not use identity numbers for any purpose other than the one they were collected for.

7. Who we share your data with

We do not sell your personal data. We share it only as described below, and only as much as each purpose requires.

• Your Organisation or programme authority. If you use Path Saathi through a college, employer, training partner or government programme, we share your enrollment, attendance, assessment, certification and placement data with that Organisation or authority, as the programme requires. This includes submitting data to government MIS portals.
• Assessment, certification and awarding bodies , to conduct assessments and issue or verify certificates and skill attestations.
• Employers and recruiters , only when you apply to an opportunity, register for a job drive, or opt in to be discovered by employers. Employers then handle your data as independent Data Fiduciaries.
• Mentors and investors , only when you ask for an introduction through the Startup Platform.
• Certificate verifiers. Anyone you give a certificate link or code to can confirm that it is valid and see the details printed on it.
• Service providers (Data Processors) who process data for us under written contracts that require them to keep it secure and confidential. These include cloud hosting (Amazon Web Services), identity and productivity tools (Microsoft), HR and payroll (Keka), accounting (Tally), payment gateways, SMS, WhatsApp and email providers, video and proctoring tools, and customer support tools.
• Path Saathi group entities , including the entities that operate specific centres under PPP arrangements, for the purposes in this policy.
• Lawful authorities , where required by law, court order or a lawful request.
• A successor business , if we are involved in a merger, acquisition or restructuring, subject to this policy and the law.

8. Where your data is stored and transfers outside India

Your personal data is stored in India, in Amazon Web Services' Hyderabad region (ap-south-2) as our primary location, and its Mumbai region (ap-south-1). Each client Organisation's data is kept in its own separate database and file store. Some service providers may process limited data outside India, for example for email delivery or productivity tools. Any such transfer complies with section 16 of the DPDP Act and any restrictions the Central Government notifies. We will not transfer personal data to any country or territory the Government has restricted.

9. How long we keep your data

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. After that, we erase it or anonymise it irreversibly.

Records of individual attendance and assessments are kept as an unalterable, append-only log, because funding bodies and auditors rely on them. When erasure is required, we either erase these records or de-identify them, while keeping the aggregate records the law requires.

10. How we protect your data

We use reasonable security safeguards, including those required by Rule 6 of the DPDP Rules:

• Encryption of personal data in transit and at rest, with the most sensitive fields (such as identity numbers and bank details) encrypted individually;
• A separate database for each client Organisation, so that data cannot mix between Organisations;
• Role-based and policy-based access controls, so that each person sees only what their role needs, with centre-level scoping by default;
• Masking of sensitive fields on screen, with every reveal logged;
• Tamper-evident audit logs of access and significant actions, kept for at least one year;
• Secrets management, secure development practices, code review, automated testing and vulnerability scanning;
• Written contracts with our Data Processors that impose equivalent safeguards;
• Backups, business continuity plans, and staff training in data protection.

10.1 Personal data breaches. If a personal data breach occurs, we will inform affected Data Principals without delay. We will tell you what happened, the likely consequences, what we are doing about it, and what you can do to protect yourself. We will also report the breach to the Data Protection Board of India within the timelines in the DPDP Rules, including a detailed report within 72 hours of becoming aware of it.

11. Automated decisions and AI

We use automated tools, including AI, to recommend courses and learning paths, identify skill gaps, match candidates with jobs, prioritise enquiries, and flag operational issues such as bottlenecks. These tools support human decisions. Admission, assessment results, certification and hiring decisions are not made solely by an automated system without human oversight. We do not use children's data for profiling or targeted advertising. You can ask for a human to review any automated output about you. How we use data to train AI models is explained in section 12.

12. Using data to develop and train AI models

We use AI to make the platform more useful: better course recommendations, fairer skill assessment, more accurate job matching, and earlier warnings about operational problems. To build and improve these models, we may use data from the platform to train, fine-tune, evaluate and test AI models. These include models we build ourselves and models from third-party providers that we adapt for our Services. This section explains the strict rules we follow.

12.1 Anonymised data first. Wherever possible, we train on data that has been anonymised, meaning it has been irreversibly processed so that no individual can be identified from it, even by combining it with other data. Examples include aggregated attendance patterns, de-identified assessment responses, and course-completion statistics. Anonymised data is no longer personal data, and we may use it to train our own or third-party models.

12.2 Identifiable data only with your separate consent. We use personal data that identifies you, or could reasonably identify you, for AI training only if you give separate, optional consent for this specific purpose.

• The consent request will be separate from your other consents. It will explain the types of data involved and whether they may be used with third-party model providers.
• Refusing this consent will never affect your admission, learning, assessment, certificate, job applications or any other Service.
• You can withdraw consent at any time in Account → Privacy → AI training. We will then stop using your data in any new training. Where it is technically feasible, we will also remove your data from training datasets that we hold. Models that have already been trained may not be able to "forget" individual data, so we minimise and de-identify data before training to limit any lasting effect.

12.3 Data we never use for AI training. Whatever consent is given, we do not use the following to train AI models:

• Personal data of children (anyone under 18), or of persons with disabilities processed with a guardian's consent;
• Aadhaar numbers and other identity numbers , and identity document images;
• Biometric data , face images used for attendance or identity verification, and precise location traces;
• Bank, card and payment details ;
• Social category, disability, income and health information ; and
• The content of private messages, grievances and support tickets, except in de-identified form to improve support tools.

12.4 Third-party AI providers. When we use third-party AI services to run or improve our features:

• They act as our Data Processors under written contracts;
• They may process data only to provide the service to us; and
• They may not use our users' personal data to train their own general-purpose models, unless you have specifically consented to that as described in section 12.2 and the provider has agreed to our safeguards.

We may share anonymised datasets with third parties for model training and research.

12.5 Data processed for Organisations. Where we act as a Data Processor for an Organisation, such as a college, employer, white-label client or government programme, we use that data for AI training only if the Organisation's agreement with us permits it, and always within the limits of this section.

12.6 Safeguards. Training datasets are minimised, pseudonymised or anonymised before use, stored in India under the same security controls as the rest of the platform, access-controlled and logged. We test models for bias, particularly bias by gender, region, language, caste or disability in assessment and job-matching models, and keep records of the datasets used to train each model.

13. Cookies and similar technologies

Our websites and apps use cookies, local storage and SDKs to keep you signed in, remember your preferences, keep the service secure, and understand how features are used. Essential cookies are needed for the service to work. We use analytics or marketing cookies only with your consent, which you can change at any time in the cookie settings.

14. Your rights

Under the DPDP Act, you have the right to:

• Access information: get a summary of the personal data we process about you, the processing activities, and the identities of the other Data Fiduciaries and Data Processors we have shared it with, together with a description of the data shared.
• Correction, completion and updating: have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated.
• Erasure: have your data erased when it is no longer needed for the purpose, or when you withdraw consent, unless the law requires us to keep it.
• Withdraw consent at any time (section 4.2).
• Grievance redressal: raise a grievance with us and get a response (section 15).
• Nominate: nominate another person to exercise your rights if you die or become incapable of doing so.

14.1 How to exercise your rights. Use the privacy settings in your Account, or write to the Data Protection Officer (section 17). We may need to verify your identity before acting. We will respond as soon as possible and in any case within the time allowed by the DPDP Rules (no more than 90 days). Exercising your rights is free.

14.2 If we are a Data Processor for your Organisation , we will pass your request to that Organisation and help it respond.

14.3 Your duties. The DPDP Act also asks Data Principals to follow applicable laws when exercising their rights, not to impersonate others, not to hide material information when providing data for government documents or benefits, not to file false or frivolous grievances, and to provide only verifiably authentic information when requesting correction or erasure.

15. Grievances and complaints

If you have a concern about how we handle your personal data, contact our Data Protection Officer (section 17). We will acknowledge your grievance promptly and resolve it within the time allowed by the DPDP Rules (no more than 90 days). If you are not satisfied with our response, you can complain to the Data Protection Board of India, after first using our grievance process as the DPDP Act requires.

16. Changes to this policy

We will update this policy when our processing changes or the law requires it. We will notify you of material changes through the Services or by email or SMS before they take effect. Where a change needs fresh consent, we will ask for it. The version number and effective date at the top show the current version, and previous versions are available on request.

17. Contact us: Data Protection Officer

For privacy questions, requests to exercise your rights, or grievances:

• Data Protection Officer / authorised contact person: K Naveen Kumar
• Email: hello@pathsaathi.com
• Phone: +91-7032534144
• Post: Data Protection Officer, Path Saathi Private Limited, 5th Floor - 501, Interface 11, Off Malad Link Road, Near Malad West, Malad West, Mumbai, Mumbai Suburban, Maharashtra 400064
• In-app: Account → Privacy → My data requests

This policy is available in English and, on request, in any language in the Eighth Schedule to the Constitution of India.