Privacy Policy

This Privacy Policy explains how Pinnacle Institute Of Software Tech Solutions ("Pinnacle," "we," "us," or "our") collects, uses, discloses, stores, and protects your personal data when you access or use our website and services.

1. About This Policy

This Privacy Policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) of India, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. This policy applies to all individuals ("you," "your," or "Data Principal") who visit our website at https://pinnaclehtd.vercel.app, use our services, or otherwise provide personal data to us.

By accessing our website or submitting your personal data through our contact form or any other means, you consent to the collection, processing, and use of your data as described in this Privacy Policy. If you do not agree with any part of this policy, please do not use our website or services.

2. Data Fiduciary Information

For the purposes of the DPDPA 2023, Pinnacle Institute Of Software Tech Solutions is the Data Fiduciary responsible for processing your personal data.

3. Personal Data We Collect

We collect personal data that you voluntarily provide to us when you interact with our website, submit enquiries, or register for our programs. The categories of personal data we collect include:

Data Category	Specific Data Points	Collection Method
Identity Data	Full name	Contact form
Contact Data	Email address, phone number	Contact form
Educational Data	Qualification (e.g., 12th pass, graduate, post-graduate)	Contact form
Interest Data	Category of interest (e.g., Placement, Training, Hiring Partners)	Contact form dropdown
Communication Data	Free-text message or enquiry content	Contact form textarea
Technical Data	IP address, browser type, device information, access timestamps	Automatically via server logs

We do not collect any sensitive personal data as defined under the DPDPA 2023, including but not limited to financial data, biometric data, health data, sexual orientation, political opinions, religious beliefs, or genetic data.

4. Purpose of Data Collection

We collect and process your personal data for the following specific, lawful purposes:

1. Service Delivery: To respond to your enquiries, process your applications, and facilitate your enrollment in our training programs.
2. Communication: To contact you via phone call, email, or messaging services regarding your enquiry, application status, program updates, and placement opportunities.
3. Placement Services: To match your profile with suitable employment opportunities with our hiring partners and facilitate job placement.
4. Record Keeping: To maintain internal records of enquiries, enrollments, training progress, and placement outcomes for operational and administrative purposes.
5. Legal Compliance: To comply with applicable laws, regulations, and legal obligations, including responding to lawful requests from government authorities.
6. Website Improvement: To analyze website usage patterns (through aggregated, anonymized data) to improve our website's performance, functionality, and user experience.
7. Dispute Resolution: To establish, exercise, or defend legal claims and resolve disputes.

We will not process your personal data for any purpose other than those stated above without obtaining your prior consent, unless otherwise permitted by applicable law.

5. Legal Basis for Processing

Under the DPDPA 2023, we process your personal data on the following legal bases:

• Consent: When you voluntarily submit your data through our contact form, you provide explicit consent for us to process your data for the stated purposes. You may withdraw your consent at any time by contacting us.
• Legitimate Uses: Processing necessary for compliance with any law or court order, or in connection with legal proceedings.
• Contractual Necessity: Processing necessary for the performance of a contract to which you are a party, such as your enrollment agreement for our training programs.

6. Data Storage and Security

6.1 Storage Infrastructure

Your personal data is stored securely using the following infrastructure:

• Primary Database: Google Firebase (Cloud Firestore), operated by Google LLC. Data is stored on Google's secure cloud infrastructure, which maintains industry-leading security certifications including ISO 27001, SOC 1/2/3, and is compliant with global data protection standards.
• Website Hosting: Vercel Inc. Our website is hosted on Vercel's edge network. Vercel may process limited technical data (such as IP addresses and request logs) as part of its hosting services.

6.2 Security Measures

We implement reasonable security safeguards to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols (HTTPS).
• Access controls restricting data access to authorized personnel only.
• Firebase Security Rules governing database read/write access.
• Regular review of data access patterns and security configurations.
• Use of secure, authenticated connections to third-party services.

6.3 Data Retention

We retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. Specifically:

• Enquiry Data: Retained for a period of up to 3 (three) years from the date of submission, or until you request deletion, whichever is earlier.
• Enrollment and Training Data: Retained for the duration of your training program and for a period of 5 (five) years thereafter for record-keeping, audit, and placement verification purposes.
• Technical/Log Data: Retained for up to 12 (twelve) months for security monitoring and analytics purposes, after which it is automatically purged or anonymized.

Upon expiry of the retention period, or upon a valid deletion request, your personal data will be securely deleted or irreversibly anonymized within 30 (thirty) days.

7. Third-Party Services and Data Sharing

We may share your personal data with the following categories of third-party service providers, strictly for the purposes outlined in this policy:

Third-Party	Purpose	Data Shared	Privacy Policy
Google LLC (Firebase)	Database storage and backend services	All form submission data	Google Privacy Policy
Vercel Inc.	Website hosting and content delivery	Technical data (IP, request logs)	Vercel Privacy Policy

We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. We may disclose your personal data if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to:

• Comply with a legal obligation or lawful request.
• Protect and defend the rights or property of Pinnacle Institute.
• Prevent fraud or investigate potential violations of our Terms of Service.
• Protect the personal safety of users or the public.

When sharing data with hiring partners for placement purposes, we will share only the information necessary for the placement process (such as your name, qualification, and training details) and only with your explicit consent.

8. Cookies and Tracking Technologies

8.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They help the website recognize your device and store certain information about your preferences or past actions.

8.2 Cookies We Use

Our website may use the following types of cookies:

• Essential Cookies: Necessary for the basic functioning of the website, such as maintaining session state and security features. These cookies do not require your consent as they are strictly necessary.
• Analytics Cookies: Used by third-party services (such as Vercel Analytics, if enabled) to collect aggregated, anonymized data about website usage, page views, and performance. These help us understand how visitors interact with our website.
• Third-Party Cookies: Our use of Firebase and Vercel may result in cookies being set by these services for authentication, performance monitoring, or analytics purposes. Please refer to their respective privacy policies for details.

8.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling essential cookies may affect the functionality of our website. To manage cookies, consult your browser's help documentation or visit www.aboutcookies.org for general information.

9. Your Rights as a Data Principal

Under the DPDPA 2023 and applicable Indian law, you have the following rights with respect to your personal data:

1. Right to Access: You have the right to obtain confirmation as to whether your personal data is being processed and to access a summary of your personal data and the processing activities related to it.
2. Right to Correction: You have the right to request correction of any inaccurate or incomplete personal data that we hold about you. We will take reasonable steps to verify and correct the data promptly.
3. Right to Erasure: You have the right to request the deletion of your personal data when it is no longer necessary for the purpose for which it was collected, or when you withdraw your consent. This right is subject to any legal retention obligations.
4. Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal.
5. Right to Grievance Redressal: You have the right to register a complaint or grievance regarding the processing of your personal data. We will acknowledge your grievance and respond within the timeframe prescribed by law.
6. Right to Nominate: You have the right to nominate another individual to exercise your rights in the event of your death or incapacity, as provided under the DPDPA 2023.

To exercise any of these rights, please contact us using the details provided in the "Contact Us" section below. We will respond to your request within 30 (thirty) days of receipt. We may request verification of your identity before processing your request to ensure the security of your data.

10. Data of Children

Our services are intended for individuals who are at least 18 years of age. We do not knowingly collect personal data from children under the age of 18 without verifiable consent from a parent or legal guardian. If we become aware that we have collected personal data from a child without appropriate consent, we will take immediate steps to delete such data. If you believe that a child has provided us with personal data without parental consent, please contact us immediately.

11. Cross-Border Data Transfers

Your personal data may be transferred to and stored on servers located outside India, as our third-party service providers (Google LLC and Vercel Inc.) operate global infrastructure. Such transfers are conducted in compliance with the DPDPA 2023 and are subject to the data protection standards maintained by these service providers. By using our website and providing your data, you consent to such cross-border transfers. We will ensure that any transfer of personal data is carried out in accordance with applicable data protection laws and that appropriate safeguards are in place.

12. Data Breach Notification

In the event of a personal data breach that is likely to cause harm to you, we will:

• Notify the Data Protection Board of India as required under the DPDPA 2023.
• Notify you, the affected Data Principal, of the breach and its potential impact.
• Take immediate remedial measures to contain and mitigate the breach.
• Provide information about the nature of the breach, the data affected, and the steps taken to address it.

Notifications will be made without unreasonable delay and in accordance with the timelines prescribed by the Data Protection Board of India.

13. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be effective immediately upon posting the revised policy on our website with an updated "Last Updated" date. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website and services after any changes to this policy constitutes your acceptance of the revised policy.

14. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the name and contact details of the Grievance Officer are as follows:

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:

16. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of India, including but not limited to the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the rules and regulations made thereunder. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Bangalore, Karnataka, India.