Privacy Policy

IndiHacks Privacy Policy (Full, with Additions Marked)

Operated by ACIC-VGU Foundation

Effective Date: 11th August 2026 | Last Updated: August 2026

DRAFT FOR LEGAL REVIEW: This is a working draft prepared for ACIC-VGU Foundation's IndiHacks platform, refined for alignment with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025, and structured to also read cleanly for participants and sponsors elsewhere in Asia. Fields in [brackets] must be completed, and the document must be reviewed and signed off by a qualified lawyer before publishing — nothing below should be treated as legal advice.

1. Introduction

This Privacy Policy explains how ACIC-VGU Foundation ("ACIC-VGU Foundation," "we," "us," or "our"), the operator of the IndiHacks platform ("IndiHacks," the "Platform," accessible at indihacks.com), collects, uses, discloses, and protects information when you use the Platform as a participant, team member, mentor, judge, organizer, or visitor (collectively, "Users," "you").

ACIC-VGU Foundation operates an Atal Community Innovation Centre (ACIC) under NITI Aayog's Atal Innovation Mission (AIM), based at Vivekananda Global University (VGU), Jaipur, Rajasthan, India. Our registered address is VGU CAMPUS, SECTOR 36, NRI ROAD, JAGATPURA, JAIPUR, JAIPUR, RAJASTHAN, INDIA, 302025, and we can be reached at info@acicvgu.com / 9001792930, 9001792931.

Under the DPDP Act, we act as the "Data Fiduciary" for personal data processed through the Platform, and you (as a Data Principal) hold the rights described in Section 8.

By accessing or using IndiHacks, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Information you provide directly

Account details: name, email address, phone number, password, profile photo

Identity/eligibility details: date of birth or age confirmation, institution/college/company name, student/employment status, city and country of residence

Government or institutional identifiers where required for prize disbursement, compliance, or partner reporting (e.g., PAN, bank account details, and, where offered as an optional verification method, Aadhaar/DigiLocker-based identity verification,) — collected only when necessary and only from prize-winning participants or organizations, and processed as "sensitive personal data" with additional safeguards

Team information: teammates, team name, roles

Hackathon submissions: project title, description, source code/repository links, demo videos, presentation decks, screenshots, and any other content you upload

Communications: messages sent to us via contact forms, support requests, or event communications

Payment information, where hackathons involve paid registration, sponsor billing, or prize disbursement (processed via third-party payment processors — we do not store full card details)

Consent records: where we rely on your consent as the legal basis for processing (e.g., marketing communications, optional verification), we log what you consented to and when, as required under the DPDP Act

2.2 Information collected automatically

Device and usage data: IP address, browser type, operating system, pages visited, referring URLs, timestamps

Cookies and similar technologies (see Section 6)

Approximate location derived from IP address, for event/timezone relevance

2.3 Information from third parties

If you sign in using Google, GitHub, or a similar third-party account, we receive basic profile information (name, email, profile photo) as permitted by your settings on that service

Information provided by hackathon organizers or sponsors where you register through a partner-managed event

3. How We Use Your Information

To create and manage your account and participant profile

To register you for hackathons, form or manage teams, and facilitate submissions

To operate judging, scoring, leaderboards, and to announce and disburse prizes, including deducting and remitting tax at source (TDS) on cash prizes as required under Indian tax law

To communicate with you about events, deadlines, results, and platform updates, including via email and WhatsApp/SMS where you have provided a phone number for this purpose

To personalize your experience (e.g., recommending relevant hackathons)

To maintain platform security, detect fraud, and prevent abuse

To comply with legal, regulatory, tax, and institutional reporting obligations, including those connected to NITI Aayog / Atal Innovation Mission reporting where applicable

To analyze usage and improve the Platform

For marketing communications about future hackathons and programs, where you have consented or as otherwise permitted by law (you may opt out, or withdraw consent, at any time — withdrawal does not affect processing carried out before withdrawal)

4. How We Share Your Information

We do not sell your personal data. We may share information in the following circumstances:

With hackathon organizers and sponsors: for events you register for, so they can evaluate submissions, coordinate logistics, and contact eligible participants (e.g., for internships, job opportunities, or prize fulfillment).

With judges and mentors: limited information necessary to review and score your submission.

With service providers: third parties that help us operate the Platform, such as cloud hosting, email delivery, analytics, and payment processing providers, under confidentiality and data protection obligations. Where such providers act as our "Data Processors" under the DPDP Act, they are bound by written agreements consistent with our obligations under the Act.

Cross-border transfers: some service providers may process data outside India. The DPDP Act permits cross-border transfer of personal data except to countries specifically restricted by the Central Government; we will update this section to name transfer destinations once our hosting/vendor stack is finalized.

For legal reasons: where required by applicable law, regulation, legal process, or governmental request (including the Data Protection Board of India), or to protect the rights, property, or safety of ACIC-VGU Foundation, our Users, or the public.

Business transfers: in connection with a merger, restructuring, or transfer of the Platform's operations, subject to standard confidentiality protections.

With your consent: for any other purpose disclosed to you at the time of collection.

Publicly visible information: certain information — such as your name, team name, project title, and public project submissions — may be displayed publicly on the Platform (e.g., in a hackathon gallery or leaderboard) as part of the normal operation of the service.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by law, consistent with the DPDP Act's storage-limitation principle, including to comply with legal, accounting, or reporting obligations (including AIM/NITI Aayog program reporting requirements where applicable). Hackathon submissions and public project showcases may be retained indefinitely for portfolio and historical archive purposes unless you request removal, subject to Section 8. [Add specific retention periods per data category once finalized, e.g., account data retained until account deletion + X days; KYC/tax records retained for the statutory period under Indian tax law.]

6. Cookies and Tracking Technologies

IndiHacks uses cookies and similar technologies to keep you logged in, remember preferences, and understand how the Platform is used. You can control cookies through your browser settings; disabling cookies may limit certain features of the Platform. [Add specifics once a cookie/analytics tool such as Google Analytics is finalized — name the tool(s) and provide an opt-out mechanism.]

7. Data Security

We implement reasonable technical and organizational security measures, consistent with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023, to protect your information from unauthorized access, alteration, disclosure, or destruction. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Users as required under the DPDP Act and Rules. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Subject to applicable law, as a Data Principal under the DPDP Act, you may have the right to:

Access the personal data we hold about you, and a summary of how it is being processed

Correct, update, or complete inaccurate or incomplete data

Request erasure of your personal data, subject to legal and legitimate business retention needs

Withdraw consent for any consent-based processing (e.g., marketing communications) at any time, as easily as consent was given

Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, as provided under the DPDP Act

Raise a grievance regarding the handling of your personal data, and subsequently approach the Data Protection Board of India if unresolved

To exercise these rights, contact our Grievance Officer using the details in Section 12. We aim to respond to verified requests within the timelines prescribed under the DPDP Rules.

9. Children's Privacy

IndiHacks is intended for users who are at least [13/16/18 — confirm minimum age, noting that under 18 triggers the DPDP Act's child-data obligations] years old. Under the DPDP Act, any individual below 18 years of age is treated as a "child," and processing a child's personal data requires verifiable parental or lawful-guardian consent. Where a hackathon is designed for school-age participants below this age, we require verifiable consent from a parent or guardian, or registration through the participant's school/institution, before collecting personal data from the minor, and we will not undertake behavioural monitoring, tracking, or targeted advertising directed at children. Please confirm event-specific age policies with organizers.

10. Third-Party Links

The Platform may contain links to third-party websites (e.g., sponsor pages, GitHub repositories, payment gateways). We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Platform or by email. Continued use of IndiHacks after changes take effect constitutes acceptance of the revised Policy.

12. Contact Us / Grievance Officer

In accordance with the Information Technology Rules, 2021 and the DPDP Act, for any questions, requests, or grievances regarding this Privacy Policy or your personal data, please contact:

ACIC-VGU Foundation

Address: VGU CAMPUS, SECTOR 36, NRI ROAD, JAGATPURA, JAIPUR, JAIPUR, RAJASTHAN, INDIA, 302025

Email: info@acicvgu.com

Phone: 9001792930, 9001792931

If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India through the process it prescribes.