Shittal's Institute of Fashion (SIF)

At Shittal's Institute of Fashion (SIF) (“we”, “our”, or “us”), having its registered academy at Aaroha Dwelling, Ambegaon Bk, Pune - 411046, Maharashtra, India, we are committed to safeguarding the privacy, confidentiality, and security of our students, alumni, and platform visitors in full compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India) and applicable information technology regulations.

1Categories of Personal Data We Collect

We collect and process only the personal data strictly required to deliver our educational programs, facilitate alumni designer portfolios, process financial payouts, and secure our intellectual property:

Personal Identity & Profile Data: Full Name, Legal Name, Email Address, Contact Phone/WhatsApp number, Age Confirmation Status (18+ self-attestation boolean isAdult and timestamp ageConfirmedAt; SIF does not collect or store Date of Birth or Gender), sewing experience level, sewing machine type, and shipping address for physical toolkits.
WhatsApp Messaging & Consent Records: Mobile telephone number, opt-in timestamps, verification state/source (e.g., explicit checkbox consent during account creation, admission inquiries, or student support requests), delivery receipts, and opt-out preferences.
Alumni & Designer Network Data: For students joining the SIF Alumni Network or Designer Directory, we collect UPI IDs and bank account details (strictly for referral rewards and commission payouts), atelier/boutique name, physical studio address, years of commercial experience, bespoke garment starting prices, and Instagram handles.
Creative Portfolios, Garment Photos & Reviews: Student assignment photographs, capstone garment showcase images, written reviews, video testimonials, and client garments uploaded to our community showcase wall.
Client–Designer Inquiry & Chat Records: Direct 1-on-1 communications between prospective clients and designers on the SIF platform, including client contact numbers, bespoke outfit requirements, target event dates, budget estimates, and attached design sketches/images.
Admissions & Prospectus Inquiries: Applicant name, contact number, email, chosen curriculum stream, learning mode (offline atelier vs. online), personal background, statement of purpose, and 18+ age self-attestation status.
Academic Progress & Autonomous Certifications: Course video timestamps, lesson completion percentages, quiz scores, assignment grading records, and cryptographically verifiable certificate serial numbers with QR hashes.
Transactional & Financial Records: Razorpay order IDs, payment gateway transaction references, GST-compliant tax invoices, and coupon/referral redemption records. (Note: We do NOT collect or store raw payment card numbers or UPI PINs; all payments are processed directly through RBI-authorized payment aggregators via 256-bit SSL encryption).
Security, Device & Forensic Logs: IP address, device session tokens (for our Anti-Piracy Single-Device Session Lock), browser User-Agent metadata, and dynamic forensic video watermarking hashes (encoding user email and UID to prevent unauthorized screen captures).

Age-Gate & Self-Attestation Notice: SIF operates an age-gate mechanism requiring visitors and applicants to self-attest that they are 18 years of age or older via a mandatory confirmation checkbox (ageConfirmed: true / isAdult: true) prior to account registration, admissions submissions, or support inquiries. SIF does not collect government ID proofs or verified Date of Birth (DOB) records; age verification relies on applicant self-attestation.

2How We Use Your Data

To provide authenticated access to online masterclasses, interactive video lessons, and downloadable 1:1 blueprint slopers.
To verify course completion, evaluate capstone projects, and issue autonomous skill certificates with public verification registry links.
To dispatch physical tailoring starter kits and communicate courier tracking details via WhatsApp, SMS, and Email.
To dispatch automated transactional notifications (enrollment receipts, invoice breakdowns, prospectus delivery, class links) via the official Meta WhatsApp Cloud API.
To process affiliate commissions and referral cash rewards directly to verified alumni UPI IDs or bank accounts.
To power the public SIF Designer Directory, enabling potential clients to discover local graduate ateliers and initiate bespoke tailoring inquiries.
To enforce anti-piracy security measures, detect malicious account sharing, and defend proprietary instructional content under the Indian Copyright Act, 1957.

3Third-Party Data Processors & Cloud Infrastructure

We never sell, rent, or monetize your personal information to third-party data brokers or advertisers. Personal data is shared strictly with essential cloud infrastructure providers, payment aggregators, and communications gateways operating under strict confidentiality and security safeguards:

1. Google Cloud Platform & Firebase (Google LLC): Hosts authentication tokens, student database records (Firestore), and encrypted cloud storage for assignment images, garment photos, and student avatars.

2. Razorpay Software Private Limited: RBI-authorized payment aggregator processing course and membership checkouts. Receives customer email, phone, billing address, order amount, and item details. Handles all card and payment instrument data directly through secure tokenization; SIF systems never receive or store full card numbers, CVVs, or payment credentials.

3. Meta Platforms, Inc. (WhatsApp Cloud API): Dispatches transactional messages, syllabus downloads, and enrollment confirmations. Receives recipient mobile numbers and templated message parameters via Meta's Graph API.

4. Vercel, Inc.: Hosts and serves our web application, serverless functions, and edge network. Processes request headers, client IP addresses, and operational server execution logs.

5. Upstash, Inc.: Provides serverless Redis caching to enforce distributed IP-based rate limiting on the admissions portal to prevent bot abuse and brute-force attacks.

6. Functional Software, Inc. (Sentry): Captures real-time application errors, stack traces, and diagnostic performance metrics to ensure system reliability and uptime.

7. Mux, Inc.: Video infrastructure delivering high-definition video masterclasses with secure, signed HLS streaming tokens and adaptive bitrate delivery.

8. SMTP Email Gateways: Dispatches automated email verification links, password resets, and GST invoices via secure TLS mail servers.

9. Cloudflare, Inc. (Cloudflare Turnstile): Provides privacy-preserving bot detection and CAPTCHA challenge verification on public forms without tracking users across non-Cloudflare sites or placing cross-site behavioral cookies.

10. Google LLC (Google Analytics): Measures aggregated website traffic, engagement metrics, and anonymous interaction patterns to improve educational platform experience, page performance, and course discovery.

4Data Retention Schedules

In alignment with Indian statutory requirements and institutional accreditation needs, we retain personal data according to the following schedules:

Financial, GST & Order Records: Retained for a minimum of 8 years following the end of the relevant financial year, as mandated under Section 128 of the Companies Act, 2013 and the Income Tax Act, 1961.
Student Academic Records & Certificates: Retained indefinitely in our permanent institutional registry to enable students, employers, and clients to verify certificate credentials via QR code verification at any future date.
Student Profiles & Learning Progress: Retained indefinitely to ensure lifelong access to purchased masterclasses, student portfolios, and digital learning assets.
Alumni Directory Profiles & Showcase Submissions: Retained indefinitely as part of the permanent SIF alumni archive and professional designer directory, unless specific de-listing is formally requested.
Direct Client-Designer & Event Chat Logs: Retained indefinitely in the institutional archive for dispute resolution, audit trail verification, and community integrity monitoring.
Admissions Inquiries: Retained for academic counseling records and institutional reporting.

5Your Rights under the Digital Personal Data Protection Act (2023)

As a Data Principal under the DPDP Act, 2023 (India), you have the following enforceable statutory rights:

Right to Access Information: Obtain a summary of personal data being processed by SIF and the identities of third-party processors with whom data has been shared.
Right to Correction & Completion: Request correction of inaccurate personal data, updating of contact numbers, or rectification of names on certificates.
Right to Erasure: Request deletion of your personal account data, subject to mandatory statutory retention requirements for financial invoices and certificate archives.
Right to Grievance Redressal: Submit a grievance to our designated Data Protection Officer regarding the processing of your personal data, with guaranteed acknowledgment within 48 hours.
Right to Nominate (Section 14): Designate another individual who, in the event of death or incapacity, shall have the right to exercise your data principal rights.
Escalation to Regulatory Authority: If dissatisfied with our grievance redressal, you retain the statutory right to file a complaint before the Data Protection Board of India.

6. Data Privacy Grievance Officer (DPDP Act & IT Act)

To exercise any of your statutory rights, request data correction, or register a privacy grievance, please contact our designated officer:

Designated Officer: Legal & Privacy Redressal Cell

Institute: Shittal's Institute of Fashion (SIF)

Email: support@siflegacy.com (Subject: DPDP Data Privacy Request)

Official Phone: +91 9112344558

Atelier Address: Aaroha Dwelling, Datta Nagar Chowk, Ambegaon Bk, Pune - 411046, Maharashtra, India