🔐 Privacy Notice

Last updated: July 2026  |  REC Durgapur Class of 1988 Alumni Directory

1. Who Controls Your Data

The REC Durgapur 1988 Alumni Association ("we", "us") operates this private directory exclusively for authenticated class members. The system administrator group is the Data Controller under GDPR, CCPA, and the Digital Personal Data Protection Act (DPDPA) 2023.

2. What Personal Data We Collect

• Full name, nickname, department, graduation roll number
• Email address and mobile/WhatsApp number (if provided by you)
• Date of birth (stored as DD-MMM format — year is not stored)
• Present and permanent address, spouse/family details (if provided)
• Professional information: employer, designation (if provided)
• Profile photographs (self and family)
• Login timestamps and authentication activity (audit log)
• Survey responses (if you participate)

3. Purpose and Legal Basis for Processing

• Legitimate interest — maintaining a private alumni directory for the REC Durgapur Class of 1988 community
• Consent — you voluntarily created an account and submitted your profile information
• Security obligations — authentication logs maintained for fraud prevention and account security

4. How We Protect Your Data

• All profile data is encrypted at rest using AES-256 (Fernet)
• Passwords are stored as PBKDF2-SHA256 salted hashes — never in plaintext
• Two-factor authentication (TOTP) is required for all accounts
• HTTPS (TLS 1.2+) is enforced for all connections
• Database files are permission-restricted (0o600) — owner read/write only
• IP addresses in audit logs are pseudonymised using salted SHA-256 hashes
• Audit logs use a tamper-evident hash chain (SOC 2 / ISO 27001 A.12)

5. Who Can See Your Data

• You — always see your own complete profile
• Verified class members — see your public profile fields (name, dept, city) in the Batchmates directory. Sensitive fields (phone, address, employer) are hidden unless you opt in
• Administrators — can view all profile fields for directory management only
• Third parties — we do not sell, share, or transfer your data to any third party

6. Data Retention

• Profile data is retained as long as your account is active
• Authentication audit logs are automatically purged after 365 days
• Upon account deletion, all personal data is anonymised immediately

7. Your Rights

You have the following rights under GDPR, CCPA, and DPDPA:

• Right to Access — download all your personal data as JSON from your Settings page
• Right to Rectification — update your profile at any time via My Profile
• Right to Erasure ("Right to be Forgotten") — contact the administrator to request full anonymisation of your account
• Right to Restriction — control visibility of sensitive fields via privacy checkboxes in your profile
• Right to Data Portability — download your data as machine-readable JSON
• Right to Opt-out — you may opt out of showing sensitive information in the Batchmates directory at any time

8. Cookies and Sessions

We use a single session cookie (HttpOnly, SameSite, Secure) to maintain your authenticated session. No tracking cookies, analytics cookies, or third-party cookies are used. Sessions expire after 30 minutes of inactivity or 8 hours maximum.

9. Children's Data (COPPA)

This directory is exclusively for REC Durgapur 1988 alumni (age 55+). We do not knowingly collect data from individuals under 18 years of age.

10. Contact

To exercise any data rights or raise a privacy concern, contact the system administrator through the Admin Dashboard or by email to the alumni association. Requests will be processed within 30 days in accordance with GDPR Art.12 and DPDPA requirements.