Privacy Policy

1. What data we collect

When you submit a referral form, we collect:

• Your full name — used by our counsellor to address you correctly.
• Phone number — to call you back about the programme.
• Email address — to send programme information and updates.
• Course of interest — to route your enquiry to the right counsellor.
• Referral code (if applicable) — to attribute the referral and pay the referrer's reward.

We do not collect: date of birth, residential address, financial details, browsing history, or any sensitive personal data, unless you provide it later in the enrolment process.

2. Why we collect it (Purpose Limitation)

• To follow up on your interest in our programmes.
• To attribute the referral to the student who shared the code (so they get their reward).
• To meet our financial audit obligations (3-year retention).

3. Who we share it with

Your data is shared with:

• LeadSquared (our CRM, India region) — for lead management.
• Gupshup (WhatsApp Business API) — only for the referrer to receive their referral link. We never WhatsApp referees from this system.
• No third-party marketing partners. No data brokers. No advertising platforms.

4. How long we keep it

We retain referral data for 3 years from submission, in line with financial audit norms. After that, records are anonymised automatically.

5. Your rights under DPDP Act 2023

• Right to know — see what data we have about you (form below).
• Right to correction — email privacy@jaro.in with corrections.
• Right to erasure — request deletion (form below).
• Right to grievance redressal — contact our Grievance Officer at privacy@jaro.in. We respond within 7 working days.

6. Security measures

• Passwords are hashed (bcrypt). OTPs are hashed and single-use.
• All data in transit is encrypted (HTTPS/TLS).
• Phone numbers and emails are masked in our staff portal views (only counsellors handling your case see the full number).
• All access to personal data is logged in our audit trail.

7. Data localisation

All personal data of Indian residents is stored on servers located in India (Mumbai region), as required by DPDP.

8. Breach notification

In the unlikely event of a data breach affecting your data, we will notify you within 72 hours via the contact details you provided.

9. Contact

Data Protection Officer: privacy@jaro.in
Grievance Officer: grievance@jaro.in
Jaro Education, Mumbai, India