inSIG 2026
Back to login

inSIG Privacy Policy

Last updated: 20 Aug 2026

1. Who We Are

inSIG (India School on Internet Governance) operates the fellow portal at app.insig.in.

Privacy and compliance contact: Anupam Agrawal, inSIG Code of Conduct Compliance Team, legal@insig.in.

inSIG acts as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and, where applicable, as a Data Controller under the EU/EEA General Data Protection Regulation (GDPR) and similar laws for international fellows, including the California Consumer Privacy Act (CCPA/CPRA) for California residents.

2. Scope

This Privacy Policy applies to personal data collected through the inSIG fellow portal and related fellowship administration for the active edition (for example, inSIG 2026).

3. Personal Data We Collect

We collect only data needed to run the fellowship and support you during the program:

  • Identity and contact: name, email, phone, organisation, city, country, job title or area of study, emergency contact.
  • Profile and logistics: t-shirt size, food preference, dispatch address, room allocation, attendance.
  • Travel data: inbound and outbound travel mode, locations, dates and times, optional travel pool visibility.
  • Meet and greet: bio, fun facts, photo, LinkedIn URL.
  • International fellows: passport and visa-related details, invitation letter data, document uploads.
  • Financial: reimbursement submissions and payment identifiers where applicable.
  • Technical: session cookies, OTP authentication records, security logs.
  • Consent records: Code of Conduct, Terms, Privacy Policy, and name publication acceptance timestamps.

4. How We Use Your Data

Travel data

Used only for logistics: airport or station coordination, pickup planning, and optional travel pool matching when you opt in. Not used for marketing.

T-shirt and catering data

T-shirt size and food preference are used only to prepare event kits and catering. Not shared with other fellows.

Meet and greet data

During the active program, completed meet and greet profiles are visible to other fellows in your edition. This helps fellows connect during inSIG.

inSIG Social (alumni network)

inSIG Social is the inSIG network where alumni and current participants may view each other's networking profiles. Profile fields may include: name, photo, organisation, designation, bio, fun facts, and LinkedIn URL.

  • During the active edition, meet and greet data is visible to fellows in your edition as described above.
  • After fellowship completion, your profile may appear in inSIG Social for alumni networking unless you opt out.
  • You can hide yourself from inSIG Social at any time from Profile > Privacy and data. Your data remains with inSIG for record-keeping, but other alumni cannot see you in the network.

5. Who Can Access Your Data

  • During the program: authorised inSIG organisers who need access for logistics, travel desk, accommodation, finance, or program administration.
  • Other fellows: meet and greet directory during the active edition; inSIG Social after completion unless you opt out.
  • After the event: operational access by organisers ends. Data is retained in archive for record-keeping, certificates, audit, and legal compliance. Archived data is not used for day-to-day logistics.

6. Legal Basis for Processing

  • Contract: fellowship participation, portal access, travel coordination, reimbursement.
  • Consent: meet and greet directory, inSIG Social visibility, name publication, travel pool opt-in.
  • Legitimate interest: portal security, fraud prevention, program integrity.
  • Legal obligation: tax, audit, or regulatory retention where required.

7. Data Processors and International Transfers

We use trusted service providers, including email delivery (Brevo), file storage (Cloudflare R2), database hosting (Turso), and application hosting (Vercel). Personal data may be processed outside India. We require processors to protect data and delete it on our instruction.

8. Retention

We keep personal data while your fellowship is active and for a reasonable period afterward for archives, certificates, and legal compliance. When the specified purpose is no longer served, we erase or anonymise data unless retention is required by law.

Security and processing logs may be retained for up to one year where required under the DPDP Rules, 2025, before erasure unless a longer period is legally required.

9. Your Rights

Depending on your location, you may have the following rights:

  • Access: know what personal data we hold about you.
  • Correction: update inaccurate or incomplete data (via Profile or by request).
  • Erasure: request deletion of your personal data.
  • Portability: receive a copy of your data in a portable format.
  • Withdraw consent: where processing is consent-based (for example, inSIG Social or travel pool).
  • Grievance / complaint: under the DPDP Act, GDPR, or CCPA.

Self-service

From Profile > Privacy and data you can:

  • Download my data (JSON export).
  • Delete my account and data (OTP-confirmed permanent deletion).
  • Hide from inSIG Social (opt out of alumni network visibility).

Requests by email

Email legal@insig.in. We respond within 30 days (GDPR: one month; CCPA: 45 days where applicable). We may verify your identity using your registered email address.

We do not sell or share personal data for cross-context behavioural advertising. California residents have the right to know, delete, and correct personal information as described above.

10. Harassment and Conduct Complaints

Privacy complaints: Anupam Agrawal, legal@insig.in.

Harassment or Code of Conduct complaints: contact the inSIG Code of Conduct Compliance Team (inSIG-CCCT) via insigorganizer@gmail.com or see the Code of Conduct.

11. Cookies

We use essential cookies only. See the Cookie Policy.

12. Children

The Portal is intended for selected adult fellows. We do not knowingly collect personal data from children.

13. Changes

We may update this Privacy Policy. The "Last updated" date will change when we do. Material changes may be notified through the Portal or by email.

14. Supervisory Authorities

You may contact legal@insig.in first. You may also lodge a complaint with the Data Protection Board of India (when operational), your EU/EEA supervisory authority, or the California Privacy Protection Agency where applicable.