Privacy Policy

Why this document is detailed

Privacy law in most countries rests on one principle: you must be told, before your data is used, what is collected, why, on what legal footing, who receives it, how long it is kept, and what you can do about it. A short summary cannot meet that duty and cannot be relied on by either side. So the full text below is the binding statement; the “At a glance” panel at the top is a convenience and does not change it. If the two ever differ, the full text applies.

How we keep this policy accurate

Every factual statement here describes what the site does at the date shown. It is written from the site’s actual behaviour, not from aspiration. If the site starts to collect something new, this policy is changed first, or at the same time, and the change is recorded in the version history at the foot of the page. A privacy statement that does not match practice misleads the reader, and that is treated as a wrong in its own right in many jurisdictions. We therefore state limits as well as promises.

What we do not collect

• No account details, passwords or payment card data. The site has no sign-in and takes no payments.
• No biometric, health or other special-category data, and we ask you not to send any to us.
• No precise location. Analytics, where on, infers an approximate region from your network address.
• No advertising profiles. We do not run advertising or build audiences.

Why the mailto design matters

The forms that say “email us” do not submit anything to a server. They open your own email application with a prepared message. Nothing is transmitted to IICTP until you choose to press send. You can edit or discard it first. This is deliberate: it keeps the data you give us to what you decide to send.

How we weigh legitimate interests

Where we rely on legitimate interests we have considered three questions: is the interest real and lawful, is the processing needed to achieve it, and do your interests or rights outweigh ours. Because the data is small, mostly stays on your device and is not used to profile you, we judge the balance favours the processing. You may object at any time (Section 13) and we will reconsider.

Where we rely on consent (India and other consent-based laws)

Under the DPDP Act, 2023, consent must be free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action; it can be withdrawn as easily as it was given. Certain uses are permitted without consent, such as complying with law. We apply these standards wherever we ask for consent. We do not make use of the site conditional on agreeing to analytics.

How it is started

Clarity is off by default. The site shows a choice, “Accept analytics” or “Reject analytics”, with equal prominence, the first time you visit. The code that loads Clarity runs only after you accept. If you reject, or do not choose, nothing is loaded and nothing is sent to Microsoft. It also never runs on a local development address, and it needs a Clarity project identifier to be set for the build.

Your choice is saved in your browser (the iictp-consent item on the Cookies and Storage page). You can change it at any time from “Cookie settings” in the footer. If you withdraw consent, the page reloads so that Clarity stops running. Withdrawal does not make earlier use unlawful, and we do not make the site conditional on accepting.

What it collects

Where it runs it may collect page views, clicks, taps, scrolling, the pages you came from, device and browser details, an approximate region, and recordings that replay your visit on screen. It may set cookies of its own to link visits together. Microsoft states that it applies masking to sensitive input fields; we do not rely on that alone, and the site does not ask you to type sensitive data into any field.

Roles

Microsoft processes this data for us under its data protection terms. Microsoft’s own notice explains any further use.

What we do with it, and what we do not

• We review results in aggregate to find confusing pages and broken flows.
• We do not use them to identify you, to build advertising audiences, or to make decisions about you.
• We do not combine them with the registry or with anything you email us.

Why a public record is justified

A credential is only worth something if a third party can check it. Publishing a limited record serves that purpose and protects the public from false claims. We limit what is shown to what that purpose needs, and holders can ask for correction or review (Section 13).

Other disclosures

• Where the law, a court or a competent authority requires it. We review each request and disclose only what is required.
• Where needed to protect the safety, rights or property of others, or to prevent fraud or abuse of the registry.
• In a merger, reorganisation or transfer of the registry. The receiving body must honour this policy, and we will tell you if its purposes change.

If a personal data breach occurs

• We will investigate, contain it and correct any affected record.
• Where the GDPR applies, we will tell the supervisory authority within 72 hours of becoming aware where the breach is likely to put people at risk, and tell the people affected without undue delay where the risk is high.
• Where the DPDP Act applies, we will notify the Data Protection Board of India and each affected person in the form and time the rules require.

How to use a right

1. Email privacy@iictp.org and say what you want. You need not quote a law.
2. We may ask for enough information to confirm who you are, so that we do not give your data to someone else. We will ask for no more than we need.
3. We aim to reply within one month of receiving a valid request and acknowledge it within 48 hours; we will tell you if a complex request needs longer. We do not charge, unless a request is clearly unfounded or excessive, in which case we will say why.
4. If we refuse all or part of a request, we will tell you the reason and how to challenge it.

If you are not satisfied

Write to us again and ask for senior review. You may complain to the data protection authority of the country where you live, work or believe the problem occurred, for example the Data Protection Board of India, a national authority in the EU, the Information Commissioner’s Office in the UK or the California Privacy Protection Agency. You may also have a right to go to court. Nothing here limits a right that the law gives you and that cannot be waived.

What you can do yourself

• Change or remove your name from the “Hi, name” menu in the header.
• Clear the site’s data in your browser settings.
• Block analytics cookies or scripts in your browser, or use a browser or extension that does so, where the site does not yet offer a choice.