Privacy Policy

In short: we collect only what a campaign needs, we never sell or "share" your data for advertising, there is no tracking across sites, research uses anonymised answers only, and you can ask to see, correct or delete your data at any time.

This policy explains how Scripteco Technologies Private Limited ("Askofy", "we") handles personal data. It is written to meet India's Digital Personal Data Protection Act, 2023 and Rules, 2025 ("DPDP law") and the Information Technology Act, 2000 and its Rules. It also meets the EU and UK General Data Protection Regulation ("GDPR"), US state privacy laws such as California's CCPA/CPRA, and similar laws elsewhere. Where those laws give you more protection, we apply it.

1. Who is responsible for your data

It depends on why the data is used. In DPDP terms the one who decides is the Data Fiduciary, and the one acting on their behalf is the Data Processor. In GDPR terms these are the controller and the processor; in US law, the business and the service provider.

When you take a campaign

The organisation that invited you (your employer, hospital, school or another body) decides why and how your data is used for its campaign, and is responsible for it. Askofy runs the platform on its behalf as a processor, following its instructions and our Data Processing Addendum.

A campaign partner named in a campaign (for example, the medical trust that wrote the content) is responsible for the content. It receives your data only if the campaign's Terms & Conditions say so. If you tick the box to receive its updates, it is responsible for your contact details for that purpose. See the Campaign Partner Terms.

When we decide the purpose

We are responsible (controller or Data Fiduciary) when:

• you visit askofy.com, contact us or request a demo or partnership
• you try the public demo at askofy.com/demo
• you are an organisation admin or partner contact with an Askofy account
• you opted in to updates from Askofy
• we keep the platform secure, prevent fraud and fake certificates, and meet legal duties
• we create anonymised research data (see Research Data Policy)

2. What we collect

Participants (people who take a campaign)

• Identity: your name, as it should appear on your certificate.
• Contact (if asked or given): email and phone, to send your certificate and campaign messages.
• Profile (only what the campaign asks for): how you are taking part (employee, patient, visitor, guest, student, caregiver), department, occupation or stream of study, employee code, city, age group and gender.
• Learning record: for each level you take (for example Basic and Advanced): your answers (stored as option numbers), score, pass or fail, time taken, certificate code, and when you opened, started and finished.
• Consent record: what you agreed to, the version of the Terms & Conditions, and when. If you are under 18, your confirmation that a parent or guardian agrees.

We do not ask for government ID numbers (such as Aadhaar, PAN or a social security number), bank or card details, or medical records. Campaigns are designed not to ask about your own health. If a campaign ever does, it will say so clearly, the question will be optional, and answers are used only anonymously. Your age group and gender are optional.

Employees invited by their organisation

Your organisation may upload a list containing your name, employee code, email, phone, department, designation and location. This is used to send you your personal link and reminders, and to show your organisation who has completed. Your organisation must tell you about this.

Visitors who try the demo

What you enter in the demo form (you may use a made-up name), how far you get, and your answers and scores. We use this to understand who tries the demo and to improve Askofy, and to contact you only if you tick the box asking us to. Only our super administrators can see it.

Organisation admins, partner contacts and enquiries

Name, work email, phone, organisation, role, the products you are interested in and messages you send. If you sign in with a password, our login provider stores it only as a secure one-way hash. We never see it.

Emails we send

To deliver certificates and reminders, we keep a copy of each email (recipient, subject and content) in a sending queue until it has been sent, and a short record of each attempt.

Automatically

• Device storage: your progress in a campaign is saved in your browser so you can resume. See the Cookie & Storage Policy.
• Technical logs: our hosting and security providers process IP address, browser type and request times to deliver the site and block attacks. We do not use these for profiling or advertising.
• Counts: we count link opens, starts and completions per campaign, without identifying you.

3. Why we use it, and our legal basis

• Running the campaign: show the course, score answers, and issue, email and verify your certificate. *Basis:* your consent, or the organisation's legitimate purpose (for employees); under GDPR, the organisation's legitimate interests or consent, and performing what you asked for.
• Organisation reporting: show your organisation your participation, score, certificate level and department progress, and send reminders on its behalf. *Basis:* as above, decided by the organisation.
• Updates you asked for: only if you ticked the separate box. *Basis:* consent, which you can withdraw at any time.
• The demo: understanding who tries it and improving Askofy. *Basis:* your consent on the demo form.
• Security, fraud prevention and certificate integrity. *Basis:* legitimate use under DPDP law, and our legitimate interests under GDPR.
• Customers and partners: accounts, billing, support and service messages. *Basis:* contract, and legal obligations such as tax records.
• Research and impact: turning answers into anonymised statistics. *Basis:* legitimate interests and scientific-research rules. Once anonymised, the data no longer identifies anyone.

You can withdraw consent at any time (see section 8). Withdrawing does not affect what was done before.

Automated scoring

Your quiz is scored automatically, and a certificate is issued when you reach the pass mark. This does not have legal effects or similarly significant effects on you. If you think a result is wrong, ask the organisation or us for a human review, and we will check it.

4. Who can see it

• The organisation that invited you sees your name, the details you entered, participation, score, certificate level and certificate. Organisations cannot see other organisations' participants.
• Networks: if that organisation is part of a larger body (for example a club within a district, or a branch within a hospital group), the larger body sees only totals, unless the organisation chooses to share participant details with it. If it does, you are told so before you sign up.
• Campaign partners receive only anonymised, aggregated results, unless the campaign's Terms & Conditions say otherwise and you agreed.
• Askofy staff with a need to know, for support, certificate delivery and security. Access to contact details is limited, masked by default, and every reveal, export or deletion is logged with a reason.
• Anyone with your certificate code can verify it, and sees your name, the campaign, the organisation, the level and the date. See the Certificate Policy.
• Service providers who help us run Askofy (our sub-processors), bound by contract to protect your data. See the Sub-processors list.
• Authorities, when the law requires it, for example a lawful request from a court or CERT-In.
• A buyer or successor, if Askofy is ever sold or merged, under the same protections.

We never sell personal data, and we do not "share" it for cross-context behavioural advertising, as US laws define those terms.

5. Where it is stored and international transfers

Our main database is hosted in India. Some providers process data in other countries: our content delivery and security network runs worldwide, and our email and database providers are based outside India. See the Sub-processors list.

• India: transfers follow DPDP law and any country restrictions notified by the Government of India.
• EU, EEA and UK: when we receive or send personal data from these regions, we protect it with the European Commission's Standard Contractual Clauses and the UK Addendum, or another lawful transfer mechanism. You can ask us for a copy.

6. How long we keep it

These periods are enforced automatically by our system:

• Participant contact details (email, phone, employee code): removed 12 months after the campaign ends, or after your last activity if the campaign has no end date. Your answers and broad profile fields stay, for the organisation's records and anonymised research.
• Names and certificate codes: kept 3 years from the certificate, so certificates can be verified. After that the name is replaced with "Anonymous" and the certificate stops verifying.
• Demo entries: 12 months, then deleted.
• Email copies in the sending queue: 7 days after sending (30 days if sending failed), then deleted. The record of each sending attempt is kept for 24 months.
• Log of staff access to personal data: 3 years.

We also keep:

• Employee lists: until the organisation deletes them, or within 90 days after its account ends.
• Admin, partner and enquiry records: for the life of the account, or 24 months after the last contact for enquiries.
• Invoices and payment records: for as long as tax and company law requires (currently up to 8 years in India).
• System and security logs: as kept by our hosting providers, and for 180 days where Indian CERT-In directions require it.
• Backups: overwritten on a rolling basis.
• Anonymised research data: may be kept indefinitely, as it no longer identifies anyone.

7. Children

Askofy is not directed at children on its own. A person under 18 in India, or under the age of digital consent where they live (13 to 16 in most countries), may take part only:

• through an organisation (such as a school) that has obtained verifiable consent from a parent or lawful guardian, or
• with a parent or guardian who agrees on their behalf.

We do not knowingly collect data from children under 13 without a parent's consent. For anyone under 18 we do not offer optional updates, do not track behaviour across sites, and do not show advertising. A parent or guardian can ask us to delete a child's data at digi@askofy.com.

8. Your rights

Everyone

Wherever you live, you can ask us to:

• tell you what data we hold about you and how it is used, and give you a copy
• correct or complete it
• delete it, where it is no longer needed or you withdraw consent (certificates already shared outside Askofy cannot be recalled)
• withdraw consent at any time, as easily as you gave it
• stop optional updates: use the unsubscribe link in any email, or write to us

India (DPDP law)

You can also nominate someone to exercise your rights if you die or become unable to. You can complain to us, and then to the Data Protection Board of India.

EU, EEA and UK (GDPR)

You can also:

• object to processing based on legitimate interests
• restrict processing while a request is checked
• receive your data in a portable format (portability)
• complain to your local data protection authority (in the UK, the ICO)

United States (state privacy laws such as California's)

You can also know the categories and specific pieces of data collected, ask for deletion and correction, and opt out of sale, sharing or targeted advertising. We do none of these. We do not use sensitive personal information to infer characteristics about you. We will not treat you differently for using your rights. An authorised agent may make a request for you.

How to ask

Email digi@askofy.com with your name, the campaign and the email or phone you used. You can also ask the organisation that invited you. We will verify your identity, using only what you have already given us where possible, and reply within 30 days, or sooner where your law requires. If your request needs longer, we will tell you why.

When we act for an organisation (as its processor), we pass your request to it and help it respond.

9. Security

• Data is encrypted in transit (HTTPS) and at rest.
• Database rules mean each organisation can see only its own data.
• Staff access to contact details is masked by default, logged and reviewed.
• Logins use one-time email links, or passwords stored only as one-way hashes.
• Correct answers are protected, and each campaign can require answers to be scored on our server.

No system is perfectly secure. If a breach affects your personal data, we will inform you without undue delay, and inform the authorities within the time limits the law sets (for example the Data Protection Board of India and CERT-In in India, or a supervisory authority within 72 hours under GDPR). See Security.

10. Changes

We will post updates here and change the date at the top. For significant changes affecting how participant data is used, we will ask for fresh consent where the law requires it.

11. Contact

• Privacy requests: digi@askofy.com
• Grievance Officer (India): Sachin Gaikwad, digi@askofy.com. See Grievance Redressal.
• Post: Scripteco Technologies Private Limited, Mumbai, Maharashtra, India