Privacy Policy

Effective date: 23 October 2026 · Version: 2026-10-23

Pune Knowledge Cluster Foundation (PKC Foundation) is responsible for deciding how personal data is processed through this MAHA-EV Mission website and portal. This policy covers public browsing, account applications, authenticated reporting, Knowledge Centre contributions and privacy requests.

Information we collect

Account applicants provide their name, email address, institution, requested role, e-node affiliation and password. We record email-verification and administrative decisions, the privacy-notice version and acceptance time, and an adult-eligibility declaration. We do not ask for Aadhaar, identity-document copies or a date of birth as part of standard registration.

Authorised users may provide programme submissions, investigator names and institutional affiliations, comments, evidence references and Knowledge Centre material. Technical records include access times, IP addresses, login attempts, session information and administrative audit events. Passwords are stored as one-way hashes. Verification codes expire and cannot be reused after successful verification.

Why we use information

We use account information to verify email ownership, assess eligibility, assign access, secure accounts and communicate service decisions. Programme information supports Mission coordination, review, progress monitoring and reporting to ANRF. Publication information supports approved public updates. Technical records support security, troubleshooting and accountability.

The signup notice requests consent for account verification and access administration. Other processing may be required to meet applicable legal obligations or undertaken on another basis permitted by applicable law. Public browsing does not require registration. Optional publication material should contain only information authorised for public disclosure.

Who can access or receive information

Access is restricted according to assigned responsibilities. E-node participants access their authorised scope. PMU administrators, authorised ANRF personnel and appointed reviewers may receive programme information within their duties. The public website exposes approved public material and aggregate progress, rather than private account details or draft submissions.

Infrastructure and email providers process information needed to operate the service. Google processes email delivery when Google SMTP is configured. An optional Google Sheets connection reads a designated progress spreadsheet; SMTP and spreadsheet permissions are separate. We may disclose information where required by law or to investigate a security incident through an authorised process.

YouTube and external resources

YouTube videos load only when you choose “Load YouTube video” or follow an external video link. Loading a video sends information such as your IP address and browser details to YouTube, whose policies then apply. External PDF and other resource links may lead to independently operated services. Their operators control their own collection and retention practices.

Cookies and browser storage

The service uses essential session and CSRF cookies for authentication and request protection. Public navigation may use session storage to remember scroll position. Portal submission content is not deliberately persisted in browser local storage by this release. Unsaved edits may remain in the open tab until saved or closed. This release does not add advertising or behavioural-tracking cookies.

Retention and erasure

We retain account information while needed for authorised participation and administration. Unverified and rejected applications are reviewed for removal when no longer needed, subject to statutory retention. This release applies a default minimum of 366 days from the latest recorded application activity. Legal or security holds may require longer retention. Programme records and report snapshots follow the applicable Mission, funding and institutional retention requirements. Security and processing records are retained for applicable statutory periods, including the relevant one-year minimum when required.

Retention may continue where necessary to meet legal obligations, investigate incidents, resolve disputes or preserve required audit evidence. Erasure requests are reviewed against these obligations. Deleted information may remain temporarily in restricted backups until the backup cycle expires; restoration procedures must reapply applicable deletion decisions. PKC maintains the operational retention schedule and reviews it as requirements change.

Your choices and requests

You may request information about processing of your personal data, correction or updating, erasure where applicable, withdrawal of consent, nomination of another person to exercise applicable rights, or grievance review. Use the privacy-request page when signed in, or contact the Mission Manager - PMU by email, phone or post. You may contact us without an active account, including when an application is pending or rejected.

We may verify your identity and authority before acting. Withdrawing consent may prevent us from providing account access where the relevant information is necessary. It does not invalidate prior lawful processing or require removal of records that must be retained by law. We will communicate the outcome and any applicable retention reason. Grievances will be addressed within the applicable statutory timeframe, with a published operational maximum of 90 days. Where applicable, you may approach the Data Protection Board of India after using the available grievance process.

Security and incidents

Technical controls include HTTPS, password hashing, role-based access, server validation, restricted uploads and audit records. Infrastructure operators must also maintain protected backups, access reviews, storage protection and incident procedures. No system can eliminate all risk. If a personal-data breach occurs, PKC will assess and contain it and make notifications required under applicable law.

Children and authorised use

Self-registration is limited to authorised Mission participants aged 18 or older. The adult declaration does not authorise collection of children's data. Do not include children's personal information or unnecessary third-party personal data in submissions or public material. Contact PMU if such information needs special handling.

Policy changes

We will publish material changes with a revised version and effective date and provide additional notice or obtain fresh consent where required. The applicable legal framework includes the Digital Personal Data Protection Act, 2023 and notified Rules as their relevant provisions commence.

Privacy and grievance contact