Privacy policy
How this website handles the little data it collects.
Privacy policy
Version 1.0 · Published 7 August 2026 · Notice given by Durjeya Solutions Private Limited under section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
What this notice covers
This notice covers this website, durjeya.com, and nothing else.
It does not cover our products. Where an examination body deploys CORTEX, that body decides what candidate data is processed, on its own premises, under its own notice and under whatever we agree with it in writing. Nothing on this page tells you how an examination is run or how examination data is handled. If you are a candidate looking for that, ask the body conducting your examination.
We have written this the same way we write everything else on this site. What we take, why we take it, how long we keep it, and what you can make us do about it. If a sentence here cannot be checked, it should not be here. Write to us and we will correct it.
Who we are
- Data Fiduciary: Durjeya Solutions Private Limited (“Durjeya”, “we”, “us”).
- Registered office: 6009, RBTIC Building, Indian Institute of Technology Bombay (IIT Bombay) Campus, Powai, Mumbai 400076, Maharashtra, India.
- Corporate Identity Number (CIN): U74999MH2017PTC295104.
- Email: mail@durjeya.com
- WhatsApp: +91 98924 18553
Under the DPDP Act you are a Data Principal and we are the Data Fiduciary for the personal data described below.
What we do not collect
Not on this website
- No Aadhaar number, and no other government-issued identifier.
- No biometrics. No face, fingerprint, iris or voice data.
- No examination data. No question papers, no candidate responses, no scores, no roll numbers, no candidate records of any kind.
- No sensitive personal information. We do not ask for health, financial, caste, religion, political or sexual-orientation data, and we have no field in which to put it.
- No payments. The site takes none, so we hold no card or bank details.
- No analytics, no advertising, no tracking pixels, no marketing platform, no data broker. We do not profile visitors, we do not build audiences, and we do not sell, rent or trade personal data. There is nobody to sell it to whom we would want to sell it.
We state this first, and plainly, because of what we sell. A company that builds examination-integrity systems has no business quietly assembling a profile of the people who read about it.
What we collect, and why
The website’s data-related interactions are described below. For each one, we explain the data, the purpose, the lawful basis, where it is stored, and how long it stays.
1. The contact form on the homepage
- What you give us: your name and email address, which are required; a phone number or organisation, and a description of your role from a dropdown list, both optional; and your message.
- Why: to read your enquiry, to reply to it, and to keep a record of the exchange so that a later reply makes sense.
- Lawful basis: your consent, given by pressing Send after reading the notice printed on the form itself. In the alternative, section 7(a) of the DPDP Act, which covers personal data you provide voluntarily for a purpose you have not objected to.
- Where it goes: two places. It is written to this website’s database as an enquiry record, and it is emailed to our mailbox at mail@durjeya.com.
- Why two places: email from a web server is not reliable, and a message that failed to send would otherwise vanish with nobody knowing. Storing it first means a failed enquiry is visible to us instead of silently lost. It is a deliberate choice, and it means one extra copy exists.
- How long: a maximum of two years from the date you write to us, or until you ask us to erase it, whichever is sooner.
One more thing you should know. The form carries an automated-abuse check. If a submission trips it, we store it anyway and mark it, rather than discarding it, because a false positive would otherwise destroy a genuine message while showing the sender a thank-you. Such records are held and erased on exactly the same terms as any other enquiry.
2. The subscribe form on the Insights page
- What you give us: your email address. Nothing else. There is no name field, and we do not want one.
- Why: to send you one email when we publish an article, and nothing else. No offers, no newsletters you did not ask for, no third-party mailings.
- Lawful basis: your consent, given by pressing Subscribe.
- Where it goes: the website database, in a subscriber list, plus a record that the subscription happened. A notification is also emailed to mail@durjeya.com.
- How long: until you unsubscribe. See Consent, and how to withdraw it below, which is honest about one detail most policies gloss over.
3. A truncated IP address
- What we record: your Internet Protocol (IP) address with its last part removed and replaced by zero. For example, an address of the form 203.0.113.47 is stored as 203.0.113.0. The equivalent truncation is applied to IPv6 addresses.
- Why: one purpose only. To count submissions and stop automated abuse, by limiting each caller to five form submissions per hour. Without it, a public form is an open invitation to fill our database.
- Why truncated: a full IP address can point at one household or one connection. A truncated one is still good enough to throttle a flood but is no longer a precise identifier of a person. This is data minimisation, applied at the point of collection rather than promised in a policy.
- What we do not do with it: we do not use it to locate you, to recognise you between visits, to link your visits together, or to build any profile.
- Lawful basis: we treat a truncated address as not identifying an individual. To the extent it is personal data at all, it is collected under the same consent as the form it accompanies, and it is discarded on the same schedule.
4. Cookies
This site sets no analytics, advertising or tracking cookies, because it uses none of those tools. WordPress, the software this site runs on, may set functional cookies — for example if you log in to the site as an administrator, or when a form needs to carry a security token between two page loads. These do you no marketing harm and carry no advertising identifier.
If you would rather have none of them, your browser can block or delete cookies for this domain. The site will still work.
Who else sees anything
The third-party services involved are named below, including the ones you might not otherwise notice, because “we do not share your data” is a claim many sites make while their pages quietly call out to other companies.
Google Fonts
Our typefaces are loaded from fonts.googleapis.com. This happens automatically on every page, before you click anything. To serve the fonts, Google receives your IP address and basic information about your browser. We receive nothing from this and set nothing through it. If you want to avoid it entirely, a browser extension or setting that blocks third-party font loading will do so; the site remains readable in a fallback typeface.
Google Maps
The contact section of the homepage embeds a map showing our office. It is set to load lazily, so it loads when you scroll to that section rather than when the page opens. When it loads, Google receives your IP address and browser information in the same way. There is no account, no marker and no data of yours passed to it — the map is simply pointed at our own address.
Google Drive
Our films are hosted on Google Drive. They are deliberately not embedded as live players. The page shows a still image, and Google is contacted only if you press play. Until you do, loading our pages sends nothing to Drive. This was done for privacy and for page speed, in that order.
Our web host
The site and its database run on servers operated by our hosting provider, Hostinger. Form submissions are stored there, and our provider can technically access the systems on which they sit, as any hosting provider can. They process it for us, not for themselves.
We publish a WhatsApp number. If you choose to message us there, that conversation takes place on Meta’s platform under Meta’s terms and privacy policy, not ours. We can see the messages you send us, and so, subject to its own encryption design, can the platform carrying them. If that matters to you, email is the better channel.
Transfers outside India
Google and Meta are global companies and will process the above outside India. We do not transfer personal data to any country to which such transfer is restricted by the Central Government under section 16 of the DPDP Act. We do not transfer your form submissions abroad ourselves; what leaves India is what the embeds above collect directly from your browser.
Everyone else
Nobody. We disclose personal data outside the list above only where the law compels us — a court order, or a lawful demand from a government authority acting within its powers. If that ever happens and we are permitted to tell you, we will.
Consent, and how to withdraw it
Section 6 of the DPDP Act says consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative act, and limited to the data necessary for the stated purpose. It also says withdrawing consent must be as easy as giving it. We take that literally.
To stop the Insights emails
Every article email carries an unsubscribe link. One click. No login, no form, no reason required, no “are you sure”. Your address is removed from the mailing list immediately.
Here is the detail most policies leave out. Removing you from the mailing list does not, by itself, delete the original record showing that the address once subscribed. That record is erased on the retention schedule below, or immediately if you ask. If you want it gone now, email mail@durjeya.com and say so. We will erase it and confirm.
To withdraw consent for a contact-form enquiry
Email mail@durjeya.com from the address you used, or tell us plainly which enquiry you mean, and ask us to stop. We will stop processing it and erase it, keeping only what a law independently requires us to keep. We will tell you if anything is retained on that basis, and why.
The consequence of withdrawing
It is simple and we will not dress it up. If you erase your enquiry, we can no longer reply to it. If you unsubscribe, you stop getting the articles. Nothing else changes, and nothing else is withheld from you as a result.
How long we keep it
Section 8(7) of the DPDP Act requires personal data to be erased once consent is withdrawn or the purpose is no longer being served, whichever is earlier. Our rules:
- Contact enquiries: a maximum of two years from the date of your message. This is the period stated on the form itself, at the moment you submit it. Two years, because an examination body that spoke to us in one procurement cycle often returns in the next, and a reply that has lost its history is useless to both of us.
- Subscriber addresses: until you unsubscribe.
- Truncated IP counters: one hour. They exist to enforce an hourly limit and expire automatically.
- Anything at all: immediately, if you ask us to erase it and no law requires us to keep it.
Emailed copies in our mailbox are covered by the same two-year rule as the database record.
Your rights
These are yours under sections 11 to 14 of the DPDP Act. To use any of them, email mail@durjeya.com, or write to the registered office above. Put “DPDP request” in the subject line if you want it routed quickly.
- Access (section 11). Ask us what personal data of yours we hold, what we have done with it, and who else we have given it to. We will tell you.
- Correction, completion and updating (section 12). If what we hold about you is wrong, incomplete or out of date, tell us and we will fix it.
- Erasure (section 12). Ask us to delete it. We will, unless a law requires the record to be kept — in which case we will tell you which one and for how long.
- Grievance redressal (section 13). Complain to us about anything in this notice or anything we have done with your data. Our Grievance Officer is named below. This is a right you can use before approaching the Data Protection Board of India, and the Act expects you to use it first.
- Nomination (section 14). You may nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself. Tell us the nominee’s name and how to reach them, and we will record it against your data.
How we respond
- We aim to acknowledge any request within three working days and to complete it within thirty days.
- We may need to check that you are who you say you are — usually by replying to the address the data came from. We will ask for the least we can get away with, and we will not ask you for an identity document to service a request about an email address.
- There is no fee.
Your duties
Section 15 of the Act places some duties on you too, and they are reasonable ones: do not impersonate someone else when giving us data, do not suppress material information where you are legally obliged to provide it, and do not file a false or frivolous grievance.
Children
The DPDP Act treats anyone under eighteen as a child, requires verifiable parental consent before processing a child’s personal data, and prohibits tracking or behavioural advertising directed at children. We do no tracking or behavioural advertising of anyone, so the second part is settled by design.
On the first part, we are direct about it because of who reads this site. The forms on this website are intended for adults — officials of examination bodies, institutions, partners, journalists and researchers. They are not designed for candidates, and we do not seek information from children.
If you are under eighteen, please do not use the forms without a parent or guardian doing it with you. If you are a parent or guardian and believe a child has submitted personal data to us, email mail@durjeya.com and we will erase it. We will not ask for a reason.
Security, and what happens if we get it wrong
We are required by section 8(4) of the DPDP Act to take reasonable security safeguards. What that means here, concretely:
- The site is served over HTTPS, so what you type into a form is encrypted in transit.
- Enquiry records are private. They are not published, not addressable by any URL, not included in the site’s sitemap, and not exposed through the site’s programming interface.
- Only administrators of the site can read them, and only through an authenticated login.
- Submissions are rate-limited and screened for automated abuse, as described above.
- We collect less, so there is less to lose. That is the strongest safeguard on the list and the only one that cannot fail.
No system is beyond attack, and we will not claim ours is. If personal data held by us is breached, we will notify each affected person and the Data Protection Board of India as section 8(6) requires, and we will tell you what happened rather than what we would prefer you thought happened.
Reporting a weakness
If you find a security weakness in this website, please tell us at mail@durjeya.com. We will acknowledge it. We ask only that you do not access, alter or download other people’s data while demonstrating it, and that you give us a reasonable chance to fix it before publishing.
Grievance Officer
As required by sections 8(9) and 13 of the DPDP Act, the following person answers questions and complaints about how we process personal data.
- Grievance Officer: Amit Kumar Gupta
- Email: mail@durjeya.com
- Post: Grievance Officer, Durjeya Solutions Private Limited, 6009, RBTIC Building, IIT Bombay Campus, Powai, Mumbai 400076, Maharashtra, India.
Write in any way you like. There is no prescribed format and no form to fill. Tell us what happened and what you want done.
If you are not satisfied with our answer, or we do not answer, you may complain to the Data Protection Board of India in the manner it prescribes. The Act expects you to raise it with us first, and we would rather you did — it is faster for you and it is how we find out we are wrong.
Changes to this notice
If we change what we collect, we will change this page before the change takes effect, not after, and we will move the version number and date at the top. Substantive changes will be flagged on the page for at least thirty days so that a returning reader can see that something moved.
We will not quietly widen the purposes for which we use data you have already given us. If we ever want to use it for something new, we will ask you.
One last thing
Our whole argument as a company is that you should be able to check a claim rather than trust the person making it. This page is a set of claims about our own conduct. If you find one that does not match what the site actually does, tell us at mail@durjeya.com — you will have found a real defect, and we will treat it as one.