Who controls your personal data
Indian Youth Entrepreneurship Council Foundation ("IYEC", "we", "us" or "our"), CIN U85500UP2026NPL247715 is the data fiduciary or controller for personal data collected through iyec.in and IYEC-operated programs, except where a clearly identified partner independently determines how data is used.
This policy applies to visitors, members, founders, students, mentors, investors, partners, service providers, event attendees, applicants, company representatives, and people who contact us.
Data we collect
Information you provide
- Identity and contact details such as name, email, telephone or WhatsApp number, location, date of birth or age information, profile photograph, account credentials, and communication preferences.
- Membership, education, employment, skills, mentorship, investor, startup, company, team, application, event, grant, cohort, course, and funding information.
- Business and verification data such as company name, registered address, website, registration status, CIN, GSTIN, PAN, and, only where required for a requested service, Aadhaar or other identity documents.
- Service fulfilment documents such as incorporation records, address proofs, financial or bank documents, cancelled cheques, contracts, pitch decks, project files, and payment proofs.
- User content including posts, comments, ideas, messages, reviews, testimonials, forms, support requests, and documents you choose to submit.
- Transaction data such as purchased service, amount, invoice, coupon, tax, payment status, Razorpay identifiers, bank transfer reference, refund status, and billing details. IYEC does not intentionally store full card numbers or CVV values.
Collected automatically
- IP address, device and browser information, browser-reported time zone, timestamps, referring host, pages and actions used, response status and timing, form-attempt category and outcome, session and security logs, cookie identifiers, and approximate location inferred from IP. Where you are signed in, operational events may be associated with your account or profile so we can secure the service, investigate misuse, support users, and maintain an audit trail. We do not intentionally place passwords, OTPs, access tokens, cookie values, full query strings, full request bodies, or form-field values in these operational logs.
- Analytics and advertising events from tools such as Google Analytics and Meta Pixel, subject to available consent controls and applicable law.
From other sources
We may receive information from Google sign-in or Firebase, payment processors, WhatsApp/Meta, event or institutional partners, mentors, investors, service providers, referral sources, public company records, and information you have made public.
Why we process data
| Purpose | Typical basis |
|---|---|
| Create accounts, authenticate users, deliver memberships, events, courses, mentoring, accelerator, grant, funding, company and marketplace services. | Contract, requested steps before contract, consent, or legitimate use permitted by law. |
| Process payments, invoices, refunds, taxes, provider payouts, fraud checks, and accounting. | Contract and legal obligations. |
| Review eligibility, applications, profiles, uploaded documents, service requests, and complaints. | Contract, consent, legitimate interests, and legal obligations. |
| Send transactional email, SMS, WhatsApp, reminders, service updates, and support responses. | Contract, consent, or legitimate interests. |
| Send newsletters, opportunities, program or partner marketing. | Consent or another basis permitted by applicable law. You may opt out. |
| Measure performance, prevent abuse, secure accounts, debug, enforce policies, and establish legal claims. | Legitimate interests and legal obligations. |
Where consent is the basis, you may withdraw it. Withdrawal does not make earlier lawful processing unlawful and may prevent us from delivering a feature that requires the data.
How we share information
We may share only what is reasonably necessary with:
- Hosting, database, security, email, communications, analytics, customer-support, cloud-storage, identity-verification, and technology vendors acting under contract.
- Razorpay, banks, UPI or other payment participants for payments, refunds, chargebacks, fraud prevention, and compliance.
- Google, Firebase, reCAPTCHA, Meta, and WhatsApp when you use or encounter those integrations.
- Mentors, investors, partners, cohort or event organisers, and service providers when needed for the service you request or when you direct us to share.
- Professional advisers, auditors, insurers, regulators, courts, police, or government authorities when lawfully required or reasonably necessary to protect rights and safety.
- A successor in a merger, restructuring, financing, or transfer, subject to lawful safeguards.
Public profile fields, posts, comments, startup stories, testimonials, or directory listings may be visible to others when you publish them or agree to publication. Do not place confidential or highly sensitive information in public fields.
Cookies, analytics, and advertising
We use essential cookies for sessions, authentication, security, carts, and preferences. With consent where required, we may use analytics or advertising cookies, including Google Analytics and Meta Pixel. See our Cookie Policy.
IYEC does not sell personal data for money. Where U.S. state law treats cross-context behavioural advertising as "sharing" or "sale", eligible residents may request an opt-out by emailing us with the subject "Do Not Sell or Share". We will also honour legally required browser-based opt-out signals where technically applicable.
Retention
We retain data only as long as reasonably necessary for the stated purposes, legal compliance, dispute resolution, safety, and enforcement. Typical periods are: inactive account data up to 3 years after last activity; enquiry and unsuccessful application records up to 2 years; transaction, tax, invoice and accounting records up to 8 years or the legally required period; security logs generally up to 12 months; and consent or complaint records for as long as needed to demonstrate compliance. Active projects, legal holds, fraud investigations, or statutory requirements may require longer retention. Backups are deleted on a rolling cycle.
Security and international processing
We use access controls, encryption in transit, secure password hashing, restricted administrative access, backups, logging, rate limiting, and vendor review appropriate to the nature of the data. No system is perfectly secure. Follow our account-security instructions and notify us promptly of suspected compromise.
Some service providers may process information outside India or your state or country. We use contractual, technical, and organisational safeguards and transfer data only where permitted by applicable law.
Your choices and rights
Subject to applicable law and exceptions, you may ask to access a summary of your data, correct it, erase it, withdraw consent, obtain information about sharing, nominate another person where Indian law permits, opt out of marketing, or appeal a denied privacy request. Certain U.S. residents may also have rights to know, delete, correct, obtain a portable copy, opt out of targeted advertising, sale or sharing, and limit certain sensitive-data uses without discrimination.
Send requests to contact@iyec.in with the subject "Privacy Request". We may verify identity and authority. We will respond within the period required by applicable law. We may refuse or limit requests where an exception applies, such as legal record-keeping, fraud prevention, another person's rights, or active disputes.
India privacy notice
For people in India, this policy is intended to support the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as their provisions come into force, together with applicable provisions of the Information Technology Act, 2000 and rules currently in force. We provide itemised notice of data and purpose, seek valid consent where required, enable withdrawal and correction, use reasonable safeguards, maintain a grievance channel, and notify incidents as applicable.
You are responsible for providing authentic information, not impersonating another person, and not suppressing material information when exercising statutory rights. You may nominate another individual to exercise rights in the event of death or incapacity where the law permits.
United States privacy notice
IYEC is established in India and does not represent that every U.S. state privacy statute applies to it. Where a U.S. privacy law does apply, the categories collected during the preceding 12 months are the identifiers, account data, internet activity, commercial records, professional or education data, user content, approximate location, and sensitive data described above. They are collected from you, your device, integrated providers, partners, and lawful public sources for the stated purposes, and disclosed to the recipient categories stated above.
We do not knowingly sell personal information for money. We do not knowingly sell or share personal information of consumers under 16 for cross-context behavioural advertising. Eligible residents may exercise applicable access, correction, deletion, portability, opt-out, limitation, appeal, and non-discrimination rights by contacting us. An authorised agent must provide proof of authority, and we may verify the consumer directly where law permits.
Children and young people
IYEC serves youth and may offer programs to people below 18. The current self-service account and payment flows are intended for people aged 18 or older. A parent, lawful guardian, school, or authorised institution must contact IYEC before a minor uses an account-based, paid, mentoring, event, or application service, unless a specific supervised program provides another approved process. The general website is not directed to children under 13. We do not knowingly collect personal data online from a U.S. child under 13.
If we learn that data was collected from a child contrary to this rule, we will restrict the account and delete or lawfully retain the data as appropriate. Parents or guardians may contact us to review or request deletion. See our Child and Youth Safety Policy.
Complaints and updates
First contact our Grievance Officer using the process in the Grievance Redressal Policy. You may also complain to the Data Protection Board of India or another competent privacy authority when the relevant legal provisions apply.
We may update this policy for legal, technical, or service changes. Material changes will be highlighted on the site or sent through a reasonable channel. The effective date above identifies the current version.
Contact and legal notices
Indian Youth Entrepreneurship Council Foundation
CIN: U85500UP2026NPL247715
Registered office: C/O Anita, Kanakpur, Mayabazar, Faizabad, Uttar Pradesh 224161, India
Email: contact@iyec.in
Toll-free: 1800 309 8565
Website: iyec.in
When contacting us about an account, payment, privacy request, complaint, or legal notice, include enough information to identify the relevant transaction or account. Do not send passwords or full payment-card details.