Privacy Policy

1. Who we are

This Privacy Policy explains how we handle personal data on the CatalystBox Marketplace at marketplace.catalystbox.in (the "Platform").

Data Fiduciary CATALYSTBOX (OPC) PRIVATE LIMITED CIN: U62011UP2026OPC244687 GSTIN: 09AANCC5886G1Z1 Registered office: P-10, K-376, Chinhat, Ganeshpur Rahmanpur, Lucknow, Uttar Pradesh — 226028, India Email: hello@catalystbox.in

For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), CATALYSTBOX (OPC) PRIVATE LIMITED is the Data Fiduciary for personal data processed through the Platform.

2. Scope

This Policy applies only to the CatalystBox Marketplace at marketplace.catalystbox.in and its dashboards, checkout, and communications.

Other CatalystBox websites and products are governed by their own separate privacy notices. If you reached us from another site, read the notice that applies there.

3. Language

This notice is available in English. On request, we will provide it in any language specified in the Eighth Schedule to the Constitution of India. Write to hello@catalystbox.in and tell us which language you need.

4. The Platform is for adults only

The Platform is for institutions, intervention providers, teaching and non-teaching professionals, staffing partners, CSR funders, verifiers, partner organisations, and their authorised representatives.

You must be 18 or older to use the Platform. We do not knowingly collect personal data of anyone under 18, and we do not process children's personal data through the Platform. Because we do not process children's data, we do not carry out behavioural monitoring or targeted advertising directed at children.

Users must not upload student personal data. Our Terms of Use prohibit introducing any personal data of a person under 18 into the Platform — including student names, roll numbers, contact details, photographs, assessment records, health information, or student-level feedback. If you believe such data has been uploaded, tell us at hello@catalystbox.in and we will remove it.

If you believe a person under 18 has created an account, contact us and we will suspend and delete it.

5. What we collect

We collect only what the Platform needs to work. What we hold depends on your role.

5.1 Everyone with an account

• Name and email address
• Password credentials, managed by our authentication provider (we do not store your password in readable form)
• Role and organisation membership
• Account and activity timestamps
• Communications you send us

5.2 Institutions (schools, colleges, universities and their staff)

• Institution name, type, board or affiliation, management type, parent university where applicable
• Postal address and location
• Contact person's name, designation, email, and phone number
• Email and phone verification status
• Group, trust, or society name where applicable
• Declared improvement needs, requirements, and the benchmark parameters selected against them
• Vacancies, job posts, shortlists, applications received, and hiring activity
• Verification records, evidence submitted, and engagement history
• Where an institution chooses to connect an external diagnostic score (clause 9), the score only

5.3 Providers and staffing partners

• Organisation name, category, and service catalogue
• Contact person's name, email, and phone number; verification status
• Vetting submissions, scorecards, credentials, and supporting documents
• Listings, proposals, responses, promotions, and engagement records
• Subscription tier, plan history, and billing records
• Reviews received

5.4 Teaching and non-teaching professionals (candidates)

• Full name, preferred name, contact email, phone number
• Curriculum vitae, including the file you upload and its stored location
• Qualifications, experience, subjects, languages known, and goal areas
• Applications submitted and their stage
• Declared career or development needs
• Plan and billing records where you subscribe to a paid tier
• Profile photograph where you choose to add one

5.5 CSR funders

• Organisation and legal entity name
• Contact person's name, email, phone number
• PAN, where required for licensing, invoicing, or statutory purposes
• Licence, seat allocation, commitments, and consent settings
• Cohort application details

5.6 Verifiers, volunteer experts, partner organisations, and internal staff

• Name, contact details, agency or organisation affiliation
• Organisational registration identifiers where the role requires them
• Skills, qualifications, languages, availability, and service locations
• Assignment records
• Background-check status, where applicable to the role

5.7 Payment and billing data

• Amount, currency, payment status, transaction and order references
• Gateway payment, order, and subscription identifiers
• The provider's linked-account identifier for settlement
• Plan, tier, billing period, and invoice records
• GSTIN where you supply one

We never receive or store your card number, CVV, UPI PIN, net-banking credentials, or bank account credentials. These go directly to our payment partner. Card data never touches our systems, so our Platform is outside the scope of PCI-DSS; our payment partner maintains that certification for the payment flow.

5.8 Technical, security, and usage data

• Session and usage events: an event name, a session identifier, your account identifier where you are signed in, your role, the page or screen, the referring page, and a timestamp
• Production error diagnostics: an error type and message after automated redaction, stack trace and source location, application release and environment, and timestamp. We configure this service without user identity, session replay, behavioural breadcrumbs, cookies, request headers or bodies, authentication data, query parameters, local variables, logs, or performance traces.
• Login device records, including a hashed device identifier, used to recognise your devices and detect suspicious sign-ins
• Push notification subscriptions, including a device label and browser user-agent string, where you enable notifications
• Notification delivery logs and error records
• Security audit events, including sign-in and permission changes
• Where you submit certain public forms, a coarse network signal used for abuse prevention

5.9 Communications and content

• Messages, threads, proposals, and attachments exchanged on the Platform
• Documents and evidence files you upload
• Reviews and ratings you write
• Suggestions and feedback you send

5.10 Information from other sources

• Publicly available institutional information, such as school and college directory records, board affiliation, and official contact details published by education authorities. This is institutional information, not personal data about you, though it may include a publicly listed official contact.
• Verification and payment onboarding results returned by our payment partner when a provider completes identity and bank verification.
• Information from your organisation, where a colleague invites you to an organisation account or submits information on your behalf.

We do not buy personal data from data brokers or lead-generation vendors.

6. Why we process it, and our legal basis

Under the DPDP Act we process personal data on the basis of your consent, or where the Act permits processing for a legitimate use — including where you voluntarily provide data for a specified purpose, and to comply with law.

We do not use payment from any party to influence a match ranking or a verification result.

We will not use your personal data for a new purpose that is incompatible with the one it was collected for without telling you and, where required, asking for your consent.

7. What we never do

• We never sell personal data.
• We never sell an institution's identity.
• We never let payment change a merit ranking or a verification result.
• We never use your personal data to train or fine-tune artificial intelligence models, ours or anyone else's.
• We never use cross-site tracking, advertising pixels, or retargeting technology.
• We never share personal data with data brokers or advertising networks.

8. Artificial intelligence processing

Parts of the Platform use AI to assist with drafting, summarising, matching support, and safety review. Where AI is used:

1. Content you submit for an AI-assisted feature is sent to a third-party AI processor for that purpose only.
2. We retain a record of the request and the output so the feature is auditable and so we can review it for safety and quality.
3. Your content is not used to train the AI provider's models.
4. AI outputs are suggestions. They do not by themselves determine vetting status, match ranking, verification results, or any other decision that materially affects you. We do not make solely automated decisions that produce legal or similarly significant effects.

9. Externally sourced diagnostic scores

An institution may choose to connect an external diagnostic benchmark score to its marketplace account.

1. Connecting a score is always optional and requires the institution's explicit opt-in. The Platform works fully without it.
2. Only the aggregate institutional score crosses the interface. The individual student, teacher, or parent responses behind that score never enter the Platform and we never receive them.
3. The institution can withdraw this consent at any time, after which no further score is imported.
4. Diagnostic enrichment is never a prerequisite for using the Platform.

10. Who we share personal data with

10.1 Other users of the Platform

• Institutions and providers see what a match, proposal, or engagement requires. Some information is masked at earlier stages depending on plan and workflow.
• Institutions and staffing partners see a candidate profile and CV when the candidate applies to their vacancy, or when the candidate has explicitly enabled recruiter discoverability and the recruiter has the relevant access. A paid plan alone does not enable discoverability. Candidates can turn recruiter discoverability off again from My Profile; this does not hide applications they already sent from the receiving institution.
• Funders see aggregate, anonymised intelligence. An institution's identity is visible to a funder only where that institution has given explicit consent.
• Verifiers see what is needed to carry out an assigned verification.

You control much of this by choosing what to publish and whom to engage.

10.2 Service providers (Data Processors)

We use third parties to run the Platform. Each processes personal data only on our instructions, for the purpose we specify, under contractual terms.

Changes to this list. We will update this table before or when a new processor starts handling personal data. Where the change is material — a new category of data, or a new country — we will notify account holders.

10.3 Payment partner

Payments are processed by Razorpay Software Private Limited, a payment aggregator authorised by the Reserve Bank of India. It receives the transaction data it needs to process, hold, and settle payments, and handles all payment-instrument data under its own privacy policy and regulatory obligations. Funds are held in its designated escrow account, not by us.

CatalystBox does not currently operate provider payment onboarding or escrow settlement. If that workflow is activated, the payment partner will carry out the required identity and bank verification under its own obligations, and this Policy and the checkout notice will be updated before use.

10.4 Legal and protective disclosures

We may disclose personal data where required by law, regulation, court order, or a valid request from a competent authority, or where necessary to establish, exercise, or defend legal claims, prevent fraud, or protect the rights and safety of any person. We do not volunteer data in the absence of a lawful obligation, and we will notify you where the law permits.

10.5 Corporate transactions

If CatalystBox is involved in a merger, restructuring, conversion of corporate form, or sale of assets, personal data may transfer as part of that transaction. This Policy will continue to apply, or you will be notified of any new notice that governs.

11. Cookies, storage, and analytics

We use cookies and similar browser storage. In summary:

• Strictly necessary — authentication and session tokens that keep you signed in and protect the Platform. These cannot be switched off.
• Functional — storage created when you ask the Platform to remember an interface preference or draft; it is not controlled by the analytics choice.
• Analytics — first-party usage events, described in clause 5.8, that tell us which features are used and where the Platform is failing.
• We use no advertising, remarketing, or cross-site tracking technology.

Where required, we ask for your consent for non-essential cookies and analytics, and give you controls to change your choice. Full detail is in our Cookies and Storage Policy.

12. Transfers outside India

As set out in clause 10.2, some of our processors store or process personal data outside India — principally in South Korea and the United States, and on globally distributed hosting infrastructure.

We make these transfers subject to contractual protections and in accordance with the DPDP Act, which permits transfers other than to countries the Central Government restricts. If any restriction is notified that affects our arrangements, we will change them.

We do not currently offer India-only data residency on this Platform. If that matters to your procurement, tell us before you subscribe.

13. How long we keep it

Statutory retention overrides deletion. Where the Companies Act, 2013, GST legislation, the Income-tax Act, 1961, or any other law requires us to keep a record — books of account, invoices, and transaction records in particular — we will keep it for the statutory period even if you have asked for deletion. We will restrict its use to that legal purpose.

We may also retain data where it is needed to establish, exercise, or defend a legal claim, or where a dispute is open.

When a retention period ends, data is deleted or irreversibly anonymised.

14. Security

We apply technical and organisational safeguards appropriate to the data we hold. In particular:

• Encryption in transit using TLS, and encryption at rest on our database and file storage
• Row-level access controls, so users can reach only the records their role permits
• Role-based permissions and audited privilege changes
• Hashed password credentials and hashed device identifiers
• Security audit logging of sign-ins and permission changes
• Restricted administrative access

We describe only the safeguards we actually operate. As the Platform matures we will add further controls — including multi-factor authentication for account holders and independent security testing — and we will update this clause when we do rather than in advance of it.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal without delay, describing the breach, the data involved, the likely consequences, the measures we are taking, and what you can do — in line with the DPDP Act and the rules made under it.

15. Your rights

Under the DPDP Act, you have the right to:

1. Access — obtain a summary of the personal data we process about you, the processing activities, and the identities of others with whom we have shared it.
2. Correction, completion, and updating — have inaccurate or incomplete data corrected or completed. Most of this you can do yourself in your account settings.
3. Erasure — ask us to delete personal data where it is no longer needed for the purpose it was collected for, subject to clause 13.
4. Withdraw consent — withdraw a consent you gave, at any time, as easily as you gave it. Withdrawal does not affect processing already carried out, and may mean we can no longer provide part or all of the service.
5. Nominate — nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
6. Grievance redressal — complain to us about how we handle your data or your rights request.

To exercise a right, write to hello@catalystbox.in from the email address on your account, or use the controls in your account settings. We may need to verify your identity. We will respond within the timelines the law prescribes and, in any case, without undue delay. We do not charge for exercising these rights.

You also have the right to escalate. If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.

16. Your duties as a Data Principal

The DPDP Act asks you to provide accurate information, not to impersonate anyone, not to suppress material information where you are supplying it for a legal purpose, and not to file false or frivolous grievances.

17. Marketing communications

We send service and transactional messages — account notices, matches, applications, billing — because they are part of the service, and you cannot opt out of them while your account is active.

Marketing messages are sent only with your consent. Every marketing email carries an unsubscribe link, and you can change your preferences in Account → Notifications. Unsubscribing from marketing does not affect service messages.

18. Grievance Officer

Grievance Officer Name: Yatesh Srivastava Designation: Grievance Officer, CATALYSTBOX (OPC) PRIVATE LIMITED Address: P-10, K-376, Chinhat, Ganeshpur Rahmanpur, Lucknow, Uttar Pradesh — 226028, India Email: hello@catalystbox.in

We acknowledge within 48 hours and aim to resolve within 30 days. For urgent security matters, mark your subject line URGENT: Data Security.

If you are not satisfied, escalate to the Data Protection Board of India.

19. Users outside India

The Platform is designed for, and offered in, India. We do not target users in the European Economic Area, the United Kingdom, or California, and we have not appointed a representative under the EU or UK GDPR.

If you access the Platform from a jurisdiction whose law gives you rights beyond those in clause 15, write to us and we will consider your request in good faith. We do not claim compliance with the GDPR, the UK GDPR, or the CCPA/CPRA, and you should not rely on this notice as though we did.

20. Changes to this Policy

See the standing rule at the top of this document. The current version is always at marketplace.catalystbox.in/privacy, with the version number and date at the top. We keep previous versions available on request.