Privacy Policy

01Who we are, and which role we are in

This policy is issued by Rooman Technologies Pvt. Ltd. ("Rooman", "we", "us"). It covers this website, erp.rooman.net, and the Rooman One platform — the academic ERP, the CRM and the social publishing tools that run on it.

Rooman handles personal data in two distinct roles, and almost every question about your data has a different answer depending on which one applies to you. Please read the one that describes you.

If you are a learner, enquirer, referral partner or website visitor

You dealt with Rooman directly — you submitted an enquiry, enrolled in a course, joined the referral program, or simply browsed this site. Rooman decides why and how your data is used, which makes Rooman the Data Fiduciary under India's Digital Personal Data Protection Act 2023 (the equivalent of a "controller" under the GDPR). Your requests come to us, and we answer them.

If your data is in Rooman One because your institute put it there

You are a student, employee or contact of a training institute that licenses Rooman One. Your institute decides what is collected, who may see it and how long it is kept. Rooman only stores and processes it on that institute's instructions, which makes Rooman a Data Processor and your institute the Data Fiduciary.

This matters practically: we cannot correct or erase your record on your own request, because it is not ours to change. Contact your institute, and they can act on it directly in the system. If you are not sure who to ask, write to us at info@rooman.net and we will point you to the right institute.

02What we collect

We collect only what a specific purpose needs. The categories below are the complete set; we do not buy personal data from brokers or scrape it from third-party sources.

Data you give us directly

• Course enquiries. Name, mobile number, email, gender, qualification, city and state, the course and centre you are interested in, how you heard about us, your work experience if you tell us, and any document you choose to attach.
• Enrolment. If you join a program, the academic record that follows — batch, attendance, assessment results, fee payments and invoices, certification and placement details.
• Referral partners. Your contact details, the referrals you make, and the payout information needed to pay a commission.
• Support requests. The name, email, optional phone number, organisation and message you submit on our support page.
• Account credentials. A username and a password, which is stored only as a salted hash — we cannot read it, and neither can anyone who obtains a copy of the database.

Data collected automatically

• Security and delivery data. IP address, browser user-agent and timestamps, recorded when you submit a form or sign in. These exist to rate-limit abuse and investigate security incidents, not to profile you.
• Session state. Authentication tokens held in your browser so that you stay signed in between pages.

Data an institute loads into Rooman One

When an institute uses the platform it uploads records about its own students, enquiries, employees, attendance, fees and communications. The institute chooses that content. We describe how we protect it in section 5 and how long we keep it in section 7.

What we do not collect

We do not ask for and do not want payment card numbers — card payments are handled by our payment gateway, which receives the card details directly; Rooman receives only the transaction result. We do not knowingly collect data from children under 18 through this website except where an institute enrols a minor learner, in which case the institute is responsible for obtaining verifiable parental consent as the DPDP Act requires.

03Why we use it, and on what legal basis

Under the DPDP Act we must have a lawful ground for every use. In almost every case that ground is your consent, given when you submit a form, or the necessity of performing a contract you have entered into with us.

• To respond to your enquiry — a counsellor contacts you about courses, fees, batch timings and your nearest centre. Basis: your consent, given when you submit the enquiry form.
• To deliver a course you enrolled in — admissions, batch allocation, attendance, assessment, invoicing, certification and placement support. Basis: performance of our contract with you.
• To operate Rooman One for an institute — hosting, processing and making the institute's records available to its authorised staff. Basis: our contract with the institute, on whose documented instructions we act.
• To answer a support request — investigating and replying to what you asked. Basis: your consent.
• To pay referral commissions — tracking which referrals converted and what is owed. Basis: performance of the referral agreement.
• To keep the service secure and working — rate limiting, abuse prevention, audit logging, backups and debugging. Basis: our legitimate interest in a service that is not abused, and our legal obligation to protect the data we hold.
• To meet statutory obligations — tax, accounting and skilling-scheme reporting where a program is run under a government scheme. Basis: legal obligation.

Marketing. If you enquire about a course we will contact you about that course and closely related programs. We send WhatsApp, SMS and email campaigns only where you have consented, and every one of them carries a way to opt out. Withdrawing consent stops the marketing; it does not affect a course you are already enrolled in, because that runs on the contract instead.

We do not sell your personal data, and we do not share it with third parties for their own advertising.

04Who we share it with

We disclose personal data only in the situations below, and only the minimum the situation needs.

• Rooman staff and training centres. Access is role-based: a counsellor sees their own leads, a centre manager sees their centre, management sees the network. Access is logged.
• Franchise partners. Where you enquire about or enrol at a partner-operated centre, that centre receives the details it needs to counsel and teach you.
• Service providers we rely on. Cloud hosting and storage, email delivery, SMS and WhatsApp messaging, and payment processing. They act on our instructions under contract and may not use your data for their own purposes.
• Scheme and certification bodies. Where a program is delivered under a government skilling scheme or leads to a third-party certification, the data those bodies require for enrolment, assessment and certification.
• Legal and safety disclosures. Where we are required by law, a court order or a lawful request from a public authority, or where disclosure is necessary to establish or defend a legal claim.
• A successor entity in a merger, acquisition or restructuring — under the same protections described here.

Data belonging to different organisations on Rooman One is kept separated at the row level, so one institute's staff cannot query another institute's records. Disclosing one customer's data to another is not something we do.

05How we protect it

No system is perfectly secure, and a privacy policy that claims otherwise is not telling the truth. These are the specific measures in place:

• Encryption in transit. The site and API are served over HTTPS/TLS only.
• Passwords are never stored in readable form. They are salted and hashed, and strength rules are enforced when one is set.
• Role-based access control. Every account is scoped to a role and an organisation; users see only what their role allows.
• Tenant isolation. Every record carries the organisation it belongs to, and queries are filtered on it, so data cannot cross between customer organisations.
• Audit logging. Sensitive account operations — password changes, email changes — are recorded with a timestamp and IP address.
• Rate limiting on sign-in, password reset and public forms, to blunt credential-stuffing and spam.
• Managed, backed-up infrastructure. The database runs on managed cloud infrastructure with automated backups.

If a personal data breach occurs that is likely to affect you, we will notify the Data Protection Board of India and affected individuals as the DPDP Act requires. Where Rooman is the processor for an institute, we notify that institute without undue delay so it can meet its own obligations.

06Your rights, and how to use them

Under the DPDP Act 2023 you have the right to access a summary of the personal data we hold about you and how it is processed; to have inaccurate or incomplete data corrected, updated or completed; to have data erased where it is no longer needed for the purpose it was collected for and no law requires us to keep it; to withdraw a consent you previously gave, as easily as you gave it; to nominate someone to exercise these rights on your behalf if you die or become incapacitated; and to have a grievance heard and answered.

Where to send the request — this is the part people get wrong

If you dealt with Rooman directly — you enquired, enrolled, referred someone or contacted support — write to info@rooman.net. We will verify your identity before acting, because acting on an unverified request is itself a data breach, and we will respond within 30 days.

If your data is in Rooman One because your institute put it there, send the request to your institute, not to us. We are the processor; acting on your request without the institute's instruction would mean changing their records on the word of someone we cannot authorise. If you contact us by mistake we will tell you who to approach — we will not simply ignore it.

Exercising these rights is free. We may decline a request that is manifestly unfounded or repetitive, or where a law requires us to retain the data, and where we decline we will tell you why.

07How long we keep it

We keep personal data only as long as the purpose needs, or as long as a law requires — whichever is longer.

• Enquiries that do not convert are kept while the enquiry is active and for a limited follow-up period afterwards, then deleted or anonymised for statistics.
• Student academic records — enrolment, assessment, certification — are kept for as long as a former learner may need to prove a qualification, and for any period a certifying or scheme authority mandates.
• Financial records — invoices, receipts, payments — are retained for the period required by Indian tax and accounting law.
• Support requests are kept long enough to resolve the issue and see whether it recurs.
• Security and audit logs are kept for a limited period for incident investigation.
• Institute data on Rooman One is retained for as long as that institute's subscription is active. On termination it is handled as the customer agreement sets out — see the data ownership clause in our Terms.

Backups are cycled on their own schedule, so data erased from the live system may persist in an encrypted backup for a short period before it is overwritten.

08Cookies and browser storage

We keep this deliberately minimal. The public pages of this site do not run third-party advertising or cross-site tracking cookies, and we do not sell or share browsing behaviour with ad networks.

• Strictly necessary storage. When you sign in, your browser holds an authentication token and session state. Without it you could not stay signed in, so it cannot be switched off while you are using the application.
• Preferences. Small items such as a saved list view or a dismissed notice, stored locally in your browser.

You can clear this storage at any time in your browser settings; doing so signs you out and resets your preferences. If we later add analytics or marketing cookies we will update this section and ask for consent before setting them.

09Where your data is stored

Rooman One runs on managed cloud infrastructure. Some of that infrastructure, and some of the service providers listed in section 4, may process or store data outside India. Where that happens we rely on contractual protections with the provider and transfer only what the service requires, in line with the DPDP Act's restrictions on cross-border transfer. Institutes with a specific data-residency requirement should raise it before subscribing so it can be addressed in the contract.

10Changes to this policy

We update this policy when our practices, the platform or the law change. The "last updated" date at the top always reflects the current version. Where a change materially affects your rights we will give notice — by email to account holders, or a notice on this site — before it takes effect. Continuing to use the service after a change takes effect means you accept the updated policy.

11Contact and grievance redressal

For any question about this policy, to exercise a right, or to raise a grievance about how your data has been handled, contact our Grievance Officer. Section 13 of the DPDP Act gives you the right to a response, and we will acknowledge your complaint and respond within 30 days.

If you are not satisfied with our response you may complain to the Data Protection Board of India. For anything that is not a privacy matter, our support page is the faster route.