Certiflo Privacy Policy

This Privacy Policy explains how Senement handles Personal Data through Certiflo, its certificate management platform, when Organizations register, upload participant lists, generate or send certificates, manage organization profiles, use verification pages, or contact Certiflo Support. It should be read with the Certiflo Terms of Service & Acceptable Use Policy. Processing is subject to applicable Indian law, including the Digital Personal Data Protection Act, 2023, its applicable rules and the Information Technology Act, 2000, as in force.

Senement acts as a Data Fiduciary for information it collects to manage organization accounts, provide support, operate and secure the Platform, and understand usage. For participant information uploaded by an Organization to issue certificates, Senement generally acts as a Data Processor on that Organization’s instructions. The Organization is generally responsible for deciding why participant data is collected, ensuring a lawful basis and required consent, providing privacy notices, and handling participant requests.

Depending on the features used, information may include organization account data, participant data, security credentials, and verification technical logs.

We collect information directly when an Organization registers or uploads a file, when a recipient opens or verifies a certificate, when a visitor uses the site, or when someone contacts support. We may also receive technical delivery logs from hosting, email, security, analytics or other providers used to run the Platform.

To resolve technical problems, assist an Organization, maintain the service, investigate fraud or security incidents, or comply with law, authorized Senement/Certiflo administrators and support personnel may inspect the relevant Organization profile, account settings, uploaded participant records, certificate records and technical logs.

We use commercially reasonable technical, organizational and administrative measures appropriate to the nature of the information and the service. Depending on implementation, these may include encryption in transit and/or at rest, role-based access controls, authentication, restricted staff permissions, logging, monitoring, backups, vulnerability management and incident-response procedures.

We may share only the information reasonably necessary with service providers that help us host the Platform, send certificate emails, monitor errors and security, provide customer support, analyze usage, or process payments if applicable. Such providers may process data in India or other locations depending on their infrastructure and applicable law.

A certificate verification page may display information contained on the certificate, such as the participant’s name, issuing Organization, event or achievement, issue date, certificate identifier and status. This display is necessary for recipients and authorized verifiers to confirm authenticity. Organizations should not place unnecessary Personal Data on certificates and should inform participants that certificate details may be visible to people who have the verification link or access to the verification page.

We retain Personal Data for the time reasonably necessary to provide the service, keep certificates verifiable as directed by the Organization, maintain security and audit records, resolve disputes and meet legal obligations.

Subject to applicable law, individuals may have rights to request access to information, correction or updating of inaccurate data, deletion, withdrawal of consent where processing is based on consent, grievance redressal and other statutory rights.

Organizations are responsible for identifying when participant data relates to a child and obtaining verifiable parental or guardian consent and any other authorization required by law before uploading it. Organizations must follow their own institutional requirements and applicable child-data rules. Certiflo should not be used to collect children’s data beyond what is necessary for legitimate certificate issuance and verification.

The Platform may use essential cookies or similar technologies to maintain sessions, protect accounts, remember preferences, diagnose errors and understand service performance. If analytics tools are used, they should be configured to limit or anonymize identifiers where feasible. Users can manage cookies through browser settings, but disabling essential cookies may affect Platform functionality.

Service providers may process or store data outside the user’s state or country. Any transfer will be subject to applicable Indian law and safeguards required at the time. The Platform may link to third-party websites or services; we are not responsible for their independent privacy practices. Review their policies before providing information to them.

If Senement becomes aware of a Personal Data breach affecting Certiflo, it will assess and investigate the incident, take reasonable steps to contain it and mitigate harm, preserve relevant records, and notify affected individuals and authorities within the time and manner required by applicable law that is in force and applies to the incident.

As Certiflo adds or changes certificate delivery, verification, account administration or security features, Senement may update this Policy to reflect the actual service, its providers, security practices or applicable law. Material changes will typically be communicated through Certiflo or the registered email 14–30 days before taking effect where practicable. The effective date and version will be updated when the Policy changes.

For privacy requests, complaints, suspected breaches, and grievance redressal under Indian data protection law, contact our team.