Privacy Policy

Version 1.1 · Last updated 11 September 2026

i45G (“i45G”, “we”, “us”, “our”) is a trade name of Bhagath Singh Karunakaran.

We run educational programmes, workshops, assessments, learning platforms and related advisory services — directly, and on behalf of schools, colleges, universities, employers and other organisations that engage us.

This Privacy Policy explains what personal data we collect, why we process it, who we share it with, how long we keep it, how we protect it, and what you can ask us to do about it.

It applies when you:

• visit our website;
• create or use an i45G account;
• register for or take part in an i45G programme;
• complete an assessment, survey, reflection or feedback form;
• use an i45G learning or programme platform;
• use a supported authentication or external-service connection;
• make a payment;
• communicate with us; or
• otherwise use a service through which i45G processes your personal data.

This Policy is a notice, not a contract. Visiting our website does not by itself mean you have agreed to anything.

Where the law requires your consent, we ask for it separately, in plain words, at the point where it matters, and we record what you agreed to and when.

Read this Policy together with any programme-specific privacy notice, registration notice, assessment notice or consent screen shown to you.

Where such a notice is more specific about a particular programme or activity, it should be read together with this Policy and governs that specific processing.

On this page

• Words used in this Policy
  1. Who we are and how to reach us
  2. Our role — when we decide and when a Partner decides
  3. What personal data we collect
  4. How we obtain personal data
  5. Why we process personal data
  6. Assessments, reflections and how results are used
  7. AI-assisted analysis and technology providers
  8. Communications and why marketing is a separate question
  9. Candidates under 18
  10. Who we share personal data with
  11. Aggregated, de-identified and anonymised information
  12. How long we keep personal data
  13. How we protect personal data
  14. If something goes wrong
  15. Where personal data is processed
  16. Your rights
  17. Withdrawing consent
  18. If your data came through your college, school, university or employer
  19. Grievances
  20. Cookies and website analytics
  21. Links and connections to other services
  22. How this Policy relates to the DPDP Act and Rules
  23. Changes to this Policy
  24. Data deletion
  25. Contact

Words used in this Policy

You — anyone whose personal data we hold, including a candidate taking part in a programme, an account holder, a contact at a Partner, or a visitor to our website.

Candidate — a person moving through an i45G programme, including registration, participation, assessment and progression through programme stages.

Partner — a school, college, university, employer or other organisation that has engaged i45G to run a programme, assessment or workshop, or that funds or arranges participation in one.

In this Policy, “Partner” does not mean an advertiser, data broker or any arrangement in which personal data is exchanged for value.

Data Fiduciary, Data Processor and Data Principal — the roles defined in the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

A Data Fiduciary determines the purpose and means of processing personal data, alone or together with others.

A Data Processor processes personal data on behalf of a Data Fiduciary.

A Data Principal is the individual to whom the personal data relates — that is you.

1. Who we are and how to reach us

i45G is a trade name of:

Bhagath Singh Karunakaran

operating in India.

Website: https://i45g.com

Privacy and Grievance Contact

Email: info@i45g.com

We publish a privacy and grievance contact rather than describing that person as a statutory Data Protection Officer.

Under the DPDP Act, a formal Data Protection Officer is required for a Significant Data Fiduciary. i45G has not been notified as a Significant Data Fiduciary.

If that changes, we will publish the appropriate Data Protection Officer’s business contact details here.

2. Our role — when we decide and when a Partner decides

Our role depends on who determines why and how personal data should be processed.

Where i45G decides

Where i45G independently determines the purpose and essential means of processing, i45G acts as the Data Fiduciary.

This may include circumstances where you:

• create an account directly with us;
• buy or enrol in a programme directly from us;
• contact us directly;
• use our platform independently of a Partner programme;
• ask to receive information from us; or
• provide personal data for another purpose determined by i45G.

For that processing, this Policy, together with any applicable programme or consent notice, describes how we use your personal data.

Where a Partner decides

Where a school, college, university, employer or other organisation determines the purpose and essential means of a programme or assessment and engages i45G to process personal data on its behalf, that Partner is generally the Data Fiduciary and i45G acts as its Data Processor.

In such cases, i45G processes personal data under a written engagement and on the Partner’s documented instructions.

The Partner may determine matters such as:

• why the programme is being conducted;
• who participates;
• what information is required;
• what results are needed; and
• how those results will be used.

The distinction matters.

Taking part in a Partner-commissioned programme does not, by itself, give i45G permission to:

• market another programme to you;
• create a continuing identifiable profile of you after the engagement;
• combine your identifiable data across different Partners;
• use your identifiable programme data for unrelated purposes; or
• use your photograph, testimonial or personal story for advertising.

If i45G independently determines a separate purpose for processing your personal data, i45G is responsible as Data Fiduciary for that separate processing.

Where consent is required for that separate purpose, we ask for it separately.

3. What personal data we collect

What we collect depends on the programme or service you use.

It may include the following.

Identity and contact data

This may include:

• name;
• mobile number;
• email address;
• WhatsApp number, where provided; and
• other contact information needed for the service.

Age and eligibility data

This may include:

• date of birth; or
• other age-related information

where required to determine eligibility to create an account or participate in a programme.

Affiliation and academic data

This may include:

• school;
• college;
• university;
• employer;
• register number;
• admission ID;
• employee ID;
• department or branch;
• degree or programme;
• year of study;
• cohort;
• batch; or
• section.

Programme and progression data

This may include:

• registrations;
• invitations;
• attendance;
• programme activity;
• submissions;
• milestones;
• programme or tier progression; and
• outcomes.

Assessment and learning data

This may include:

• assessment responses;
• diagnostic responses;
• pre-programme responses;
• post-programme responses;
• scores;
• results;
• rankings where a programme genuinely uses them;
• participation records; and
• recommendations, groupings or learning insights derived from those responses.

Reflections and free-text responses

You may choose to tell us about matters such as:

• career intentions;
• concerns;
• learning habits;
• use of AI tools;
• projects;
• internships;
• portfolio activity;
• code-hosting activity; and
• areas where you would like more support.

These questions are optional unless particular information is genuinely required for the activity and is identified as such.

Programme feedback

This may include:

• ratings;
• facilitator feedback;
• comments;
• suggestions; and
• reflections on the programme.

Assessment-integrity data

Where an assessment is invigilated, our system may record:

• whether the assessment tab lost focus;
• whether the browser left full-screen mode;
• when this occurred; and
• how long it lasted.

We do not use your camera or microphone during an assessment, record your screen, or capture what you type outside your assessment responses.

Camera access for QR-code scanning

If you use an in-app scanner to scan an event or programme QR code, your browser or device asks for camera permission.

The QR code is decoded on your device.

No camera image or video is stored by i45G or transmitted to i45G merely as part of scanning the QR code.

Payment data

Where a programme has a fee, we may hold:

• payment reference;
• amount;
• payment status;
• invoice information; and
• contact information associated with the transaction.

Complete card or bank credentials are handled by the relevant payment provider and are not stored by i45G.

Meta, Facebook and other external-service connection data

Some i45G services may use Meta, Facebook or another external provider to authenticate a user or connect an authorised external service or business account.

Where you choose to use such a connection, we may receive limited information authorised through that connection, depending on the feature and permissions involved.

This may include:

• a provider-specific account identifier;
• name;
• email address;
• business-account or asset identifiers; or
• permissions needed for the particular feature.

We receive only the information and permissions required for the feature you choose to use.

We use such information to:

• authenticate or establish the connection;
• associate it with the correct i45G account or business context;
• maintain the security of the integration; and
• provide the feature that you requested.

We do not receive your Facebook, Meta or other external-provider password.

The exact information available to i45G depends on the permissions enabled for that integration.

Where we introduce a feature involving additional categories of personal data, we will update the relevant privacy notice before using that information for a new purpose.

Communication data

This may include:

• programme notifications;
• reminders;
• support requests;
• messages sent to us; and
• records required to resolve a query or complaint.

Technical and usage data

This may include:

• device type;
• browser information;
• application version;
• timestamps;
• security events;
• application logs; and
• limited technical information required to operate and secure the platform.

Where appropriate, our platform stores a keyed hash derived from an IP address rather than retaining the complete IP address itself.

4. How we obtain personal data

We may obtain personal data in four principal ways.

Directly from you

For example, when you:

• register;
• create an account;
• complete an assessment;
• submit a reflection;
• make a payment;
• give feedback;
• contact us; or
• provide information during a programme.

From a Partner

A school, college, university, employer or other Partner may provide information needed to organise or administer a programme for its members.

For example, the Partner may provide:

• participant rosters;
• institutional identifiers;
• programme eligibility information; or
• other information required for the agreed activity.

Through your participation

Information may be generated as you use the programme or platform, such as:

• attendance;
• assessment results;
• programme progress;
• completion records;
• platform activity; and
• security logs.

From an authentication or external-service provider

Where you choose to connect Meta, Facebook or another supported service, we may receive the limited information and permissions required to establish and operate that connection.

The external provider may also process information independently under its own terms and privacy policy.

5. Why we process personal data

Depending on the relationship and programme, we process personal data to:

• register you for programmes;
• establish and manage your account;
• verify eligibility;
• authenticate you;
• run workshops, assessments and learning activities;
• administer institutional programmes;
• measure learning outcomes;
• compare responses before and after a programme;
• identify concepts a cohort found difficult;
• provide feedback;
• prepare agreed reports;
• issue certificates and participation records;
• manage programme progression;
• process payments;
• provide support;
• respond to questions;
• send communications necessary for your programme;
• operate authorised integrations;
• maintain platform security;
• prevent fraud, misuse and unauthorised access;
• maintain necessary programme, contractual and financial records;
• comply with legal obligations; and
• where you have separately permitted it, or another lawful basis applies, tell you about other i45G programmes and opportunities.

We aim to collect only the personal data a purpose genuinely requires and to stop using identifiable data when that purpose ends.

6. Assessments, reflections and how results are used

Assessments, diagnostics and reflections are primarily teaching and learning instruments.

They may help us or the relevant Partner understand:

• change in understanding;
• readiness;
• common misconceptions;
• problem-solving approaches;
• AI literacy;
• career preparedness;
• learning behaviour; and
• programme effectiveness.

A score is a snapshot of one exercise in a particular context. It is not a judgement about your intelligence, potential or employability, and we ask Partners not to treat it as one.

Reports to a Partner are aggregated at cohort level wherever the programme purpose allows.

Individual or named results are provided to a Partner only where:

• individual-level reporting forms part of the agreed programme;
• it is necessary to administer the programme;
• it is required for agreed follow-up;
• it is relevant to progression or sponsorship under the programme; or
• the Partner has otherwise lawfully instructed us to provide it within the scope of the engagement.

We do not intend automated analysis, acting by itself, to make a consequential decision about you such as:

• admission;
• academic qualification;
• employment;
• recruitment; or
• a comparable opportunity.

Where an assessment contributes to an i45G selection, sponsorship or progression decision, appropriate human judgement forms part of that process.

7. AI-assisted analysis and technology providers

We use software to:

• score assessments;
• compare responses before and after a programme;
• identify patterns;
• group similar answers;
• surface recurring themes in free-text feedback; and
• assist in preparing reports.

Some of these tools may be AI-assisted.

Our rules for using them are:

• We do not submit identifiable candidate personal data to consumer or publicly accessible general-purpose AI chat services.
• Where individual identity is not required for an analysis, we remove or minimise direct identifiers.
• We use aggregated, pseudonymised, de-identified or anonymised information appropriate to the purpose.
• Where an AI or technology provider processes personal data on behalf of i45G under a controlled service arrangement, we apply appropriate contractual restrictions concerning purpose, confidentiality, security, retention and further use.
• We do not authorise a technology provider to use candidate personal data to train its general-purpose models merely because that provider processes information for i45G.
• Where information remains reasonably capable of being linked back to an individual, we continue to treat it as personal data.
• AI-assisted analysis supports human judgement. It is not treated as unquestionable fact.
• A person from i45G reviews AI-assisted outputs before they become a material programme conclusion or form part of a Partner report where human review is appropriate.

8. Communications and why marketing is a separate question

Taking part in an assessment, workshop or Partner-commissioned programme is not the same as agreeing to receive marketing from i45G.

We may send communications necessary to deliver a programme you are participating in, including:

• invitations;
• reminders;
• schedule changes;
• assessment information;
• results;
• certificates;
• operational notifications;
• security communications; and
• support messages.

Where we want to contact you about unrelated i45G programmes, bootcamps, services or opportunities, we seek the appropriate permission separately where required.

We record marketing preferences separately from programme participation where appropriate.

You may withdraw marketing permission at any time.

Doing so does not prevent you from continuing with a programme you are otherwise entitled to participate in.

9. Candidates under 18

Under the DPDP Act, a person who has not completed 18 years of age is treated as a child.

We have designed our platform around a conservative under-18 model rather than relying on broad assumptions about consent.

Direct onboarding

The i45G platform is 18+ for direct onboarding by default.

We do not directly onboard a person we know to be under 18 into an ordinary i45G account or paid programme.

Participation through a Partner

An under-18 candidate may participate through a specific school, college, university or other authorised Partner arrangement established for that programme or event.

Where the Partner is the Data Fiduciary

Where the Partner determines the purpose and essential means of processing and acts as Data Fiduciary, the Partner is responsible for establishing the lawful basis for the child’s participation and for obtaining and verifying parental or guardian consent where applicable law requires it.

The respective responsibilities are recorded in the Partner engagement.

We may rely on the Partner’s documented confirmation that the necessary authority and verification have been established rather than routinely asking the Partner to transfer copies of parents’ identity documents to i45G where we have no independent need to hold them.

i45G processes the child’s personal data only for the documented Partner purpose and does not treat participation in that programme as permission for unrelated i45G marketing.

Where i45G is the Data Fiduciary

Where i45G independently determines a separate purpose for processing a child’s personal data, the Partner’s general institutional relationship is not itself permission for that processing.

i45G must establish an appropriate lawful basis and, where required, obtain or verify the applicable parental or guardian consent before carrying out that processing.

Marketing and profiling

We do not knowingly:

• market paid i45G programmes directly to children;
• use a child’s personal data for targeted advertising;
• build advertising profiles of children;
• track children across unrelated services for advertising; or
• treat participation in a Partner programme as permission to enrol a child into i45G marketing.

Communication about a separate paid i45G programme concerning someone we know to be under 18 should normally take place through the appropriate Partner, parent or lawful guardian.

Assessment integrity

Where an assessment is invigilated, the limited assessment-integrity signals described in Section 3 may be used to protect the fairness and integrity of the assessment.

They are not used for advertising or behavioural profiling.

If you are a parent or lawful guardian with a question about a child’s personal data, you may contact the relevant Partner or contact us at:

info@i45g.com

10. Who we share personal data with

We do not sell personal data.

We do not provide candidate personal data to advertisers or data brokers.

We disclose personal data only where there is a genuine reason connected with the service, programme or law.

This may include the following recipients.

The Partner running or sponsoring your programme

We may provide the programme information, results and reports agreed for that engagement.

Where a programme includes consideration for sponsorship or progression, information may be shared in accordance with the applicable programme-specific notice.

Assessment scores or other information are shared only to the extent required for the stated programme purpose.

Service providers acting on our instructions

These may provide services such as:

• application hosting;
• database hosting;
• infrastructure;
• one-time-password delivery;
• SMS;
• email;
• payment processing;
• messaging;
• security;
• error monitoring;
• document or content hosting; and
• other technology necessary to operate a programme.

Where such a provider processes personal data on our behalf, we require appropriate confidentiality, security and purpose-limitation protections.

Authentication and external-service providers

Where you choose to connect Meta, Facebook or another external provider, limited information will necessarily pass between i45G and that provider to establish or operate the connection.

The provider may also process information independently for its own authentication, security or service purposes under its own privacy policy and terms.

Professional advisers

We may disclose information to:

• accountants;
• auditors; or
• legal advisers

where genuinely necessary and subject to appropriate professional or confidentiality obligations.

Authorities

We may disclose personal data where required by:

• applicable law;
• a court;
• a competent regulator;
• a legally valid government request; or
• another legally binding process.

Protecting people and the platform

We may disclose information where reasonably necessary to investigate:

• fraud;
• abuse;
• unauthorised access;
• security incidents; or
• threats to the safety or legal rights of candidates, Partners, staff or i45G.

11. Aggregated, de-identified and anonymised information

We distinguish between information that has merely had obvious identifiers removed and information that is genuinely anonymous.

De-identified and pseudonymised information

During a programme, we may remove or replace direct identifiers so that people analysing information do not need to see names or other unnecessary identifying information.

For example, a candidate may be represented by a programme identifier rather than by name.

Where information remains reasonably capable of being linked back to an individual, we continue to protect it as personal data.

Merely replacing a name with an identifier does not, by itself, make information anonymous.

At the end of a Partner engagement

Identifiable and re-identifiable participant data processed on behalf of a Partner is returned, deleted, anonymised or retained only as required by:

• the relevant Partner agreement;
• the agreed programme purpose;
• applicable law;
• necessary audit or dispute requirements; or
• another lawful retention obligation.

Properly anonymised or genuinely aggregated information

We may retain information that has been properly anonymised or genuinely aggregated so that it no longer identifies, and is not reasonably capable of identifying, an individual.

We may use such information to:

• understand programme effectiveness;
• identify broad learning patterns;
• improve teaching methods;
• design future programmes;
• perform internal research;
• maintain institutional knowledge;
• understand cohort-level outcomes; and
• describe overall programme results.

We do not attempt to re-identify properly anonymised information.

Photographs, videos, quotations and testimonials

A photograph, video, identifiable quotation, testimonial or personal story is different.

Participation in a programme is not permission for us to use your identity, photograph, video, testimonial or personal story in marketing.

Where separate permission is required, we obtain it separately.

For a child, we apply the additional permissions and safeguards required for that child.

12. How long we keep personal data

We do not keep identifiable personal data indefinitely merely because storage is available.

Retention depends on why the information exists.

Account and programme records

We keep these while required to administer your account or programme and for a reasonable period afterwards where needed for:

• programme administration;
• evaluation;
• certificates;
• participation records;
• audit;
• support;
• complaints; or
• dispute handling.

Identifiable assessment responses and reflections

These are retained only for as long as reasonably required for the agreed educational purpose, such as:

• scoring;
• analysis;
• reporting;
• follow-up;
• progression; and
• appropriate audit.

Partner programme data

Where we process personal data on behalf of a Partner, return, deletion or continued retention follows the relevant Partner agreement and documented instructions, subject to applicable law.

An identifiable copy is not retained indefinitely merely because a cohort report was produced.

Partner reports

Properly anonymised or aggregated institutional reports may be retained as records of the engagement.

Where a report contains identifiable participant information, that identifiable information remains subject to the applicable retention requirements and Partner-processing boundary.

Consent and communication-preference records

We may retain sufficient records to demonstrate:

• what you agreed to;
• what you declined;
• when the choice was made; and
• whether a permission was later withdrawn.

Financial and contractual records

These are retained for the periods required by applicable:

• accounting;
• taxation;
• contractual;
• statutory; and
• dispute-resolution requirements.

Security records and logs

These are retained for periods appropriate to:

• platform security;
• incident investigation;
• fraud prevention; and
• applicable legal obligations.

Anonymised and aggregated information

Properly anonymised or genuinely aggregated information may be retained for longer because it no longer identifies an individual.

Inactive accounts

As an i45G internal retention target, we review accounts that have been inactive for approximately three years.

Where there is no continuing programme, contractual, institutional, security, financial or legal reason to retain identifiable information, we will erase or anonymise it.

A different retention period may apply to particular records where:

• the purpose for which they are retained;
• a Partner’s documented instructions; or
• applicable law

requires a different period.

You do not need to wait for the inactivity period to request deletion.

Our data-deletion instructions are available at:

Data Deletion

13. How we protect personal data

We apply administrative, technical and organisational safeguards proportionate to the nature of the information and the risks involved.

On our platform these include, where applicable:

• encryption in transit using TLS;
• encryption at rest for personal fields including name, mobile number, email address, date of birth, register or admission identifiers and payment contact information;
• keyed hashing of appropriate identifiers and authentication-related values;
• storing a keyed hash derived from an IP address rather than retaining the complete address where appropriate;
• role-based access controls;
• least-privilege database and application access;
• organisation- or tenant-scoped queries;
• append-only or equivalent audit records for sensitive actions;
• reduction or redaction of personal data in application logs;
• removal of unnecessary personal information from error reports;
• automated backups;
• encryption of appropriate backups;
• authentication and access controls; and
• contractual security obligations for service providers that process personal data on our behalf.

No information system can be guaranteed to be completely secure.

We therefore focus on operating proportionate safeguards, limiting access and reducing unnecessary collection rather than promising absolute security.

14. If something goes wrong

If we become aware of a personal data breach, we will take steps appropriate to the circumstances.

These may include:

• investigating what happened;
• containing the incident;
• determining what information was affected;
• determining whose information may have been affected;
• limiting further harm;
• correcting security weaknesses; and
• keeping appropriate incident records.

We will notify affected individuals, relevant Partners, the Data Protection Board of India and/or other competent authorities where and when applicable law requires us to do so.

Where we hold affected information solely as a Partner’s Data Processor, we will also notify and assist that Partner in accordance with our agreement and applicable law.

15. Where personal data is processed

Our primary application infrastructure and primary database are hosted in India.

However, some specialised services used by i45G may operate infrastructure or process limited information outside India.

This may occur, for example, where you choose to use:

• an external authentication provider;
• an external business-service integration;
• a communications provider;
• a payment provider;
• a security service;
• an embedded third-party service; or
• another specialised technology service.

Where a service provider acts as our Data Processor, we require appropriate confidentiality, security and purpose restrictions.

Where you independently choose to use a provider such as Meta or Facebook, that provider may also process information for its own purposes under its own privacy policy, infrastructure and terms.

We minimise the information disclosed to external providers according to the feature being used.

Your complete card or banking credentials are handled by the relevant payment provider and are not stored by i45G.

Where personal data is processed outside India, we will comply with the DPDP Act, applicable rules and any restrictions or requirements notified by the Government of India concerning processing outside India.

You may contact us for further information about material categories of service providers that process personal data in connection with i45G services.

16. Your rights

The Digital Personal Data Protection Act, 2023 comes into force in stages.

Subject to the applicable provisions being in force and to the conditions and exceptions provided by law, you may have rights to:

• ask for a summary of the personal data being processed about you and the processing activities being carried out;
• ask for information about certain recipients of your personal data where applicable law provides for it;
• ask us to correct inaccurate or misleading personal data;
• ask us to complete incomplete personal data;
• ask us to update personal data;
• ask us to erase personal data where the purpose no longer requires it and retention is not otherwise required by law;
• withdraw consent where consent is the basis for processing;
• raise a grievance about how personal data has been handled; and
• nominate another person to exercise applicable rights if you die or become incapable of exercising them.

Some requests have lawful limits.

For example, we may need to retain certain information to:

• comply with law;
• meet tax or accounting obligations;
• maintain necessary programme or institutional records;
• establish or defend legal claims;
• prevent fraud; or
• maintain system security.

If a request cannot be fully carried out, we will explain the reason where appropriate.

To exercise a privacy right, contact:

info@i45g.com

We may need to take reasonable steps to verify that the request genuinely comes from you or from someone legally authorised to act for you.

Our aim is to resolve ordinary privacy requests promptly and, where practicable, within 30 days.

Where applicable law prescribes a different deadline or permits additional time because of the nature or complexity of a request, the applicable legal requirement will govern.

17. Withdrawing consent

Where processing is based on your consent, you may withdraw that consent.

Depending on the service, this may be possible:

• through the control where the consent was originally given;
• through account settings;
• by deleting your account;
• by using an unsubscribe mechanism; or
• by contacting us.

Withdrawal applies from that point forward.

It does not make processing carried out lawfully before withdrawal retrospectively unlawful.

Withdrawing marketing permission stops the relevant promotional communication and does not, by itself, affect your participation in an existing programme.

Where the processing for which you withdraw consent is genuinely necessary to provide a service or programme, we may no longer be able to provide that part of the service.

Where relevant, we will explain that consequence before or when the withdrawal takes effect.

18. If your data came through your college, school, university or employer

If your personal data was collected as part of a programme arranged by a Partner, that Partner will often be the appropriate first point of contact because it determined why the programme was being conducted and may hold the wider institutional record.

You may still contact i45G.

Where we are acting only as the Partner’s Data Processor, we will:

• direct or pass the request to the relevant Partner where appropriate; and
• assist the Partner in handling the request in accordance with our agreement.

Where i45G independently determined the processing purpose and acts as Data Fiduciary, we will respond to you directly for that processing.

Requesting deletion of an i45G login does not necessarily require deletion of information that:

• the relevant Partner lawfully requires us to retain on its instructions; or
• applicable law requires to be retained.

19. Grievances

If you are unhappy with how personal data has been handled, please contact our Privacy and Grievance Contact:

info@i45g.com

Please provide enough information for us to understand and investigate the issue.

Do not email:

• passwords;
• one-time passwords;
• authentication tokens; or
• other authentication secrets.

We aim to acknowledge and investigate grievances promptly.

Our aim is to provide a substantive response to ordinary privacy grievances within 30 days where practicable.

Where applicable law provides a different maximum period or other requirements, we will follow those requirements.

Where the relevant processing was determined by a Partner, that Partner may be the Data Fiduciary responsible for the grievance.

We will assist in directing the grievance appropriately.

Where the applicable provisions of the DPDP Act and Rules are in force, and after you have used the grievance-redressal mechanism of the responsible Data Fiduciary, you may have the right to approach the Data Protection Board of India in accordance with applicable law.

20. Cookies and website analytics

Our public website — i45g.com

Our public website uses cookies and similar technologies required for the website and its essential functions.

At the time of this Policy, we do not use analytics or advertising trackers on the public i45G website.

We do not intentionally use the public website to:

• build advertising profiles of visitors; or
• track visitors across unrelated websites for advertising purposes.

If you submit a contact form, we use the information you provide to respond to your request and for associated legitimate administrative purposes.

If we introduce non-essential analytics, advertising trackers or similar technologies that require consent, we will update the applicable notice and provide appropriate consent controls before using them.

Programme platform

Our programme platform may use essential cookies or equivalent technologies for purposes such as:

• signing you in;
• refreshing your session;
• maintaining security; and
• remembering the organisation or programme context associated with your session.

These technologies are necessary for the platform to function securely.

We do not use participation in our programme platform to create cross-site advertising profiles of candidates.

You may also control cookies through your browser or device settings, although disabling essential cookies may prevent parts of the platform from functioning.

21. Links and connections to other services

Our website, learning materials and programmes may contain links to or integrations with third-party websites and services.

Those organisations process information under their own terms and privacy policies.

We are not responsible for all of a third party’s independent activities merely because we link to or integrate with that service.

Where we specifically engage a third party to process personal data on behalf of i45G, the provisions of this Policy concerning our service providers apply.

Where you independently choose to connect an external service, such as an identity or business-service provider, both this Policy and the provider’s own privacy arrangements may apply to different parts of the processing.

22. How this Policy relates to the DPDP Act and Rules

This Policy is written with reference to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, whose provisions come into force in stages.

We have chosen to build toward the standard those provisions establish when fully operational rather than waiting until every obligation becomes mandatory for us.

In practice, this means we aim to:

• process personal data for stated and lawful purposes;
• provide a clear notice before or when personal data is collected;
• obtain consent where consent is the relevant lawful basis;
• make withdrawal of consent reasonably accessible;
• retain records of relevant permissions and preferences;
• collect only information reasonably required for the purpose;
• apply reasonable security safeguards;
• limit retention;
• establish appropriate arrangements with processors;
• provide additional protection for children’s personal data;
• distinguish Partner-controlled processing from i45G’s own processing;
• provide routes for correction and deletion;
• maintain a working grievance mechanism; and
• review our practices as the applicable legal provisions come into force.

Where this Policy describes a right or regulatory mechanism that is not yet legally operative because of staged commencement, we apply it as an internal privacy standard where reasonably practicable, while the statutory right itself becomes enforceable according to its applicable commencement date.

23. Changes to this Policy

We may update this Policy when our:

• programmes;
• technology;
• service providers;
• processing activities;
• security practices; or
• legal obligations

change.

Each published version carries a version number and date.

The current version will be available at:

Privacy Policy

Where a change materially affects how we use personal data we already hold, we will provide additional notice where appropriate.

This may be through:

• the application;
• email;
• SMS;
• a programme notice; or
• another suitable channel.

Where a new use requires consent, publication of a revised Privacy Policy is not a substitute for that consent.

We will request it separately where required.

24. Data deletion

You may request deletion of personal data controlled by i45G or deletion of an i45G account.

Where account deletion is available within the application, you may use that function.

You may also contact:

info@i45g.com

Where you have connected Meta, Facebook or another external service, disconnecting that service does not necessarily delete information already legitimately stored by i45G.

To request deletion of information held by i45G, use our deletion process.

Our detailed data-deletion instructions are available at:

Data Deletion

Deletion is subject to information that we are required or lawfully entitled to retain for purposes such as:

• applicable law;
• tax and accounting;
• institutional programme administration;
• security;
• fraud prevention;
• dispute handling; or
• documented instructions from a Partner for whom we act as Data Processor.

Properly anonymised information that is no longer capable of identifying you may be retained.

25. Contact

i45G
a trade name of Bhagath Singh Karunakaran

Privacy and Grievance Contact:
info@i45g.com

Website:
https://i45g.com

Privacy Policy:
https://i45g.com/privacy-policy/

Data Deletion:
https://i45g.com/data-deletion/

This Policy describes i45G’s general privacy practices.

An individual Partner, programme, assessment or service may provide a further privacy notice explaining more specifically:

• what information that programme collects;
• why it is required;
• who receives the results;
• how long identifiable information is required; and
• what choices you have.

Where such a notice is more specific about that particular processing, it should be read together with this Policy.