Version 2026-06-v2 · Effective 12 June 2026 · Replaces version 2026-06-v1
1. Who we are
The NERSSS Alumni Association ("the Association", "we", "us") is the alumni community of N. E. Railway Senior Secondary School, Kauwabagh, Gorakhpur, Uttar Pradesh, India. The Association operates this website at alumni.nersss.in and the related school information site at nersss.in. Until formal society registration completes, the founding volunteers act as the data fiduciary for the personal data described in this policy; on registration, the registered society succeeds to that role. This policy is written to comply with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, and with the Information Technology Act, 2000.
2. What this policy covers
It covers all personal data processed through this website: membership registrations, member accounts and profiles in NERSSS Connect, contact-form messages and attachments, archive contributions, vouches, job postings, RSVPs, and technical data such as server logs. It does not cover third-party platforms we link to (for example Facebook or LinkedIn), which have their own policies.
3. The data we collect, and when
Registration: name; email; phone (optional); year and class of leaving school; roll number (optional); city and country; profession, employer and LinkedIn (optional); free-text memories you choose to share; the consent choices you tick, with a timestamp, the text version you agreed to, your IP address and browser identification string.
Member accounts (NERSSS Connect): your password (stored only as a one-way cryptographic hash - we cannot read it); profile fields you edit, including an optional photograph and bio; your per-field visibility choices; directory, mentor and batch-representative flags; your membership number.
Things you do as a member: batch-wall posts, job postings, mentoring and contact requests and their accepted or declined status, vouches for pending applicants, archive submissions, and event RSVPs.
Contact form: the purpose you select, the fields shown for that purpose, your message, and any files you attach (for example scans for the archive or a photograph for an in-memoriam request).
Technical data: ordinary web-server logs (IP address, time, pages requested, browser string) kept for security and debugging; session cookies needed for sign-in; and the result token of the Cloudflare Turnstile anti-bot check described in section 7. We do not use advertising or analytics cookies.
4. Why we process it (purposes and lawful basis)
We process personal data on the basis of your consent, given through clearly marked, separate, unticked checkboxes, for these purposes only:
(a) verifying that applicants genuinely studied at NERSSS and maintaining a trustworthy member register; (b) operating the member services you use - the directory, batch rooms, jobs board, mentoring, contact relay, archive and event RSVPs; (c) contacting you about Association matters; (d) if separately consented: listing you in the member directory, adding you to batch WhatsApp groups, and sending the newsletter; (e) responding to messages you send us; (f) protecting the website against abuse; and (g) meeting legal obligations, should any apply.
Each optional consent stands alone. Declining any optional consent never affects your membership.
5. What we never do
We do not sell personal data. We do not rent, trade or share it with advertisers, marketers, recruiters or data brokers. We do not use it to train artificial-intelligence models. We show no advertising.
6. Who can see what
Other members: only what you allow. The directory shows your name, batch and membership number to signed-in, verified members; every other field (email, phone, city, profession, employer, LinkedIn, photograph) carries its own visibility switch in your profile, and you may leave the directory entirely while remaining a member. Contact details exchanged through an accepted contact request are visible to the two members involved.
Volunteers/administrators: a small number of named volunteers see registration applications (including memories and consent records), contact messages, and member records, strictly to run the Association. They are bound to confidentiality.
The public: nothing about you, unless you expressly contribute it - for example an approved archive photograph with the caption you supplied, or a tribute published with family consent.
7. Processors and third parties we rely on
We use a small set of service providers who process data on our instructions: our web-hosting provider (servers used for this site, including the database and uploaded files); Cloudflare, Inc., whose Turnstile service checks that form submissions come from humans (your IP address and a browser challenge result are processed by Cloudflare for that purpose); and an email-delivery service for transactional messages such as password links. We do not permit them to use your data for their own purposes. If the Association later engages a payment gateway for donations, this policy will be updated first.
8. Where the data lives, and for how long
Data is stored on the Association's hosting account. Backups are kept for disaster recovery. We retain: registration and member records while your membership exists and for up to one year after erasure-eligible closure (to honour audit and dispute needs); contact messages for up to two years after resolution; rejected registrations for up to one year; server logs for up to ninety days. When you ask us to erase your record (section 10), we erase or irreversibly anonymise it within a reasonable time, except the minimal records the law requires us to keep.
9. Security
Passwords are hashed, never stored in clear text. The site is served over HTTPS. Administrative access is limited to named volunteers and protected by authentication. Anti-bot verification and rate-limiting protect public forms. No internet service can promise perfect security, but if a breach affecting your personal data occurs we will inform you and the Data Protection Board of India as the DPDP Act requires.
10. Your rights
Under the DPDP Act you may, at any time and free of charge: access a summary of the personal data we hold about you and how it has been used; correct inaccurate or incomplete data (most fields you can edit yourself in your profile); withdraw any consent as easily as you gave it, including leaving the directory, WhatsApp lists or the newsletter; erase your data when it is no longer needed for the purpose you gave it; nominate a person to exercise these rights for you in case of death or incapacity; and complain, first to us, and if unresolved, to the Data Protection Board of India.
To exercise any right, use the contact form on this site and choose "Privacy / my data". To help us find your record, write from the email address you registered with.
11. Children
Membership is open to former students aged eighteen or over. We do not knowingly process children's data. Historic photographs in the archive may show people who were children when the photograph was taken decades ago; we publish such material with care, and on request from the person shown we will remove it.
12. Grievance officer
The Association's grievance contact is reachable through the contact form ("Privacy / my data"). We acknowledge grievances promptly and aim to resolve them within the periods prescribed under the DPDP Act and the IT Act.
13. Changes to this policy
When we change this policy we update the version number and effective date at the top, and for material changes we notify members by email or a site notice. Earlier versions are available on request. Your consent records always note which version you agreed to.