Your privacy is extremely important to us. This page outlines how we handle and protect your personal information.
Introduction & Overview
At Handicrafts and Carpet Sector Skill Council (HCSSC) ("We", "Us", "Our"), protecting your privacy and personal data is a core commitment. This Privacy & Cookies Policy explains how We collect, use, store, process, and disclose Your personal data when You visit and interact with Our website (https://hcssc.in, including subdomains, web applications, dashboards, and digital services (collectively, the "Service"). It also explains Your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. By accessing, browsing, or using the Service, You acknowledge that You have read and understood this Privacy & Cookies Policy. If You do not agree with any part of this policy, please discontinue the use of Our services immediately. HCSSC acts as a “Data Fiduciary” under the Digital Personal Data Protection Act, 2023, and processes Personal Data in accordance with applicable laws.
Interpretation and Definitions
Interpretation
Words with capitalized initial letters have specific meanings defined below. These definitions apply regardless of whether they appear in singular or plural form.
Definitions
Account: A unique account created for You to access Our Service or specific administrative/partner modules (such as HCSSC Admin, Employer, Candidate, or Affiliate dashboards).
Affiliate: Any entity that controls, is controlled by, or is under common control with HCSSC, where "control" means ownership of 50% or more of voting equity or management authority.
Company: Refers to Handicrafts and Carpet Sector Skill Council (HCSSC), located at OCF, Plot No. 2, Pocket 9, Sector B, Vasant Kunj, New Delhi -110070.
Data Fiduciary: Means HCSSC, which alone or in conjunction with other persons determines the purpose and means of processing Personal Data under the Digital Personal Data Protection Act, 2023.
Cookies: Small text files placed on Your computer, mobile device, or hardware by a website, storing session details, user choices, analytics data, and browsing preferences.
Our Principles Under the DPDP Act, 2023
Whenever We collect or process Personal Data (including data collected via tracking technologies and cookies), We adhere strictly to the following principles:
Consent: Non-essential processing and non-essential cookies occur only with Your explicit, informed consent. Consent shall be free, specific, informed, unconditional, and capable of being withdrawn at any time.
Purpose Limitation: Personal Data is collected solely for specified, explicit, and legitimate purposes linked to skill development initiatives.
Data Minimisation: We restrict data collection to the minimum information necessary to achieve its intended purpose.
Transparency: Clear information is provided regarding what data is collected and how it is utilized.
Storage Limitation: Data is retained only for as long as necessary to fulfil legal, regulatory, or operational requirements.
Information We Collect
A. Personal Data Provided Directly by You
Depending on how You interact with Our Service, We may collect the following personal identifiers:
Candidate Registration: Full name, email address, mobile phone number, residential address, educational qualifications, employment history, and uploaded CVs/resumes.
Partner & Employer Profiles: Organization name, registration number, Authorized Single Point of Contact (SPOC) name, official email address, phone number, subsector, and occupation mappings.
Contact & Enquiries: Name, contact details, email address, and message contents provided through Contact Us forms, enquiry dialogs, or feedback forms.
AI Assistant Inputs: Chat transcripts, queries, and text inputs submitted while interacting with the HCSSC AI Assistant.
B. Technical & Usage Data Collected Automatically
When You access the Service, Our servers automatically record standard diagnostic data:
IP Addresses: Your Internet Protocol (IP) address.
How We Use Your Personal Data
We use Personal Data for specific, lawful operational purposes:
Service Provision: Administering skilling schemes, managing candidate enrolments, processing partner registrations, and maintaining user accounts.
Employment Matchmaking: Evaluating, screening, and routing candidate applications to prospective employers or training partners.
Analytics & Statistics: Compiling and displaying aggregated, non-identifiable public skilling statistics (e.g., state-wise candidate counts, female artisan representation, training centre counts) on interactive maps and dashboards.
Chatbot Improvement: Processing text inputs, troubleshooting AI errors, and refining the response accuracy of the HCSSC AI Assistant.
Security: Protecting website forms and APIs using security services such as Google reCAPTCHA v3.
Compliance: Fulfilling reporting obligations mandated by the National Skill Development Corporation (NSDC), Ministry of Skill Development & Entrepreneurship (MSDE), and other government bodies.
Notifying You about platform updates, security alerts, administrative messages, or responses to submitted inquiries.
Disclosure and Sharing of Personal Data
We do not sell, rent, or trade Your personal information. We may share Your data only under the following lawful circumstances:
Service Providers: Sharing with trusted third-party providers (such as Amazon Web Services (AWS S3) for cloud storage, database management, and hosting) who process data on Our behalf under strict confidentiality agreements.
Legal & Government Mandates: Disclosing necessary personal records to MSDE, NCVET, NSDC, state skill missions, or regulatory authorities as mandated by Indian laws.
Corporate Transactions: Transferring user data as part of organizational restructuring, merger, consolidation, or asset transfer if HCSSC undergoes such a transaction.
Safety & Enforcement: Disclosing data if required by law enforcement, court orders, or statutory authorities to defend legal rights, prevent fraud, or ensure user safety.
No Personal Data shall be sold or disclosed for commercial marketing purposes without the Data Principal's consent unless required by law.
Tracking Technologies and Cookies Policy
What Are Cookies?
Cookies are small text files placed on Your device to store session status, site preferences, and browsing data. Web beacons (clear gifs, pixel tags) may also be used in web pages or emails to count visits or verify system integrity.
Types of Cookies We Use
We utilize both Session Cookies (deleted when You close Your browser) and Persistent Cookies (stored for a set duration or until cleared manually):
Cookie / Technology Name
Category
Purpose
Expiry / Retention
NextAuth Session Token
Essential
Authenticates admin, candidate, and employer portal logins; maintains session continuity.
Session / Short-term
Theme & Preference Cookie
Essential
Remembers UI layout preferences, language settings, and dark/light mode choices.
1 Year
Google reCAPTCHA
Data Retention & Data Storage Location
Data Localization: All Personal Data collected through the Service is stored and processed on secure cloud infrastructure (AWS S3) located within India, complying with local data localization standards.
Operational Retention: Personal Data is retained only as long as necessary to fulfil the purposes outlined in this Policy. Candidate certification records, registry entries, and training logs are retained for a minimum of 8 years to comply with government audit guidelines. Non-essential usage records are deleted or anonymized once operational requirements end.
Data Security
We implement appropriate administrative, technical, and physical safeguards-including SSL/TLS encryption, restricted database access, and secure S3 bucket policies-to protect Your Personal Data against unauthorized access, loss, or disclosure. However, no electronic transmission over the Internet or cloud storage system can be guaranteed to be 100% secure; You share information at Your own risk.
Children’s Privacy
Our Service is not directed at children under the age of 18. We do not knowingly collect Personal Data from minors without verifiable consent from a parent or legal guardian. If We learn that We have inadvertently collected personal information from an individual under 18 without verified parental consent, We will take swift steps to purge that data from Our servers.
Your Rights Under the DPDP Act, 2023
Under the DPDP Act, 2023, You possess specific rights as a Data Principal:
Summary of Processing: Requesting a summary of Your Personal Data being processed along with details of processing activities.
Rectification & Erasure: Requesting correction of inaccurate/outdated data, or erasure of Personal Data no longer required for its original purpose (subject to legal retention mandates).
Consent Withdrawal: Withdrawing Your consent for non-essential processing at any time without affecting prior lawful processing.
Grievance Redressal: Accessing an easy mechanism to register complaints regarding data processing.
Nomination: Nominating another individual to exercise Your data rights in the event of death or incapacity.
To exercise any of these rights, please submit a written request to Our Grievance Officer using the details below.
External Links to Third-Party Websites
Our Service may contain links to third-party platforms (e.g., government portals, social media channels, external training partners). If You click on a third-party link, You will be directed away from Our site. We do not control and are not responsible for the privacy policies or content of external sites.
Changes to This Privacy Policy
We may update Our Privacy & Cookies Policy periodically to reflect operational, legal, or regulatory changes. Updates will be posted on this page with a revised "Last Updated" date. For material changes, We may notify You via website banners or registered email notices prior to effective implementation. Continued use of the Service after such changes shall constitute acceptance of the revised Privacy Policy.
Grievance Officer & Contact Information
In compliance with the Information Technology Act, 2000 and the DPDP Act, 2023, HCSSC has designated a Grievance Officer to handle data privacy queries, corrections, or complaints:
Organization: Handicrafts and Carpet Sector Skill Council (HCSSC)
Registered Address: OCF, Plot No. 2, Pocket 9, Sector B, Vasant Kunj, New Delhi – 110070, India
Email Contact: hcssc@hcssc.in / info@hcssc.in
Resolution Timeframe: All grievances will be reviewed, addressed, and resolved within 24-48 working hours of receipt, and in no case later than 30 days.
Last updated: August 11, 2025
DPDP Act: Refers to the Digital Personal Data Protection Act, 2023 of India, along with any rules, regulations, or amendments enacted under it.
Device: Any hardware capable of accessing the Service, such as a desktop computer, laptop, smartphone, or tablet.
Personal Data: Any data about an individual who is identifiable by or in relation to such data.
Service: Means the HCSSC website, its subdomains, web applications, dashboards, and all related digital services operated by HCSSC.
Service Provider: Any natural or legal person processing Personal Data on behalf of HCSSC (such as hosting vendors, cloud infrastructure platforms, IT support, or analytics tools).
Usage Data: Data collected automatically during the use of the Service or from the website infrastructure (e.g., duration of page visits, device identifiers, or IP addresses).
You: The individual accessing or using the Service, or the company or legal entity on whose behalf such individual is accessing the Service.
Browser Details: Browser type, browser version, and operating system.
Page Analytics: Pages visited, date and time of access, and time spent on individual pages.
Logs: Unique device identifiers, referral URLs, and error/diagnostic logs.
Communications:
Legal Compliance: Processing Personal Data to comply with applicable laws, regulations, judicial orders, or statutory obligations.
Essential
Protects login and contact forms from automated spam and bot abuse.
Session
Google Analytics
Analytics (Non-Essential)
Tracks visitor interactions, page performance, traffic sources, and site health.
24 Hours – 2 Years
Site Performance / Monitoring
Analytics (Non-Essential)
Measures server latency, application performance, and diagnostic uptime.
Session – 1 Year
Your Cookie Control Choices
When You access Our Service, You can manage Your cookie preferences:
Essential cookies are enabled by default to ensure basic security, session management, and site navigation.
Non-essential cookies (analytics & performance) are deployed only after You provide explicit consent via the Cookie Consent Notice, which You can modify or revoke at any time through Your browser settings or the site's Cookie Settings.
