Privacy notice

Who we are

This website, lipsresearch.org, is run by LIPS Research Foundation, LIPS Building, 4/15 H, NH 47, Trivandrum – Kanyakumari Road, Marthandam, Pammam, Kanyakumari Dist. – 629165, Tamil Nadu, India (“LIPS Research”, “we”, “us”). We decide why and how the personal data described in this notice is processed. Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the data fiduciary; where the EU General Data Protection Regulation (“GDPR”) applies, we are the controller.

How to contact us about privacy

For any question, request or complaint about your personal data, e-mail [email protected] with “Privacy” in the subject line, call +91 94420 91507, or write to us at the address above.

What we collect

When you fill in a form

Our application and enquiry forms ask only for what we need to handle that application or enquiry. Depending on the form, this can include:

• Identity: your name, salutation, gender (membership form), date of birth and a photograph.
• Contact details: e-mail address, phone number and postal address.
• Education and career: degree and school certificates, a resume or CV, research interests or a research proposal, employment details and, on the internship form, your university register number.
• Government-issued ID: a copy of an identity document, which several application forms ask for. If you use an Aadhaar card, you may upload a masked Aadhaar that shows only the last four digits.
• Health data: your blood group, where a form asks for it. It is optional.
• Information about other people: the name of a parent or spouse on some admission forms, referees and their letters on the honorary-doctorate form, and the representative, board members or faculty of an institution on the corporate-membership and affiliation forms. Please share this only if the people concerned know you are doing so.
• Organisation documents: registration, building and fire-safety certificates or a logo, on the institutional forms.
• Your message: whatever you write in the contact form or a free-text field.

With each submission we also store the date and time, the page the form was sent from, the version of this notice you agreed to and when, the result of the Cloudflare Turnstile security check, your browser’s user-agent string, and a salted, one-way hash of your IP address (not the IP address itself).

When you browse the website

We use Cloudflare Web Analytics to count page views. It does not use cookies and does not identify or follow individual visitors. Cloudflare, which delivers and protects the website, and our hosting servers process your IP address and technical request data (such as the time and the page requested) to deliver the site, keep it secure and fix faults.

When you verify a certificate

The certificate search uses the number you type only to find the matching record. We do not keep a log of the numbers searched. To stop misuse, your IP address is held in memory for up to ten minutes to limit the number of searches. The DL CARD and LIPS Gurukulam registers hold the name, programme, year, status and registration or certificate number of the people listed; a record is shown only to someone who enters its exact number, and the registers are never published as lists.

When you pay us

We do not take payments on this website. When you pay by UPI or bank transfer and e-mail us the acknowledgement, we use your name, the purpose and amount of the payment, the transaction reference and the screenshot or receipt to match the payment with our bank statement.

Why we use it

• To receive and assess applications for research degrees, fellowships, courses, supervisor recognition, internships, membership, affiliation and honorary awards, and to check eligibility and documents.
• To answer your enquiries and handle grievances.
• To contact you about your application, programme, membership or payment.
• To keep records of certificates and let others verify them by number.
• To keep the website and our systems secure and to prevent spam and abuse.
• To meet our legal obligations.

We do not sell personal data, we do not use it for advertising, and we do not make decisions about you by automated means alone.

Consent and legal basis

Every form on this website asks you to confirm that you have read this notice and agree to the processing of the information and documents in the form. We record when you gave that consent and which version of this notice applied. You can withdraw your consent at any time (see Your rights); withdrawal does not affect processing that has already taken place, but we may then be unable to continue with your application.

Some processing does not depend on consent: keeping the website secure, and keeping records that the law requires. Where the GDPR applies, we rely on your consent (Article 6(1)(a)), on steps you ask us to take before entering into an agreement, such as admission or membership (Article 6(1)(b)), on our legitimate interest in keeping the website secure (Article 6(1)(f)), and on legal obligations (Article 6(1)(c)). Health data such as blood group is processed only with your explicit consent (Article 9(2)(a)).

Where we store it and how we protect it

• The website and our MongoDB database, which holds form answers, run on a server of Oracle Cloud Infrastructure in its Hyderabad region, India.
• Documents you upload with a form are stored in a private Cloudflare R2 storage bucket in Cloudflare’s Asia-Pacific (APAC) region. It is not publicly accessible.
• Only authorised LIPS staff can see submissions, through a password-protected staff dashboard. They open uploaded documents through short-lived links that expire after a few minutes.
• The e-mails that tell our staff about a new submission are sent through Amazon Simple Email Service (Amazon Web Services, United States, us-west-2 region). They contain no applicant details: only the form name, a reference number, the time, the number of attachments and a link to the staff dashboard.
• The website uses HTTPS, so data is encrypted in transit. Forms are protected by Cloudflare Turnstile against bots, uploads are checked for file type and size, and the number of submissions is limited.

Uploaded documents may be stored outside India, within Cloudflare’s Asia-Pacific region, and Cloudflare’s network processes requests to the website globally. The e-mails that tell our staff about a new submission pass through the United States, but they carry no applicant details. Where data leaves India, we transfer it only as Indian law permits and, for data covered by the GDPR, with appropriate safeguards.

If a personal-data breach affects you, we will inform you and the authorities as the law requires.

Who we share it with

• Service providers who process data for us under our instructions: Oracle Cloud Infrastructure (hosting and database), Cloudflare (file storage, website delivery and security, Turnstile and Web Analytics) and Amazon Web Services (the e-mails that tell our staff about new submissions, which carry no applicant details).
• Partner university: where your application is for a programme awarded by European International University (EIU), Paris, we share the information EIU needs to process it.
• Authorities, when the law requires us to.
• Anyone verifying a certificate, who sees only the record matching both the certificate number and the holder’s name they enter.

How long we keep it

Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it, or to erase it when it is no longer needed;
• withdraw your consent;
• use our grievance redressal, and then complain to the Data Protection Board of India;
• nominate another person to exercise your rights if you die or become unable to do so.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, and you can complain to your data-protection supervisory authority.

To use any of these rights, e-mail [email protected] from the address you used in the form. We may ask you to confirm your identity before we act.

Cookies and similar technologies

• This website sets no tracking or advertising cookies, so there is no cookie banner.
• Cloudflare Web Analytics works without cookies.
• The only cookie the website itself sets is a strictly necessary session cookie for LIPS staff who log in to the staff dashboard. It expires after eight hours or when they log out. Visitors never receive it.
• Cloudflare Turnstile runs a short check in your browser to tell people from bots when you send a form. Cloudflare may also set strictly necessary security cookies if it shows a security check.

Links and embedded content

The map on the contact page loads from Google only when you press “Show map”; Google’s privacy policy then applies. Links to other websites, such as LIPS NEXORA, European International University, our social-media pages and WhatsApp, take you to services with their own privacy policies. If you contact us on WhatsApp, WhatsApp also processes your messages.

Children

Our research-degree programmes are for adults: applicants must be 18 or over, and the research-degree application form checks this.

Changes to this notice

We will update this notice when our processing changes. The version and date at the top of this page show the current version, and every form submission records the version you agreed to.

Version: 2026-11, November 2026.