1. Who We Are

Full legal name: Indian Management & Foreign Studies (IMFS)
Registered office: Mumbai, Maharashtra, India
Website: www.imfs.co.in
Phone: +91 22 6921 0000
Privacy contact email: [email protected]

When this policy refers to “IMFS”, “we”, “us”, or “our”, it means Indian Management & Foreign Studies and all its branch locations.

2. What Personal Data Does IMFS Collect?

Information You Provide Directly

• Full name
• Email address
• Mobile phone number
• City / location
• Course interest (e.g. MS, MBA, Bachelor’s, PhD, MBBS)
• Preferred study destination (e.g. USA, Germany, Canada, UK, Australia, Ireland, New Zealand)
• Test scores (GRE, GMAT, SAT, IELTS, TOEFL) — only if you voluntarily share these with a counsellor
• Messages or queries submitted via contact forms or WhatsApp

Information Collected Automatically

• IP address (anonymised via Google Analytics)
• Browser type and version
• Pages visited and time spent on each page
• Referring website (how you found imfs.co.in)
• Device type (desktop, mobile, tablet)
• Geographic region (city/state level, from anonymised IP)

3. How Do We Collect Your Data?

📌 Table current as of May 2026. IMFS may add new data collection channels and will update this policy accordingly.

4. Why Do We Use Your Data?

📌 Legal bases per India’s Digital Personal Data Protection Act 2023 (DPDPA).

5. Who Do We Share Your Data With?

Service Providers We Work With

• CRM platform — to store and manage student enquiry records securely
• WhatsApp Business API provider — to send and receive WhatsApp messages
• Google (Analytics & Ads) — for website analytics and advertising; governed by Google’s Privacy Policy
• Meta (Facebook & Instagram) — for lead ad forms and retargeting; governed by Meta’s Data Policy
• WordPress / Elementor — website infrastructure hosted in compliance with DPDPA

Universities and Partner Institutions

If you ask us to help with a university application, we share only the data necessary for that application (name, academic records, contact details) with your explicit consent. We will always tell you before sharing your data with any university.

Legal Authorities

We may share your data with government or law enforcement authorities if required by law, court order, or to protect the rights and safety of IMFS, our staff, or other students.

6. Meta (Facebook & Instagram) Lead Ads — Special Notice

IMFS runs lead generation advertisements on Facebook and Instagram. These ads include a form that Meta pre-fills with your profile information (name, email, phone number) to make it easier to enquire.

What happens when you submit a Meta Lead Ad form?

1. Meta collects your information on their platform, governed by Meta’s Data Policy.
2. Meta shares your submitted information with IMFS as the advertiser.
3. IMFS stores your information in our CRM and an IMFS counsellor contacts you — typically within 24–48 hours.
4. You may opt out of further communications at any time by replying “STOP” to any SMS or WhatsApp, or by emailing [email protected].

What data do Meta Lead Ads collect?

• Full name
• Email address
• Phone number
• Any additional questions in the form (e.g. preferred study destination, course type)

You can manage your ad preferences and data on Meta’s platform at: facebook.com/ads/preferences.

7. What Cookies Does IMFS Use?

📌 Cookie list current as of May 2026. IMFS will update this list if new cookies are added.

8. How Long Does IMFS Keep Your Data?

📌 Retention periods set in accordance with India’s DPDPA 2023 and applicable financial regulations.

After the retention period expires, your data is securely deleted or anonymised so it can no longer identify you.

9. What Are Your Rights Under India’s DPDPA 2023?

Under the Digital Personal Data Protection Act 2023 (DPDPA) — India’s primary data protection law — you have the following rights as a Data Principal (the person whose data we process):

📌 Rights per India’s Digital Personal Data Protection Act 2023. Source: meity.gov.in

We will respond to all valid data rights requests within 30 calendar days. We may need to verify your identity before processing a request.

10. What Indian Cyber Laws Govern This Privacy Policy?

📌 All laws current as of May 2026. Source: meity.gov.in, cert-in.org.in, legislative.gov.in.

11. What Is Sensitive Personal Data and Does IMFS Collect It?

The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 — commonly called the SPDI Rules — were made under Section 43A of the IT Act 2000. They place specific obligations on any “body corporate” (which includes IMFS) that collects, stores, or deals with personal data.

What qualifies as Sensitive Personal Data under the SPDI Rules 2011?

📌 Source: Rule 3, IT (SPDI) Rules 2011 — meity.gov.in. IMFS does not collect SPDI as defined in this Rule.

What the SPDI Rules require IMFS to do

Even though IMFS does not collect SPDI, the SPDI Rules 2011 impose the following obligations on IMFS as a body corporate handling any personal data:

• Publish a privacy policy — this document fulfils that requirement
• Collect data only for a lawful purpose — IMFS collects data solely to provide study-abroad counselling
• Provide notice at collection — IMFS forms state the purpose of data collection
• Not retain data beyond the stated purpose — see Section 8 (Retention) of this policy
• Allow withdrawal of consent — you may opt out at any time (see Section 9)
• Not publish personal data without consent — IMFS never publishes student data publicly
• Implement reasonable security practices — see Section 16 (Security) of this policy

12. Who Is IMFS’s Grievance Officer Under IT Intermediary Guidelines 2021?

Under Rule 3(2) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, every intermediary — including websites that accept user-generated enquiries or form submissions — must publish the name and contact details of a Grievance Officer and provide a mechanism for users to register complaints.

13. How Does IMFS Handle Cyber Security Incidents Under CERT-In Directions 2022?

The CERT-In Directions 2022 (issued under Section 70B(6) of the IT Act 2000, effective 27 June 2022) impose mandatory cyber incident reporting obligations on all organisations operating in India, including IMFS.

What qualifies as a reportable incident under CERT-In Directions 2022?

• Targeted scanning or probing of critical networks or systems
• Compromise of critical systems or information
• Unauthorised access to IT systems or data
• Defacement of IMFS website
• Malicious code attacks (ransomware, malware, spyware)
• Identity theft, spoofing, or phishing attacks targeting IMFS or its users
• Denial of Service or Distributed Denial of Service attacks
• Data breaches — including any unauthorised access to student personal data

IMFS’s obligations under CERT-In Directions 2022

📌 Source: CERT-In Directions 2022, issued under S.70B(6) IT Act 2000 — cert-in.org.in. Effective 27 June 2022.

How does this compare to GDPR breach reporting?

GDPR requires breach reporting to EU supervisory authorities within 72 hours. India’s CERT-In Directions 2022 require reporting within 6 hours — twelve times faster. As IMFS operates primarily in India, the 6-hour rule applies to all our systems.