What we collect, and what we don't.

Last updated: 21 October 2026

This policy explains what personal data the WEC website collects, why, how it's protected, and your rights under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. The Women Empowerment Cell, Punjab Engineering College (Deemed to be University), Chandigarh is responsible for it (the “Data Fiduciary”).

What we collect, and why

• Nothing, if you just read. You never need an account to read public pages, and we use no analytics or advertising trackers.
• Your account (if you sign in with Google): your name, email address, profile photo and a Google account ID. Google never gives us your password. Used to sign you in, to tell PEC accounts from others, and to show your name on your account page.
• Your phone number (requested when you first sign in, with your consent): used only so the WEC team can contact you about your account, your submissions or events you have registered for, including where an account is involved in misuse of the site. Never used for marketing or bulk messages, never shared or sold. Remove it any time from your account page.
• Your submissions: what you send, your name, email and optional branch, year and bio. Your email and phone are never shown publicly.
• Reactions: which emoji your account gave each article, so you can take it back. Others see only totals.
• Sign-in log: when you signed in or out, how, from which network (IP) address and browser, and failed attempts. Used to protect accounts and investigate misuse, and kept because Indian law (CERT-In directions, 2022) requires it.
• Abuse protection: short-lived counters of how often an account or network address does things, stored only as a keyed hash, so one person can't flood the site.
• People shown on the site (team, alumni, event photos): published only with the person's recorded consent. Children and NGO beneficiaries aren't shown without it.

We process your data with your consent, or where the law allows it without consent, such as keeping the site secure and meeting legal duties. We collect only what's needed for these purposes.

What we never do

We don't sell or rent personal data, show ads, build profiles, track you across other sites, send marketing calls, SMS or WhatsApp messages, or let anyone else use your data for their own purposes.

Cookies

Only two strictly necessary cookies, which keep you signed in (30 days, or 7 for the WEC team). There are no analytics or advertising cookies, so there's nothing to opt out of. Embedded posts from Instagram, LinkedIn, X, YouTube or Facebook, and Google Forms, are loaded from those companies, which may set their own cookies under their own policies. YouTube uses its privacy-enhanced mode.

How we protect it

• Personal data (emails, names, phone numbers, sign-in addresses and browsers) is encrypted in the database with AES-256-GCM. The key is kept separately from the data and the backups.
• All traffic uses HTTPS. Nightly backups are encrypted with AES-256.
• Only the WEC admins can see accounts and the sign-in log. Reviewers see what's needed to review a submission. Every access is tied to a named account.
• Uploaded photos are re-saved to strip hidden location data. Every request is rate-limited, and submissions are screened for harmful content.
• Our practices follow ISO/IEC 27001 controls for information security.

Who else handles it

Only the services we need to run the site, each for that purpose only: our hosting provider (stores the site and database), Google (sign-in), and our email provider (Resend, for emails about your submissions). We disclose data to authorities only when Indian law requires it.

How long we keep it

• Your account, phone number, submissions and reactions: until you delete them or your account.
• Accounts with no sign-in for 3 years (other than the WEC team's): deleted automatically, with their reactions and unpublished submissions. Published work stays up unless you ask us to take it down.
• The sign-in and security log: 1 year, then deleted. After you delete your account, its entries stay until then but are no longer linked to an account.
• Abuse-protection counters: deleted within a day.
• Backups: 14 days.

Your rights

On your account page you can download all the data we hold about you, change your phone number or remove it (an account without a phone number can no longer react, submit or use the admin panel), and delete your account. You can also ask us to correct, complete or erase your data, to take down a photo or profile, or to explain how we've used it, and you may nominate someone to exercise these rights if you die or become unable to. Write to the Grievance Officer below. We reply within 30 days. If you aren't satisfied, you may complain to the Data Protection Board of India.

Children

The site is meant for college students and adults. If you are under 18, please sign in only with your parent or guardian's consent. We don't track, profile or target anyone under 18.

If something goes wrong

If a personal data breach happens, we'll tell the people affected and the Data Protection Board of India without delay, and report the incident to CERT-In within 6 hours, as the law requires, with what happened and what we're doing about it.

Changes to this policy

We'll update this page and its date when our practices change, and tell signed-in users about important changes on the site.

Contact and Grievance Officer

The Faculty Coordinator, Women Empowerment Cell, Punjab Engineering College, Sector 12, Chandigarh 160012, at the email address on our Join page. We acknowledge every request within 24 hours.