Policies & Terms

1 Introduction & Acceptance

These Terms and Conditions ("Terms") govern your access to and use of Sootrank, the academic management platform of the Indian Institute of Technology Mandi ("IIT Mandi"). By accessing or using Sootrank, you ("User") are bound by these Terms. As Sootrank is an institutional platform required for your academic activities at IIT Mandi, your continued use constitutes your acceptance of these Terms.

These Terms constitute a legally binding agreement between you and IIT Mandi, in accordance with the Information Technology Act, 2000, and applicable Indian laws.

2 Definitions

3 Eligibility & Access

Access to Sootrank is restricted to:

• Currently enrolled students of IIT Mandi with a valid institutional email address and roll number
• Active faculty and academic staff members of IIT Mandi
• Chairpersons and Heads of Departments of IIT Mandi
• Authorised Academic Office staff of IIT Mandi

Access is granted through IIT Mandi's institutional login (LDAP). Your entitlement to access the Platform is tied to your active affiliation with IIT Mandi; users whose affiliation concludes in the ordinary course will have their access deactivated accordingly by the Academic Office.

4 User Accounts & Credentials

Each User is issued or creates a unique account on the Platform. With respect to your account, you agree to:

• Maintain the confidentiality of your login credentials at all times
• Never share your username, password, or session with any other person, including friends, family members, or other students
• Immediately notify the Academic Section, IIT Mandi if you suspect any unauthorised access to your account
• Ensure you log out from shared or public devices after every session
• Accept full responsibility for all activities conducted under your account credentials

Passwords are stored using strong one-way cryptographic hashing (PBKDF2-SHA256). We will never ask you for your password via email, phone, or any medium other than the official login interface.

5 Permitted & Prohibited Use

You may use Sootrank exclusively for lawful academic purposes aligned with your role at IIT Mandi. Specifically, you must not:

• Attempt to access accounts, data, or features not assigned to your role
• Use automated scripts, bots, crawlers, or tools to scrape, extract, or manipulate Platform data
• Attempt to reverse-engineer, decompile, or derive the source code of the Platform
• Exploit any bug, vulnerability, or unintended behavior of the Platform — any such issues should be reported to the Academic Section, IIT Mandi
• Submit false, misleading, or fabricated information through any form or interface on the Platform
• Attempt to bypass, disable, or circumvent authentication, session management, or role-based access controls
• Perform or facilitate any denial-of-service, brute-force, or injection attack against the Platform
• Use the Platform for any commercial purpose, commercial gain, or any activity unrelated to your academic role at IIT Mandi
• Upload or transmit any malicious code, virus, or harmful content through any interface on the Platform
• Misuse the notification, feedback, or communication features of the Platform

Violations of the above may be referred to IIT Mandi's Academic Office or disciplinary committee, and where applicable, addressed under the Information Technology Act, 2000.

6 Academic Data & Accuracy

Sootrank displays academic records — including course enrollments, grades, SGPA, CGPA, credit summaries, attendance, and fee status — as maintained by IIT Mandi's Academic Office. While every effort is made to ensure accuracy and real-time consistency, the Platform is a supporting digital interface and not the primary record of authority.

In the event of any discrepancy between data displayed on Sootrank and the official records maintained by IIT Mandi's Academic Section, the official institutional records shall prevail. Students are advised to raise discrepancies with the Academic Section directly and not rely solely on Sootrank data for official correspondence or documentation.

7 Teacher Course Feedback (TCF)

The TCF module allows students to submit anonymous feedback on courses and instructors. By submitting TCF responses, you agree that:

• Your responses are anonymous — they are not linked to your identity in any report visible to faculty
• Aggregated, anonymised feedback data may be shared with faculty and the Academic Office for institutional quality purposes
• You will provide honest and constructive responses; deliberately false or malicious submissions that could harm a faculty member's professional standing may constitute defamation under applicable law
• You will not attempt to identify other students' submissions or reverse-engineer anonymisation

8 Intellectual Property

All software code, user interface design, architecture, documentation, and original content comprising the Sootrank platform is the intellectual property of IIT Mandi. This includes but is not limited to:

• The web application's source code, backend logic, and database schema
• All visual design elements, templates, and UI components
• The Sootrank name and logo

No part of the Platform may be reproduced, distributed, reverse-engineered, resold, or used to build a competing service without explicit written permission from IIT Mandi. Your right to use the Platform is a limited, non-exclusive, non-transferable licence for your personal academic use at IIT Mandi only.

9 Service Availability & Maintenance

We make reasonable efforts to maintain Platform availability, especially during critical academic periods such as course registration windows. However, we do not guarantee uninterrupted or error-free service. The Platform may be temporarily unavailable due to:

• Scheduled maintenance and updates (announced where possible via in-platform notifications)
• Unplanned technical failures, server issues, or third-party service outages
• Events beyond our reasonable control, including power outages, network failures, or cyberattacks

In cases where service downtime coincides with a registration deadline, affected students should contact the Academic Section, IIT Mandi to request deadline extensions.

10 Disclaimers & Limitation of Liability

THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IIT MANDI DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

In no event shall IIT Mandi be liable for:

• Any indirect, incidental, special, or consequential damages arising from Platform use or inability to use
• Any loss of academic data or documents resulting from technical failures beyond our reasonable control
• Decisions made by academic authorities on the basis of data displayed on the Platform

Nothing in these Terms limits liability for fraud, willful misconduct, or any liability that cannot be excluded under applicable Indian law.

11 Suspension & Termination

Access to the Platform may be suspended by the Academic Office in the following circumstances:

• Violation of any provision of these Terms
• Conduct that poses a security risk to the Platform, its users, or IIT Mandi's systems
• Fraudulent, abusive, or illegal activity
• A direction from IIT Mandi's Academic Office, disciplinary committee, or law enforcement authority
• Cessation of the User's affiliation with IIT Mandi

Upon deactivation of access, you will no longer be able to log in to the Platform. Academic data associated with your account remains with IIT Mandi and is retained in accordance with institutional record-keeping obligations.

12 Amendments to These Terms

These Terms may be updated from time to time. Where changes are material, notice will be provided through the Platform's notification system. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Terms. We encourage you to review this page periodically.

13 Governing Law & Jurisdiction

These Terms are governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023. Any dispute arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the competent courts located in Mandi, Himachal Pradesh, India.

1 Introduction & Scope

This Privacy Policy describes how the Sootrank platform, operated under the auspices of IIT Mandi, collects, uses, stores, shares, and protects your personal data in connection with the Platform's services. It is intended to comply with the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") as its provisions come into force.

This Policy applies to all Users of the Platform as defined in the Terms and Conditions above. By using Sootrank, you acknowledge that you have read and understood this Policy and consent to the processing of your data as described herein.

2 Data Fiduciary / Controller

For the purposes of the DPDP Act, 2023, the Data Fiduciary responsible for decisions about how your personal data is processed is:

3 Categories of Personal Data We Collect

We collect and process the following categories of personal data:

Identity & Contact Data

• Full name (first and last)
• Institutional email address
• Roll number (students) / Employee ID (faculty and staff)
• Mobile number (where provided)
• Profile photograph (where uploaded)

Academic Data

• Department, branch, programme, batch, and semester of enrolment
• Course enrollments, enrollment status, and course mode (Regular / Pass-Fail / Audit)
• Assessment component marks and scores
• Grades (A, A−, B, B−, C, C−, D, F, FS) and their outcomes
• Computed SGPA and CGPA values
• Attendance records (total classes, attended classes, attendance percentage)
• Academic session information (odd/even semester, year)
• Course feedback responses (TCF) — stored in anonymised form; individual responses are not linked to identity in faculty-facing reports

Usage & Technical Data

• Login timestamps and session identifiers
• Role-based access logs (which role was active during a session)
• IP addresses (stored by the web server for security and audit purposes)

4 How We Collect Your Data

Your data is collected through the following means:

• Direct provision: When you log in, complete registration forms, enter course preferences, or submit TCF responses.
• Academic Office input: Your profile, enrollment records, and grade data may be created or updated by authorised Faculty, Chairpersons, or Academic Office Admins acting in their official capacity.
• Automatic collection: Session data and login timestamps are automatically generated by the Platform's backend when you interact with it.

5 Legal Basis for Processing

Under the DPDP Act, 2023 and the IT Act, 2000, we process your personal data on the following legal bases:

• Consent: You provide consent by using the Platform. For specific processing activities (e.g., profile image upload, TCF participation), consent is implicit in your voluntary action.
• Legitimate institutional interest: Processing academic records, grades, and attendance data is necessary for IIT Mandi to fulfil its statutory function as an educational institution.
• Legal obligation: Certain data must be retained to comply with applicable laws, regulatory requirements, and IIT Mandi's statutory audit obligations.

6 How We Use Your Data

Your data is used solely for the following purposes:

• Authenticating your identity and enforcing role-based access to the Platform
• Displaying your academic profile, enrollment history, grades, SGPA/CGPA, and attendance records
• Enabling course pre-registration, enrollment, and withdrawal workflows
• Supporting Faculty in entering marks, computing grades, and viewing course rosters
• Enabling Chairpersons to approve pre-registration requests and oversee departmental academic activities
• Enabling Academic Office Admins to manage the academic session, bulk-import data, and maintain the platform
• Generating official academic documents such as grade sheets and transcripts in PDF format
• Sending role-relevant notifications regarding registration windows, grade publication, and announcements
• Generating aggregated, anonymised institutional analytics (e.g., course enrollment statistics, department-level performance data) for academic planning
• Maintaining audit trails for changes to academic records and programme requirements
• Ensuring the security, integrity, and availability of the Platform

We do not use your data for advertising, profiling, sale to third parties, or any purpose unrelated to your academic activities at IIT Mandi.

7 Data Sharing & Third Parties

Your personal data may be shared in the following limited circumstances:

• Within IIT Mandi: Relevant data is accessible to authorised roles — Faculty see their students' marks and enrollment data; Chairpersons see departmental academic data; Academic Office Admins have access to all institutional records within the Platform's scope.
• Legal requirements: We may disclose your data if required to do so by law, court order, or at the direction of a competent government authority under the IT Act, 2000, or any successor legislation.
• Audit & compliance: Aggregated or individual data may be made available to IIT Mandi's internal audit teams or external statutory auditors in the course of official audits.

We do not sell, rent, or otherwise transfer your personal data to any commercial third party. We do not use any third-party analytics, advertising, or tracking services on this Platform.

8 Data Storage & Security

All personal data processed by Sootrank is stored on servers hosted within India, in compliance with the principles of the DPDP Act, 2023.

We implement the following security measures to protect your data:

• Password hashing: All user passwords are stored using PBKDF2-SHA256 with a per-user salt. Plaintext passwords are never stored anywhere in the system.
• HTTPS / TLS: All data transmitted between your browser and the Platform is encrypted via TLS (HTTPS). The Platform does not serve content over unencrypted HTTP in production.
• Role-based access control (RBAC): Middleware enforces strict role separation. A student cannot access faculty views; a faculty member cannot access admin functions. Every request is validated for authorisation.
• Session management: User sessions are managed server-side with appropriate timeout controls. Sessions are invalidated on logout.
• Database security: The database is not publicly accessible; it is accessible only to the application server. Connection pooling (PgBouncer) is configured for efficient and secure database access.
• Production hardening: Debug mode is disabled in production. Error details are not exposed to end users. Gunicorn with gthread workers serves the application behind a reverse proxy.

While we implement robust security practices, no system is entirely immune to threats. In the event of a data breach that poses a risk to your rights, affected Users and IIT Mandi's Academic Office will be notified in a timely manner and take remedial action.

9 Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, and to comply with IIT Mandi's institutional record-keeping obligations under applicable regulations. Broadly:

• Academic records (grades, enrollments, CGPA, transcripts) are retained indefinitely as part of permanent institutional records, consistent with IIT Mandi's archival policies.
• Attendance records are retained for the duration of the academic session and for a minimum of two years thereafter for audit purposes.
• TCF responses are retained for institutional quality assurance and accreditation purposes for a minimum of five years.
• Session logs and login timestamps are retained for a minimum of ninety days for security and audit purposes, after which they may be purged or anonymised.
• Profile photographs are retained for the duration of the User's affiliation with IIT Mandi and may be deleted upon formal request after affiliation ends.

10 Your Rights Under the DPDP Act, 2023

Under India's Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data:

• Right to access: You may request a summary of the personal data held about you and the purposes for which it is being processed.
• Right to correction: You may request correction of inaccurate or incomplete personal data. Academic data corrections must follow IIT Mandi's official academic correction processes.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal, institutional, or contractual obligations (e.g., academic record retention).
• Right to grievance redressal: If you believe your data has been processed in violation of the DPDP Act, you have the right to lodge a complaint with the Data Protection Board of India once it is established under the Act.
• Right to nominate: You may nominate another individual to exercise your data rights on your behalf in the event of incapacity or death, as provided for under the DPDP Act.

To exercise any of the above rights, please contact IIT Mandi's Academic Section (contact details in Section 2 above). We will endeavour to respond to verified requests within a reasonable timeframe, subject to applicable legal and institutional constraints.

11 Cookies & Sessions

Sootrank uses server-side sessions to manage your authenticated state after login. A session cookie is stored in your browser that contains only a session identifier — no personal data is stored in the cookie itself.

• Sessions expire after a period of inactivity and are invalidated when you log out.
• No third-party cookies are set by Sootrank.
• We do not use any advertising cookies, behavioural tracking cookies, or cross-site tracking technologies.
• We do not use Google Analytics, Facebook Pixel, or any external tracking or analytics service.

Your browser's cookie settings may affect Platform functionality. Blocking all cookies will prevent the session-based authentication from working, making it impossible to log in.

12 Minors & Children's Data

Sootrank is intended exclusively for use by individuals aged 18 years and above. IIT Mandi's enrolled undergraduate students are expected to be at least 17–18 years of age at the time of admission. If any User is under the age of 18, their data is processed under the responsibility of IIT Mandi as an educational institution, with appropriate institutional safeguards in place.

In accordance with the DPDP Act, 2023, the processing of data of children (persons under 18) in educational institutions is subject to the guidelines issued by the Data Protection Board of India. IIT Mandi, as the Data Fiduciary, is responsible for ensuring compliance with applicable children's data protection provisions.

13 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Platform, applicable law, or institutional policies. Material changes will be communicated to Users via the Platform's in-app notification system. The "Effective date" at the top of this document will be updated accordingly.

We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy.

14 Contact & Grievance Redressal

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact: