Privacy Policy

Last updated: 1 November 2026 Version 1.2: First final edition, shared by all CRCGS platforms.

This policy explains what personal data the CRCGS platforms collect, why, who sees it, how long we keep it and what you can do about it. It covers all the platforms listed in section 1. It is written to be read: if anything is unclear, write to privacy@crcgs.academy.

1. Who we are and who runs the platforms

CRCGS stands for The Centre for Risk, Compliance & Governance Studies. CRCGS is the name under which the platforms below are offered. The platforms are provided and run by AmpliSkill Consulting LLP, a Limited Liability Partnership, B-1019, Luxor Apts, Kondapur, Hyderabad, Telangana 500084, India ("we", "us"). CRCGS is a brand name, not a separate legal entity; AmpliSkill Consulting LLP is the organisation responsible for your personal data (the "data fiduciary" under Indian law, and the "controller" under EU and UK law).

The CRCGS platforms today:

Knowledge Hub (crcgs.academy): articles, case studies, research papers, the glossary, events and author applications.
Country Profiles (countryprofiles.crcgs.academy): country regulatory profiles, enforcement actions, a compliance calendar, news and the CRCGS Weekly newsletter.

When we add a platform it is added to this list and this policy covers it. Each platform has its own accounts and its own database today: an account on one platform does not exist on another.

2. What we collect and why

We collect only what a form asks for, and what a web server needs to do its work. We do not run advertising, we do not use analytics or tracking tools, and no page loads fonts, scripts or images from other companies: the platforms load everything from their own servers.

Knowledge Hub (crcgs.academy)
What	What we collect	Why we use it	Our basis
Reader, author and editor accounts	Email address, name (optional), a password (stored only as a one-way hash, never in readable form), your role, the dates you signed in, and the articles you save to your reading list. Editors and authors may also have a public name, picture and short biography that CRCGS publishes with their agreement.	To create and run your account, let you save articles, and let authors and editors do their work.	Your consent when you create the account; our legitimate interest in running the platform.
CRCGS Weekly newsletter	Email address and the newsletter sections you chose. The Knowledge Hub keeps no list of its own: a sign-up on the Hub is sent to Country Profiles, which keeps the one list for both platforms.	To send the newsletter you asked for.	Your consent (you confirm by email).
Contact form	Name, email address, organisation (optional), subject and message.	To answer you.	Your consent; our legitimate interest in replying.
Event registration	Name, email address, organisation and job title (as the form asks). We email you a link to confirm your place; a registration you do not confirm within 24 hours is deleted.	To register you for the event and tell you about it.	Your consent; performing the registration you asked for.
Author application ("Join as an Author")	Name, email address, organisation, role, LinkedIn address, topics, a sample-writing link (optional), a short biography, and the time you ticked the consent box.	To decide whether to invite you to write for CRCGS and to contact you.	Your consent.
Comments and corrections	The Knowledge Hub has no public comments and no corrections form. A message about a mistake goes through the contact form above.	None.	None.
Sign-in and security records	Sign-in attempts (email address typed, internet (IP) address, whether it worked and when), a log of what staff do in the admin area (who, what, when, IP address), short-lived limits on how often a form can be sent (IP address and email, kept about two days), and error records (the page address and the error).	To keep accounts and the site safe, spot abuse and fix faults.	Our legitimate interest in security; legal duties.

Country Profiles (countryprofiles.crcgs.academy)
What	What we collect	Why we use it	Our basis
Reader, reviewer and editor accounts	Email address, name (optional), job role, industry and countries of interest (all optional), a password (stored only as a one-way hash), your role, the dates you signed in. Reviewers and editors may also have a public name and short biography on the Our reviewers page, published with their agreement.	To create and run your account and let reviewers and editors do their work.	Your consent when you create the account; our legitimate interest in running the platform.
CRCGS Weekly newsletter	Email address, the sections and (if given) the country you are interested in, and the dates you confirmed or unsubscribed. This is the one list for both platforms. A record of which issues were sent to which address is kept so that an interrupted send never mails anyone twice.	To send the newsletter you asked for.	Your consent (you confirm by email).
Suggest a correction	Your message, the page and section it is about, and, only if you choose to give them, your name and email address. We also record your IP address.	To check and, where right, correct a profile; to reply if you asked us to.	Your consent; our legitimate interest in keeping profiles accurate.
Public information about organisations	Country profiles, regulators, laws, obligations and enforcement actions are taken from official public sources. They name organisations and, where an official order itself names them, people.	To provide the reference service and cite official sources.	Our legitimate interest in publishing public information; correction requests are welcome (see "Your rights").
Comments	There are no public comments.	None.	None.
Sign-in and security records	Sign-in attempts (email address typed, IP address, whether it worked and when), a log of what staff do in the admin area (who, what, when, IP address), short-lived limits on how often a form can be sent (IP address and email, kept about two days), anonymous counts of how often the registration prompt is shown (no personal data) and error records.	To keep accounts and the site safe, spot abuse and fix faults.	Our legitimate interest in security; legal duties.

Our hosting provider also keeps ordinary technical records of requests to its servers (for example, the IP address and the page asked for) as part of running the servers. We do not control those records; see sections 4 and 5.

3. Our legal basis

We handle personal data under India's Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (as it comes into force). In plain terms we rely on:

Your consent, which you give by sending a form, ticking a box or creating an account, for the purpose the form states. You can withdraw it at any time (section 10).
Providing what you asked for, such as running your account, registering you for an event or answering your message.
Our legitimate interest in running, securing and improving the platforms and in publishing public information accurately, where that does not override your rights.
Legal obligations, such as keeping records the law requires or answering a lawful request from an authority.

For visitors in the EU and UK see section 11.

5. Where data is stored (transfers outside India)

Our servers are run by our hosting provider in Singapore. Your data is therefore stored and processed outside India. By using the platforms and sending us your data you accept this transfer. We choose a provider that protects its servers, and we do not move your data anywhere else on purpose.

6. How long we keep it

We keep personal data only as long as we need it for the purpose it was given, as set out below. These are our rules; some of the clearing-out is done by the system and some by our team (see "How it is done").

Retention
What	How long	How it is done
Contact messages	24 months after we receive them. Messages marked as spam: 30 days.	Automatic, every night.
Newsletter subscribers	Until you unsubscribe. Your address is then removed 30 days later.	Automatic, every night. You receive nothing more from the moment you unsubscribe; the 30 days make a mistaken or repeated click harmless.
Sign-ups you never confirm (accounts and newsletter)	One reminder after 7 days; removed after 30 days.	Automatic, every night.
Reader accounts (email, saved articles, profile)	Until you delete your account (Account settings, "Delete my account"). An account not used for 3 years (no sign-in and no activity) is deleted, after we email you one warning 30 days before; signing in keeps it.	You delete it yourself at any time. Unused accounts: automatic, every night.
Event registrations	24 months after the event. A registration you do not confirm within 24 hours is deleted at once.	Automatic, every night.
Author and contributor applications	24 months.	Automatic, every night.
Corrections and suggestions (Country Profiles)	Until reviewed, and no longer than 24 months after we receive them.	Automatic, every night.
Staff and editor accounts	While the person works with CRCGS; then removed.	Our team.
Server logs and security records (sign-in attempts, the staff activity log, error records)	90 days. Form-limit records: about two days.	Automatic, every night. The two-day records clear themselves.
Database backups	The newest 14 nightly backup files, then older ones are deleted.	Automatic.

Backups hold a copy of everything above, so data you ask us to delete can remain in a backup for up to 14 days before it disappears with the oldest backup file.

7. How we protect it

No system is perfectly safe, but these protections are in place:

The platforms are served over HTTPS (an encrypted connection).
Passwords are never stored in readable form; they are stored as one-way hashes (Argon2id).
A strict content security policy lets pages load only from our own servers, which also blocks third-party trackers and injected scripts.
Forms are protected against forged requests, and the number of attempts is limited.
The admin area needs an account with a role; people see and change only what their role allows, and what staff do is logged.
Database backups are made every night, kept outside the public web folder, and downloaded only by a signed-in administrator who re-enters their password.

If we learn of a data breach that affects you, we will tell you and the authorities as the law requires.

8. Cookies

The platforms set only a few small first-party cookies, listed in the Cookie Notice. There are no advertising, analytics or tracking cookies.

9. Children

The platforms are for professionals and students aged 18 or over. We do not knowingly collect personal data from anyone under 18 (a child under Indian law). If you are a parent or guardian and think a child has given us data, write to privacy@crcgs.academy and we will delete it. If we find that we hold data from someone under 18, we delete it.

10. Your rights and how to use them

You can ask us to:

tell you what personal data we hold about you and how we use it;
correct data that is wrong or out of date;
delete your data (readers can delete their own account in Account settings);
stop using your data for a purpose you agreed to (withdraw consent). Withdrawing does not undo what we did before, and you can unsubscribe from the newsletter at any time with the link in every issue;
send a complaint (section 12);
name someone to exercise your rights for you if you die or cannot act, as the Indian law allows.

To use a right, write to privacy@crcgs.academy from the email address on your account or form so that we know it is you. We acknowledge every request and answer within one month. We may need to confirm who you are first. If a public profile, article or enforcement entry names you and you think it is wrong, tell us and we will review it.

11. Visitors in the EU and the UK

Our main basis is Indian law, but if you are in the EU or UK these points are also for you.

Why we use your data: to run your account and send what you asked for (performing the service you requested); our legitimate interest in running, securing and improving the platforms; your consent where we ask for it; and legal duties.
Your rights: access, correction, deletion, restriction, objection to our legitimate-interest uses, withdrawing consent, and data portability where it applies.
Complaints: you may complain to your own data protection regulator (in the UK, the Information Commissioner's Office). We would like the chance to put things right first.
Requests: write to privacy@crcgs.academy. We answer within one month.
Transfers: your data is stored in Singapore and handled from India.
Representative: we have not appointed an EU or UK representative.

12. Grievance Officer and complaints

If you have a complaint about how we handle your personal data, contact our Grievance Officer:

Grievance Officer: B Gitanjali Reddy
Organisation: AmpliSkill Consulting LLP
Address: B-1019, Luxor Apts, Kondapur, Hyderabad, Telangana 500084, India
Email: privacy@crcgs.academy

We acknowledge every grievance and resolve it within one month.

13. Changes to this policy

We may update this policy, for example when we add a platform or change what we collect. The date at the top shows when it last changed. If a change matters to your rights, we will say so on the platforms or by email where we have your address.

14. Contact

Privacy questions and requests: privacy@crcgs.academy.

AmpliSkill Consulting LLP, B-1019, Luxor Apts, Kondapur, Hyderabad, Telangana 500084, India.