Privacy Policy

Humble Bee Institute of Marine Studies ("HBIMS", "we", "our", "us"), registered under the Ministry of Corporate Affairs, Government of India (Registration No. U80904MH2018NPL313489), operating as a Section 8 not-for-profit company, is committed to safeguarding the privacy, confidentiality, and security of all personal data belonging to applicants, cadets, parents, guardians, alumni, website visitors, and any other individuals who interact with our services. This Privacy Policy explains in detail how we collect, process, use, store, share, and protect your personal information in full compliance with the Information Technology Act, 2000, the IT (Reasonable Security Practices) Rules, 2011, and all applicable Indian data protection regulations.

By accessing our website, submitting an application form (online or offline), enrolling in any training programme, or otherwise providing your personal data to HBIMS, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.

1. Information We Collect

1.1 Personal Identification

Full legal name (as per Aadhaar), date of birth, age, gender, nationality, religion, category (General/SC/ST/OBC/EWS), father/mother/guardian name, Aadhaar number, PAN number, passport details, voter ID, and digital photograph. For cadets under 18, we also collect parent/guardian identification details.

1.2 Contact Information

Primary and alternate mobile numbers, WhatsApp number, email address, permanent and correspondence addresses with PIN codes, and parent/guardian contact details.

1.3 Academic Records

10th/12th marksheets, ITI certificates, graduation degrees, transfer certificates, character certificates from previous institutions — all with percentage, board name, and year of passing.

1.4 Medical Information (Sensitive Data)

Eyesight reports, audiometric tests, height/weight/BMI, blood group, pre-existing conditions, surgical history, medications, allergies, mental health history, drug test results, DG Shipping Form-2 medical examination report, and dental fitness. This is classified as Sensitive Personal Data under Indian law.

1.5 Financial Information

Bank account details (account number, IFSC, branch, holder name), payment transaction records, fee receipts, scholarship details, education loan details, and GST billing information.

1.6 Technical Data

IP address, browser type, OS, device type, screen resolution, referring URLs, pages visited, time spent, click patterns, cookies, session IDs, and geographic location (IP-based). Used solely to improve website functionality.

1.7 Communication Preferences

Consent status for phone calls, SMS, WhatsApp, RCS messages, email newsletters, push notifications, and in-app messages. Timestamped records of consent given, modified, or withdrawn.

2. How We Use Your Data

Processing admissions and MNAT registrations. Verifying eligibility (age, education, fitness). Facilitating enrolment, batch allocation, hostel assignment. Issuing STCW certificates, sponsorship letters, INDOS numbers, CDC, and course completion certificates. Communicating schedules, results, fee reminders, placement opportunities via phone, email, SMS, WhatsApp, and RCS. Coordinating with shipping companies for placement. Complying with DG Shipping, IMO, and flag state regulations. Maintaining academic records, attendance, performance evaluation. Improving programmes and website through analytics. Processing payments, refunds, and maintaining financial records. Alumni engagement and career tracking (with consent).

3. Data Sharing

Shipping Companies: Name, qualifications, training records, medical fitness, STCW certificates, and contact details shared for placement.

Maritime Authorities: Data shared with DG Shipping, flag state administrations for INDOS, CDC, and certification issuance.

STCW Bodies: Training completion and exam scores shared for IMO-recognised certifications.

Medical Providers: Medical info shared with DG Shipping-approved examiners and campus medical staff.

Payment Partners: Financial data shared with payment gateways for fee processing.

Communication Providers: Contact details shared with SMS, WhatsApp, RCS, and email service providers.

Legal Authorities: Disclosed when required by law or court order.

We never sell, rent, or trade your personal information to third-party advertisers or data brokers.

4. Data Security

Technical: 256-bit SSL/TLS encryption, encrypted databases, firewalls, intrusion detection, vulnerability testing, automated encrypted backups, two-factor admin authentication.

Administrative: Role-based access control, mandatory staff training, confidentiality agreements, regular audits, incident response procedures.

Physical: Restricted server room access, CCTV surveillance, secure document shredding, lockable file cabinets.

5. Data Retention

Active Records: Maintained during training + minimum 10 years post-completion (DG Shipping requirement).

Certifications: Retained indefinitely for lifetime verification by shipping companies and port authorities.

Financial Records: Minimum 8 years (tax and audit regulations).

Rejected Applications: 2 years, then anonymised or deleted.

Website Analytics: 24 months identifiable, then aggregated.

6. Cookies and Tracking

Essential: Login sessions, form submissions, security. Cannot be disabled.

Analytics: Google Analytics for anonymous traffic analysis. Can be disabled in browser settings.

Marketing: Social media pixels (with consent) for ad campaign measurement. Opt-out available.

7. RCS and Messaging Consent

By submitting your application, you consent to receive RCS, SMS, WhatsApp, email, and phone communications including: admissions updates, training schedules, fee reminders, exam results, placement alerts, promotional offers, and institutional announcements.

Opt-Out: Reply STOP to any message or email sdp@humblemaritime.com with subject "Unsubscribe". Promotional opt-out does not affect mandatory transactional messages during active enrolment.

8. Your Rights

Access: Request a copy of all your data (provided within 30 days).

Correction: Request correction of inaccurate data (documents required for academic records).

Deletion: Request deletion of non-mandatory data (processed within 60 days).

Withdraw Consent: Withdraw marketing consent including RCS at any time.

Data Portability: Request data in CSV or JSON format.

Lodge Complaint: File with Grievance Officer or regulatory authority.

9. Grievance Officer

Grievances acknowledged within 48 hours, resolved within 30 days.

10. Changes to This Policy

HBIMS may update this policy at any time. Material changes communicated 15 days in advance via email. Continued use constitutes acceptance of the revised policy.

Last reviewed by HBIMS Board of Directors on 1 March 2026. Ref: HBIMS/LEGAL/PP/2026/V3.0