1. Introduction
BSERI (Allied Business Systems Education & Research Institute Pvt. Ltd.) conducts ISO Management System Standards Practitioner Certificate Examinations, extends membership to qualified professionals, and offers training courses. Protecting the personal data of our candidates, members, trainees and website visitors is part of the same commitment to rigour that defines our examinations.
This Privacy Policy describes our overall data practices. For the itemised data lists, specified purposes (P1–P7), and how consent works purpose-by-purpose, see the Consent Notice.
2. Who is responsible
BSERI is the Data Fiduciary (and, for individuals in the EEA/UK, the data controller). References to “BSERI” mean Allied Business Systems Education & Research Institute Pvt. Ltd.
3. What we collect and why
We collect identity and contact details, examination and qualification data, professional details (for membership), payment references, and limited technical data from the website. The complete itemised lists, the specified purposes (P1–P7), and the service each purpose enables are set out in the Consent Notice. We collect nothing beyond what each purpose requires.
Publication of names: BSERI publishes on its website the names of its Members and of persons who qualify in its Practitioner Examinations, to promote their professional recognition — but only with each person’s separate, optional consent (Purpose P4), which can be withdrawn at any time.
4. Legal grounds
In India, we process personal data on the basis of your consent, and in limited situations under the “certain legitimate uses” permitted by Section 7 of the DPDP Act (for example, where you voluntarily provide data for a purpose and have not objected, for compliance with law, or in medical emergencies).
Where the GDPR applies, our legal bases are: performance of a contract (examination registration, certification, membership and training you request); consent (publication of your name; marketing communications; analytics cookies); legitimate interests (website security, fraud prevention, credential-verification integrity); and legal obligation (tax and accounting records).
5. Cookies
We use strictly necessary cookies to run the website, and analytics cookies only with your consent, obtained through the cookie banner. We use no advertising or cross-site tracking cookies. You can change your cookie choices at any time via “Cookie settings” in the website footer. See also our Cookie Policy and Consent Notice — Annexure B.
6. Sharing and international transfers
We share personal data only with contracted Data Processors (examination and proctoring platforms, payment gateways, IT service providers) bound by security and erasure obligations, and with authorities where law requires. We never sell personal data. Data is processed in India; any cross-border transfer will comply with Section 16 of the DPDP Act and, for EEA/UK individuals, with GDPR Chapter V safeguards such as Standard Contractual Clauses.
7. Security
We apply the safeguards required by Rule 6 of the DPDP Rules, 2025 — including encryption or masking, access controls, monitoring and logging (retained at least one year), and backups — and equivalent GDPR Article 32 measures, and we require the same of our processors.
8. Retention
We retain personal data only while the purpose for which you gave it is being served, or as law requires, and then erase it. Credential records are kept while your Certificate of Qualification remains verifiable. If your data is due for erasure through inactivity, we will tell you at least 48 hours in advance so you can act to preserve it.
9. Your rights and how to use them
You can access a summary of your data and its processing, correct or complete it, have it erased, nominate someone to act for you, and raise grievances — as detailed in the Consent Notice. EEA/UK individuals additionally hold GDPR rights of portability, restriction and objection.
Use Manage / Withdraw Consent or write to privacy@bseri.net, quoting your candidate ID, membership number or registered email.
Grievances are answered within 30 days. If unresolved, you may approach the Data Protection Board of India; EEA/UK individuals may also complain to their supervisory authority.
10. Children
We process the personal data of anyone under 18 only with verifiable parental or guardian consent, and we never track, profile or direct advertising at children. See also Consent Notice — Section 9.
11. Data breaches
If a personal data breach affects you, we will inform you without delay — plainly describing what happened, the likely consequences for you, what we are doing about it, the steps you can take, and whom to contact — and we will report to the Data Protection Board of India within the timelines prescribed by Rule 7 of the DPDP Rules, 2025 (and, where GDPR applies, to the relevant supervisory authority within 72 hours).
12. Updates to this Policy
We will post updated versions here with a new version number and date, and where changes affect the basis of your consent we will notify you and seek fresh consent before proceeding.
Version history
- Version 1.0 (16 July 2026): Reissued for DPDP Rules 2025 alignment; Consent Notice referenced as Section 5 standalone notice
- Prior site version (15 December 2024): DPDP Act 2023 compliance update
- Initial (15 August 2024): First published privacy policy