Privacy Policy - Learning Management System (LMS)  
1. Purpose and Applicability  
This Privacy Policy governs the collection, processing, storage, and protection of  
personal data of employees and authorized internal users (“Data Principals”) who access  
and use the Veedol Corporation Limited (VCL) Internal Learning Management System  
(“LMS”).  
This LMS is strictly for internal organizational use and is not accessible to the public.  
This Policy is framed in accordance with the Digital Personal Data Protection Act, 2023  
(India) (“DPDP Act”).  
2. Definitions (as per DPDP Act)  
o
o
o
o
Personal Data: Any data about an individual who is identifiable by or in relation to  
such data.  
Data Principal: An employee or authorized internal user whose personal data is  
processed.  
Data Fiduciary: VCL, which determines the purpose and means of processing  
personal data.  
Data Processor: Any third party processing personal data on behalf of the Data  
Fiduciary.  
3. Nature of Personal Data Collected  
3.1 Employee Identity Data  
o
o
o
o
o
Name  
Employee ID  
Official email ID  
Department, designation, reporting structure  
Location (office / plant / region)  
3.2 Learning & Performance Data  
o
o
o
Course enrolments and completion status  
Assessment scores and certifications  
Learning progress, timestamps, and participation records  
3.3 System & Access Data  
o
o
Login activity and access logs  
Device, browser, and IP address (for security and audit purposes)  
Note: The LMS does not collect sensitive personal data unrelated to learning or  
employment obligations.  
4. Purpose of Processing  
Personal data is processed strictly for legitimate organizational purposes, including:  
o
o
o
o
o
Delivering mandatory and optional learning programs  
Tracking training completion and certifications  
Assessing skill readiness and compliance requirements  
Supporting internal audits, statutory compliance, and governance  
Ensuring system security, access control, and misuse prevention  
5. Lawful Basis for Processing  
Under the DPDP Act, personal data is processed based on:  
o
o
o
Employment-related purposes  
Legitimate use by the employer  
Consent, where explicitly required (e.g., optional learning programs, profile  
enhancements)  
6. Consent Management  
Where consent is required:  
o
o
o
Consent is obtained digitally through the LMS  
Consent is specific, informed, and revocable  
Withdrawal of consent may limit access to certain non-mandatory features  
Mandatory trainings linked to employment or statutory compliance do not require  
separate consent.  
7. Data Sharing and Disclosure  
Personal data is not sold, rented, or shared externally.  
Data may be shared only with:  
o
o
Authorized HR, L&D, IT, Compliance, and Audit teams  
Approved LMS service providers acting as Data Processors, under contractual  
confidentiality and DPDP compliance obligations  
o
Statutory or regulatory authorities, when legally mandated  
8. Data Retention  
Personal and learning data is retained:  
o
o
For the duration of employment, and  
Thereafter as required for legal, audit, or compliance purposes  
Upon completion of the retention period:  
Data is securely deleted or anonymized  
o
9. Data Security Safeguards  
VCL & Data processor implements reasonable security safeguards including:  
o
o
o
o
o
Role-based access control  
Authentication and authorization mechanisms  
Encryption of sensitive data  
Secure hosting and backup controls  
Periodic security reviews and access audits  
10. Rights of Data Principals  
In accordance with the DPDP Act, employees have the right to:  
o
o
o
o
Access their personal data  
Request correction or updating of inaccurate data  
Seek grievance redressal  
Nominate a representative (where applicable)  
Requests can be raised through the contact details provided below.  
11. Grievance Redressal  
Any grievance related to personal data processing may be addressed to:  
Grievance Officer Contact:  
Name:  
Email:  
Address:  
Grievances will be acknowledged and resolved within timelines prescribed under the  
DPDP Act.  
12. Cross-Border Data Processing  
If LMS data is processed or stored outside India, appropriate safeguards are ensured in  
line with DPDP Act requirements and government notifications.  
13. Children’s Data  
This LMS is intended solely for employees and authorized internal users.  
It is not designed for individuals below 18 years of age.  
14. Policy Updates  
This Privacy Policy may be updated periodically to reflect:  
o
o
o
Changes in law  
Organizational practices  
System enhancements  
Material changes will be communicated through internal channels or LMS notifications.  
15. Acknowledgement  
By accessing and using the LMS, employees acknowledge that:  
o
o
They have read and understood this Privacy Policy  
Their personal data is processed in accordance with the DPDP Act and  
organizational policies  
Internal Disclaimer  
This document is an internal policy and forms part of Veedol Corporation Limited  
information security and data protection framework.  
Date: