Security Policy

NEXTSTEP is committed to maintaining the confidentiality, integrity, availability, and security of its information systems, digital platforms, educational resources, user information, and operational infrastructure.

This Security Policy outlines the measures implemented by NEXTSTEP to protect information and systems against unauthorized access, misuse, alteration, disclosure, loss, destruction, or disruption.

By using the NEXTSTEP website, platforms, programs, or services, users acknowledge and agree to this Security Policy.

This Policy applies to:

• The NEXTSTEP website;
• Educational platforms and learning systems;
• Student and participant records;
• Internship and workforce development platforms;
• Career development portals;
• Digital communication systems;
• Information technology infrastructure;
• Employees, consultants, trainers, mentors, contractors, and authorized users.

NEXTSTEP is committed to implementing reasonable administrative, technical, operational, and organizational safeguards to protect information under its control.

Security measures are designed to:

• Prevent unauthorized access;
• Protect personal information;
• Safeguard business information;
• Reduce cybersecurity risks;
• Ensure service continuity;
• Detect and respond to security incidents;
• Support compliance with applicable laws.

NEXTSTEP may implement security controls including:

Technical Safeguards

• Secure hosting infrastructure;
• Network security controls;
• Access management systems;
• Authentication mechanisms;
• Role-based permissions;
• Firewall protection;
• Malware and threat monitoring;
• Data backup procedures;
• Encryption technologies where appropriate;
• Security patches and software updates.

Administrative Safeguards

• Internal security procedures;
• Confidentiality obligations;
• User access management;
• Security awareness activities;
• Vendor risk management;
• Incident response procedures.

Operational Safeguards

• Monitoring of system activity;
• Account management controls;
• Data access controls;
• Password management policies;
• Business continuity planning.

Users are responsible for maintaining the security of their own accounts and devices.

Users agree to:

• Maintain secure passwords;
• Protect login credentials;
• Prevent unauthorized account access;
• Use secure internet connections whenever possible;
• Immediately report suspected security incidents;
• Use the website and services responsibly.

Users must not:

• Share login credentials;
• Attempt unauthorized access;
• Circumvent security controls;
• Introduce viruses, malware, ransomware, or harmful code;
• Engage in activities that compromise system security.

Users who become aware of any actual or suspected security incident should immediately notify NEXTSTEP.

Email: info@nextstep.ac

Reports should include:

• Description of the security concern;
• Date and time identified;
• Systems affected;
• Supporting information where available.

NEXTSTEP reserves the right to investigate all reported incidents.

Where a potential security incident is identified, NEXTSTEP may take actions including:

• Investigation of the incident;
• Restriction of system access;
• Temporary suspension of affected services;
• Implementation of corrective measures;
• Notification of affected users where required by applicable law;
• Coordination with relevant authorities where appropriate.

Nothing in this Policy creates an obligation to disclose security measures, investigative findings, or internal remediation actions.

NEXTSTEP takes reasonable measures to protect personal information and confidential information against:

• Unauthorized access;
• Unauthorized disclosure;
• Alteration;
• Destruction;
• Loss;
• Misuse.

Access to information may be limited to authorized personnel and service providers with a legitimate business need.

Personal information shall be handled in accordance with the NEXTSTEP Privacy Policy.

NEXTSTEP may utilize third-party providers for:

• Website hosting;
• Cloud services;
• Educational platforms;
• Communication services;
• Payment processing;
• Analytics services;
• Security monitoring.

While NEXTSTEP seeks to engage reputable providers, it cannot guarantee the security practices, availability, or performance of third-party systems.

Users acknowledge that third-party services may be subject to their own security policies and privacy practices.

Although NEXTSTEP implements reasonable safeguards, no method of electronic transmission, internet communication, software application, cloud environment, or storage system can be guaranteed to be completely secure.

Users acknowledge that:

• Cybersecurity threats continually evolve;
• Absolute security cannot be guaranteed;
• Internet-based communications may be subject to interception or disruption;
• Unauthorized third parties may attempt to circumvent security measures.

Accordingly, users provide information and use services at their own risk.

To the fullest extent permitted under applicable law, NEXTSTEP, its directors, officers, employees, consultants, mentors, trainers, contractors, affiliates, partners, and service providers shall not be liable for:

• Unauthorized access by third parties;
• Cyberattacks;
• Malware incidents;
• Data loss;
• Service interruptions;
• System downtime;
• Business interruption;
• Indirect or consequential damages;
• Security breaches caused by user negligence;
• Security incidents arising from third-party systems or providers.

Nothing in this Policy shall limit liability where such limitation is prohibited by applicable law.

NEXTSTEP endeavors to maintain security practices consistent with applicable laws and regulations, including:

• Digital Personal Data Protection Act, 2023;
• Information Technology Act, 2000;
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, where applicable;
• Applicable governmental notifications, regulations, and directions.

Compliance efforts are subject to the nature, scale, and operational requirements of NEXTSTEP.

NEXTSTEP reserves the right to:

• Monitor website activity;
• Restrict access;
• Suspend services;
• Remove content;
• Terminate accounts;
• Investigate suspected violations;
• Take legal action where necessary.

Such actions may be taken without prior notice where reasonably necessary to protect systems, users, data, or legal rights.

NEXTSTEP reserves the right to modify, update, amend, or replace this Security Policy at any time.

Updated versions shall become effective immediately upon publication on the website unless otherwise stated.

Continued use of the website or services after updates constitutes acceptance of the revised Security Policy.

This Security Policy shall be governed by and construed in accordance with the laws of India.

Any dispute arising from or relating to this Security Policy, the website, or services shall be subject to the exclusive jurisdiction of the competent courts located in Purba Bardhaman, West Bengal, India.

NEXTSTEP

Website: https://nextstep.ac

Email: info@nextstep.ac

For security-related concerns or incident reporting, please contact:

info@nextstep.ac