Privacy Policy

1. Who we are and what this policy covers

Sangathya Foundation is a non-profit initiative based in India. This policy explains how we collect, use, share, store and protect personal data when you use sangathya.org, contact us, volunteer with us, subscribe to updates or interact with our programmes.

The Sangathya journal is published on sangathya.com, which is operated separately. Personal data you provide through that journal is governed by the privacy terms published there.

The Foundation is currently under registration. Until registration is complete, references to the Foundation mean the initiative operating this website. We will update our legal details once registration is issued.

2. Our data promise

We do not sell, rent, trade or commercially exploit your personal data. We collect it for specific purposes you choose, and we do not use it for third-party advertising or unrelated marketing.

• We collect only the information we need for a stated purpose.
• We use it for the Foundation’s charitable and programme purposes, not for profit from data.
• We do not share it with advertisers, data brokers or unrelated third parties.
• We do not use it for automated profiling that produces legal or similarly significant effects.
• We keep it only for as long as we need it, unless the law requires a longer period.
• You can contact us to access, correct, delete or withdraw consent for your data.

3. Personal data we collect

Contact and enquiry data

Name, email address, phone number, subject and message when you use our contact form or email us.

Volunteer data

Name, email, phone, city, areas of interest, availability, motivation and any information you choose to share during onboarding.

Newsletter data

Email address and subscription status when you sign up for updates.

Donation data (when donations open)

Name, email, phone, address, PAN where required for tax purposes, donation amount, date, transaction reference and receipt details. Payment credentials are handled by the payment gateway, not by us.

Technical data

IP address, browser and device type, operating system, pages visited, referring page, approximate location derived from IP and server logs. We use this only for security, diagnostics and aggregate understanding of site use.

Programme and safeguarding data

Information you or a guardian provide when participating in a programme, including emergency contact details, accessibility needs and any safeguarding concern.

Journal data

Information submitted through sangathya.com is handled under the journal’s own privacy terms.

We do not intentionally collect sensitive personal data such as health records, biometric data, caste data or financial account credentials through this website. Please do not send sensitive information through general contact forms. If a programme genuinely requires it, we will explain why and seek appropriate consent.

We do not buy personal data from third parties.

4. Why we use your data

Respond to you

To answer enquiries, requests and complaints and to provide the information you ask for.

Manage volunteers

To assess applications, onboard volunteers, assign roles, provide support, protect participants and maintain volunteer records.

Send updates

To send newsletters and programme updates when you have asked to receive them. You can unsubscribe at any time.

Run programmes and drives

To organise academic, cultural, technology and business programmes, manage participation, make accessibility arrangements and keep people safe.

Process donations

Once donations open, to process gifts, issue receipts, meet tax and accounting requirements and communicate about your donation.

Protect the website and people

To detect fraud, prevent abuse, secure our systems, investigate incidents and enforce our policies.

Meet legal duties

To comply with applicable law, court orders, tax requirements, audit requirements and lawful requests from authorities.

Understand site use

To produce aggregate statistics about how the site is used. We do not use analytics to identify you personally, and we do not currently deploy analytics cookies.

5. Our legal bases

We process personal data on the basis of your consent, or as otherwise permitted by applicable law. Our processing is guided by the Digital Personal Data Protection Act, 2023 and the rules made under it, the Information Technology Act, 2000 and the Sensitive Personal Data or Information Rules, 2011 where applicable.

• Consent: when you submit a form, subscribe, volunteer or ask us to contact you.
• Legal obligation: when we must keep records for tax, audit, safeguarding or other statutory purposes.
• Volunteer and programme administration: when you have consented to participate and we need to manage your involvement.
• Emergency and safety: when processing is necessary to protect someone’s life, health or safety.
• Legal claims: when processing is necessary to establish, exercise or defend legal claims.

6. Consent and withdrawal

By submitting a form or asking to receive updates, you consent to the processing described in this policy. Where a form contains a consent checkbox, we rely on that consent.

You may withdraw consent at any time by writing to contact@sangathya.org. Withdrawal does not affect processing already carried out, and it may mean we can no longer provide a service that depends on that data. We will action a valid withdrawal within a reasonable period and tell you if we must retain limited information for legal reasons.

7. When we share data

We do not sell personal data. We share it only in the limited circumstances below, and only to the extent needed.

• Service providers: hosting, email delivery, form processing, payment gateways, analytics (only if introduced with consent), IT support, auditors, lawyers and other vendors who process data on our behalf under confidentiality and data-protection obligations.
• Professional advisers: accountants, auditors and legal advisers where necessary for compliance or advice.
• Authorities: police, child-protection authorities, courts, regulators or government bodies when required by law, a court order or a lawful request, or when necessary to protect someone from serious harm.
• Related parties: the Foundation is a shareholder of Arkynox, which maintains the Sangathya journal platform. We share data with Arkynox only where necessary for journal or technology operations, and only under appropriate confidentiality terms. This relationship is disclosed on our Transparency page.
• Reorganisation: if the Foundation merges, transfers its work or restructures, personal data may be transferred to the successor entity, subject to this policy and applicable law.

Service providers must use the data only to provide the service to us. They must not use it for their own marketing or sell it.

8. Cookies and analytics

We use essential cookies and similar technologies needed for the site to function. We do not currently use advertising cookies, cross-site tracking or third-party analytics cookies. If we introduce analytics, we will update our Cookie Policy and, where required, ask for your consent first.

For more information, see our Cookie Policy.

9. How long we keep data

Contact enquiries

Up to 2 years after the enquiry is resolved, unless it becomes part of a legal or safeguarding record.

Volunteer records

Up to 3 years after the volunteer’s last activity, unless a longer period is needed for safeguarding or legal reasons.

Newsletter records

Until you unsubscribe, plus up to 30 days for suppression and unsubscribe records.

Donation and financial records

At least 8 years from the end of the relevant financial year, or the period required by tax and accounting law.

Grievance records

Up to 3 years after closure, or longer if required for legal proceedings.

Server logs

Approximately 90 to 180 days, unless needed to investigate a security incident.

Safeguarding records

For as long as necessary to protect the people involved and meet legal obligations, which may be longer than the periods above.

When a retention period ends, we delete or anonymise the data. If data is subject to a legal hold, investigation or dispute, we keep it until the matter is closed.

10. How we protect data

• Encryption in transit using HTTPS for the website and forms.
• Access controls and least-privilege permissions, so only people who need data can access it.
• Multi-factor authentication for administrative and financial accounts where available.
• Separate and controlled access to donation and financial records.
• Regular backups and tested restoration procedures.
• Vendor checks and written confidentiality obligations for service providers.
• Confidentiality commitments for trustees, staff, volunteers and consultants.
• Incident response procedures and prompt action when a concern is identified.

No method of transmission or storage is completely secure. While we take reasonable technical and organisational measures, we cannot guarantee absolute security. We will notify you and the appropriate authorities if a breach affects your data and notification is required by law.

11. Data breaches

If we become aware of a personal data breach, we will take steps to contain it, assess its impact, recover affected data and prevent recurrence. Where required by applicable law, we will notify affected individuals and the Data Protection Board of India or other competent authority without undue delay. We will also notify affected individuals where there is a risk of harm, and tell them what they can do to protect themselves.

12. Your rights

Subject to applicable law and identity verification, you have the following rights:

• Access: ask for a summary of the personal data we hold about you and how we process it.
• Correction and completion: ask us to correct inaccurate, incomplete or outdated data.
• Erasure: ask us to delete data that is no longer needed for the purpose for which it was collected, subject to legal retention requirements.
• Withdrawal of consent: withdraw consent for future processing.
• Nomination: nominate a person to exercise your rights in the event of death or incapacity, as provided by law.
• Grievance redressal: complain to our Grievance Officer and, if unresolved, to the Data Protection Board of India.

To exercise a right, write to contact@sangathya.org with enough information for us to identify you and the data concerned. We may ask for reasonable verification. We aim to acknowledge requests within 48 hours and resolve them within 30 days, unless the law requires a different period or the request is complex.

We may refuse or limit a request where the law permits us to do so, for example where data must be retained for legal compliance, safeguarding or the defence of legal claims. We will explain the reason unless the law prevents us from doing so.

13. Children

We do not knowingly collect personal data from a child under 18 without verifiable consent from a parent or guardian. We do not use children’s data for behavioural tracking, targeted advertising or profiling. If you believe a child has provided personal data without appropriate consent, contact us and we will take reasonable steps to verify and delete it.

Some programmes may involve children. In those cases, we follow our Child Protection & Safeguarding Policy and obtain guardian consent where required.

14. International transfers

We aim to store personal data in India. Some service providers may process data outside India. Where that happens, we will use appropriate safeguards and comply with any restrictions on cross-border transfers under applicable law. We do not transfer data to a country or territory where such transfer is restricted by law.

15. Third-party links

Our website links to external sites, including sangathya.com and social media pages. We are not responsible for the privacy practices of those sites. Please read their privacy policies before providing personal data.

16. Changes to this policy

We may update this policy when our practices, services or legal obligations change. We will publish the updated version here and change the “last updated” date. If a change materially affects your rights, we will take reasonable steps to notify you.

17. Contact and grievance redressal

Privacy questions and requests may be sent to contact@sangathya.org. Our Grievance Officer is yet to be appointed. Postal address: Registered address will be published once registration is complete. We aim to acknowledge grievances within 48 hours and resolve them within 30 days.

If you are not satisfied with our response, you may contact the Data Protection Board of India or another competent authority under applicable law.