Privacy Policy

1Who we are and what this policy covers

This policy is issued by Seva Dham Foundation, a non-profit company registered under Section 8 of the Companies Act, 2013 (CIN U88900BR2026NPL083400, PAN ABTCS1045E), with its registered office at Shop No. 5-4, Shakuntalam Apartment, Patliputra, Phulwari, Patna — 800013, Bihar. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

It applies to sevadhamfoundation.org, our forms and chat box, donations, volunteer and membership sign-ups, events, camps and programmes, and any email, phone or WhatsApp contact you have with us. It does not apply to other websites we link to.

2What personal data we collect

We collect only what is needed for the purpose you are engaging with us for:

We do not knowingly collect sensitive details such as caste, religion, health records or bank account numbers through this website. If a programme genuinely needs health information (for example, a medical camp), it is collected on paper or a separate form with its own notice and explicit consent.

3How we use your data — and our legal basis

• Consent (Section 6, DPDP Act) — newsletters, impact updates, volunteer matching, photographs and stories.
• Legal obligation (Section 7) — keeping donation records, issuing receipts, filing Form 10BD and issuing Form 10BE under the Income-tax Act, and answering lawful requests from authorities.
• Purposes you started (Section 7(a)) — when you voluntarily send us your details to get something done, such as a donation receipt or a reply to your question.

We will never use your data for a purpose that is not compatible with the reason you gave it, and we will ask you again before any new purpose.

4Consent and how to withdraw it

Every form tells you what we will do with your details before you submit it. Optional uses (such as newsletters) are never pre-ticked.

You can withdraw consent as easily as you gave it — reply "STOP" to any message, click unsubscribe in an email, use the Cookie settings link, or write to info@sevadhamfoundation.org. Withdrawal does not affect anything done before it, and records we must keep by law (such as donation records) will be kept for the legal period.

5Children's data

Many of our programmes serve children (for example, Bal Suraksha). Under Section 9 of the DPDP Act, anyone under 18 is a child. We:

• collect a child's data only with verifiable consent of a parent or lawful guardian;
• never track children, show them targeted advertising or build behavioural profiles;
• publish a child's photo or story only with written guardian consent, and never with their full name, school or address;
• ask volunteers under 18 to register only with a parent's consent.

6Who we share data with

We never sell, rent or trade personal data. We share it only with:

• Payment gateway and banks (such as Razorpay or our bank) to process donations — they handle card and UPI details under RBI and PCI-DSS rules;
• Income Tax Department — donor name, address, PAN and amount in Form 10BD, so your Form 10BE certificate can be issued;
• Service providers who work for us under contract: email (Google Workspace / Gmail), website hosting, form delivery (FormSubmit), and accounting;
• Auditors and regulators such as our statutory auditor, the Ministry of Corporate Affairs or courts, when the law requires.

Some providers may store data on servers outside India. We use only reputed providers bound by confidentiality and security obligations, and we follow any transfer restrictions notified by the Government of India under Section 16 of the DPDP Act.

7How long we keep data

When the period ends, we delete the data or remove everything that identifies you.

8Your rights

Under Sections 11 to 14 of the DPDP Act you have the right to:

• Know what personal data we hold about you and how we use it, and with whom we have shared it;
• Correct, complete or update data that is wrong or incomplete;
• Erase data we no longer need (except what the law makes us keep);
• Grievance redressal — a quick and fair answer to any complaint;
• Nominate a person to exercise these rights if you die or become unable to.

Write to info@sevadhamfoundation.org with the subject "Data request". We may ask you to confirm your identity first. There is no fee. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

You also have a duty under Section 15: please give us accurate information and do not impersonate anyone.

9How we protect your data and handle breaches

• HTTPS encryption on every page; no card or UPI data ever touches our servers;
• access to donor and volunteer records only for staff and volunteers who need it, with two-step login on our accounts;
• regular backups and a written list of who can see what;
• confidentiality undertakings from staff, volunteers and service providers.

If a personal-data breach ever happens, we will inform affected people and the Data Protection Board without delay, and send the Board a detailed report within 72 hours, as the DPDP Rules, 2025 require.

10Photographs, stories and media

We take photographs at camps and events to show donors their impact. We ask permission before photographing anyone up close, and always before publishing a personal story. To have a photo of you removed from our website or social media, write to us and we will take it down within 7 days.

11Changes to this policy

We will update this page whenever the law or our work changes, and change the date at the top. If a change affects how we use data you have already given us, we will tell you and, where needed, ask for fresh consent.