Privacy Notice

1. Who we are

SVITECH Foundation processes personal data to run HR operations, community programmes, donations, and related statutory compliance. This notice explains what we collect, why, and how you can exercise your rights.

2. Purposes of processing

• Employment & HR operations. Staff enrollment, attendance, leave, payroll, and performance management for employees and volunteers.
• Programme delivery. Identifying and serving beneficiaries, tracking service delivery, follow-ups, and impact reporting.
• Donations & finance. Issuing receipts (including 80G where applicable), accounting, statutory filings, and donor stewardship.
• Security & audit. Securing accounts (login sessions), preventing misuse, and maintaining operational audit trails.

3. Categories of personal data

• Identity and contact details (name, email, phone, address)
• Government identifiers when required (PAN, Aadhaar, voter ID, etc.)
• Employment and statutory details (bank, UAN, ESIC, designation)
• Beneficiary demographics and programme notes (including category/cohort where collected)
• Donation records and receipt details
• Location associated with attendance punch (when GPS is used)
• Technical session data (essential login cookies)

We collect only what is reasonably necessary for the purpose. Sensitive identifiers (such as Aadhaar or PAN) are requested only when needed for employment, receipts, or programme eligibility.

4. Lawful basis

Depending on the activity, we rely on: (a) consent (where you opt in), (b) employment or contractual necessity, (c) legitimate use for providing goods/services or employment as permitted under DPDP, and/or (d) compliance with law.

5. Sharing

Personal data may be shared with authorised staff, statutory authorities, auditors, banks/payment processors, and technology processors (for example cloud hosting) bound by confidentiality and security obligations. We do not sell personal data.

6. Retention

We retain personal data only as long as needed for the stated purposes or as required by applicable Indian law (including income-tax, labour, FCRA, and NGO statutory records). After that period, data is deleted or irreversibly anonymised where feasible.

7. Security

We use access controls, encrypted transport (HTTPS), httpOnly session cookies for login, and role-based permissions. No security measure is perfect; please use a strong unique password and report suspected misuse promptly.

8. Cookies

We use essential cookies only to keep you signed in securely. We do not use third-party advertising cookies on this platform.

9. Your rights

• Right to access. Request a copy of personal data we hold about you.
• Right to correction. Request correction of inaccurate or incomplete personal data.
• Right to erasure. Request erasure of personal data, subject to legal retention duties (tax, labour, FCRA, programme records).
• Right to grievance redressal. Raise a complaint with our Grievance Officer if you are not satisfied with our response.
• Right to withdraw consent. Where processing is based on consent, you may withdraw it. Withdrawal does not affect processing already completed lawfully.

Signed-in staff can download their account data and submit requests from My privacy & data. Others may use the Grievance page.

10. Children

Where we process personal data of children in programme contexts, we seek verifiable consent of a parent/guardian as required by law and limit processing to what is necessary for the programme.

11. Contact

For privacy questions or Data Principal requests, see Grievance & privacy contact.