Privacy Policy

1. Data Fiduciary

For the purposes of the DPDP Act, 2023, the Data Fiduciary (entity responsible for determining the purpose and means of processing your personal data) is:

2. Personal Data We Collect

3. Purpose of Processing

We process your personal data for the following purposes:

• Donations and fund transfers: To process your donation and disburse funds to the Campaigner / Beneficiary.
• KYC and identity verification: To verify the identity of Campaigners and comply with AML obligations.
• Transactional communications: To send donation receipts, campaign updates, and account notifications.
• Marketing communications: To send promotional communications about the Platform and similar causes — only where you have consented (Donors consent at the time of donation; you may opt out at any time).
• Legal compliance: To comply with applicable laws including tax law, AML regulations, the IT Act, and the DPDP Act.
• Platform improvement: To analyse usage patterns and improve the Platform's features and security.
• Grievance resolution: To handle complaints and disputes.

4. Legal Basis for Processing

We process your personal data on the following bases under the DPDP Act, 2023:

• Consent: For marketing communications and non-essential data uses — given at the time of account creation or donation.
• Contractual necessity: To fulfil our obligations to you as a User of the Platform (e.g. processing your donation, disbursing funds).
• Legal obligation: To comply with applicable Indian laws, including the Income Tax Act, Prevention of Money Laundering Act, and the DPDP Act.
• Legitimate interest: To ensure platform security, prevent fraud, and maintain records.

5. Sharing of Personal Data

We may share your personal data with the following categories of recipients:

• Campaigners: Donor names and contact details may be shared with the relevant Campaigner for campaign update purposes. Anonymous donors are excluded from such sharing.
• Payment processors: Cashfree Payments receives transaction details necessary to process donations.
• Legal and regulatory authorities: We may disclose your data to law enforcement, courts, or government authorities if required by law, court order, or to protect the rights, safety, or property of users or the public.
• Third-party service providers: We may share data with trusted vendors (e.g., email/SMS service providers, analytics providers) who assist in operating the Platform, subject to data processing agreements requiring them to protect your data.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy or as required by law. Specifically:

• Transaction and financial records: Retained for a minimum of 8 (eight) years from the date of the transaction, as required under the Income Tax Act, 1961, and the Prevention of Money Laundering Act, 2002.
• KYC documents: Retained for a minimum of 5 (five) years from the date of the last transaction, in accordance with applicable AML guidelines.
• Account data (non-transactional): Deleted within 90 (ninety) days of account deactivation, subject to the retention obligations above.
• Marketing consent records: Retained until you withdraw consent or your account is deactivated.

Legal retention obligations take precedence over deletion requests. If you request deletion of data that we are required to retain by law, we will inform you of the applicable retention period.

7. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted storage, HTTPS transmission, access controls, and regular security reviews.

In the event of a personal data breach that is likely to result in harm to you, we will notify the Data Protection Board of India and affected users as required under the DPDP Act, 2023.

8. Your Rights Under the DPDP Act, 2023

As a Data Principal (individual whose data is processed), you have the following rights:

• Right to access: Request a summary of the personal data we hold about you and the purposes for which it is processed.
• Right to correction and erasure: Request correction of inaccurate or incomplete personal data, or erasure of data that is no longer necessary — subject to legal retention obligations.
• Right to grievance redressal: Raise a complaint about our data processing practices with our Grievance Officer (see Clause 10 below).
• Right to nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent: Withdraw consent for non-essential processing at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact us at support@sacchisewa.org.

9. Children's Data

We do not knowingly collect personal data from minors, except of beneficiaries. If we become aware that personal data of a minor has been collected without verifiable parental consent, we will delete it promptly. If you believe we have inadvertently collected data of a minor, please contact us at support@sacchisewa.org.

10. Third-Party Links

The Platform may contain links to third-party websites. Sacchi Sewa is not responsible for the privacy practices or data handling of any third-party sites. We encourage you to review their privacy policies before providing any personal data.

11. Changes to This Policy

Sacchi Sewa may update this Privacy Policy from time to time to reflect changes in law, technology, or our data practices. Changes will be posted on the Platform with a revised "Last Updated" date.

12. Grievance Officer

Complaints will be acknowledged within 3 business days and resolved within 30 business days. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once established under the DPDP Act, 2023.