In short
- We collect only what we need to receive your donation, issue your tax papers, answer your message or place you as a volunteer.
- We never sell or rent your details, and we never share them for anyone else’s marketing.
- Your card, UPI and bank details go straight to our payment partner. We never see or store them.
- We do not publish a child’s name, photo, village or school without written consent from a parent or guardian, and never for a child the law protects.
- You can ask to see, correct or delete your data at any time. We reply within 90 days, usually much sooner.
1. Who we are
Sitamaa Sahayata Foundation (“the Foundation”, “we”, “us”) is a volunteer-run non-profit working on education, preventive health, awareness and community welfare in Barwani district, Madhya Pradesh. We are [legal form and Act, as on the certificate], registration number [registration number and date], with our registered office at [full registered address], Barwani, Madhya Pradesh 451551, India.
Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary for the personal data described in this policy. That means we decide why and how it is used, and we are answerable for it.
2. What this policy covers
This policy covers personal data we collect through our website, our online donation form, our volunteer, contact and updates forms, and the same forms when volunteers fill them in on paper at our programmes. It does not cover other websites we link to; each has its own policy.
3. What we collect and why
We ask only for what each activity needs. Fields marked required are needed for that activity; if you leave them out we cannot complete it. Everything else is your choice.
When you
What we collect
Why we need it
Donate
Name, address, email, mobile number and citizenship declaration (required). PAN or Aadhaar (required only if you want a tax certificate). Amount, date and transaction reference from our payment partner.
To receive and acknowledge your gift, meet the Foreign Contribution (Regulation) Act 2010, report your donation to the Income Tax Department in Form 113 and send you Form 114.
Volunteer
Name, age, mobile number, email, town, skills, languages and the days you are free. For work with children: ID proof and a signed code of conduct.
To match you to work, reach you about it, and keep children and the people we serve safe.
Contact us
Name, email or phone, and your message.
To reply to you.
Sign up for updates
Email address or WhatsApp number.
To send you news of our work. We ask with an unticked box, and only if you tick it.
Take part in a programme
Name, age, village and, for health camps, basic health details you choose to share.
To run the camp or class, follow up where you ask us to, and count how many people we reach. Health details are seen only by the doctors and volunteers treating you.
Visit the website
IP address, browser type and pages visited, held in server logs by our hosting provider.
To keep the website running and secure.
4. Our legal basis
We use your personal data on one of two grounds under the DPDP Act:
- Your consent, given by a clear action such as submitting a form or ticking a box. We never use pre-ticked boxes. You can withdraw consent at any time, as easily as you gave it (see section 10).
- Legitimate uses allowed by section 7, where the law requires us to process the data, for example keeping donation records for the Income-tax Act 2025 and our auditors, or answering a lawful request from a government authority.
Withdrawing consent does not affect what we lawfully did before, and does not remove records the law requires us to keep.
5. Photos, stories and children
Much of our work is with families, and many of the people we serve are children. We follow these rules for every photo, video and story we publish, on this website and on social media:
- We never publish the name, photo, address, school or any detail that could identify a child in need of care and protection, a child in conflict with law, or a child victim or witness, as section 74 of the Juvenile Justice (Care and Protection of Children) Act 2015 and section 23 of the POCSO Act 2012 require.
- For any other child, we publish a photo or story only with written, informed consent from a parent or lawful guardian, explained in Hindi or the local language, and with the child’s own agreement where they are old enough to give it.
- We change names in stories and say so, name no place smaller than the district, and remove location data from image files.
- Any adult can ask us to take down a photo or story of themselves or their child. We remove it from the website within 7 days of the request.
6. Who we share it with
We share personal data only with the people and services below, only as much as each needs, and each is bound to use it only for our purpose.
Who
What they receive
Why
Payment partner
Details you enter at checkout
[payment gateway name] processes your payment. It is regulated by the Reserve Bank of India and keeps its own privacy policy.
Income Tax Department
Donor name, address, PAN or Aadhaar, amount and mode
We must report donations in Form 113 so you can receive Form 114.
Our auditor
Donation and expense records
Our accounts are audited every year as the law requires.
Website host and email provider
Form entries and server logs
[hosting and email provider] store the website and deliver our emails.
Companies funding our work (CSR)
Totals and anonymised stories only
To report how their grant was spent. We share names or photos only with your separate consent.
Government authorities
Only what the request lawfully covers
When a law, court order or lawful request requires it.
We do not sell, rent or trade personal data, and we do not give it to anyone for their own marketing.
7. Data stored outside India
Some of the services above may store data on servers outside India. We use only services that protect it to a standard at least equal to this policy, and we will not transfer data to any country the Government of India restricts under section 16 of the DPDP Act.
8. How long we keep it
We keep personal data only as long as its purpose needs, or as long as a law requires. Then we delete it or remove anything that identifies you.
Record
How long we keep it
Donation records
8 years after the end of the financial year of the donation, for tax and audit
Volunteer details
While you volunteer, then 2 years; 24 months for applications we could not take up
Contact form messages
12 months after we reply
Updates list
Until you unsubscribe
Consent for photos and stories
While the photo or story is published; reviewed every year
Website server logs
At least 1 year, as the DPDP Rules 2025 require
9. How we protect it
The website runs only over an encrypted (HTTPS) connection. Only named volunteers who need a record can open it, with their own password. We keep backups, log who opens personal data, and review access when a volunteer leaves.
If a breach affects your data, we will tell you without delay: what happened, what it means for you and what we are doing. We will also report it to the Data Protection Board of India within 72 hours, as the DPDP Rules 2025 require.
10. Your rights
Under the DPDP Act you can:
- Know what personal data we hold about you and who we have shared it with.
- Correct, complete or update anything that is wrong or out of date.
- Erase data we no longer need, unless a law requires us to keep it.
- Withdraw consent at any time: use the unsubscribe link in any email, reply STOP on WhatsApp, or write to us.
- Nominate someone to act for you if you die or cannot act yourself.
- Raise a grievance with us, and then with the Data Protection Board of India.
To use any right, write to our data protection contact (below) from the email or phone number you gave us. We may ask you to confirm who you are. We acknowledge every request within 7 days and answer within 90 days, as Rule 14 of the DPDP Rules 2025 allows.
11. Complaints to the Data Protection Board
Please come to us first so we can put things right. If you are not satisfied with our answer, you can complain to the Data Protection Board of India under the DPDP Act, 2023.
12. Cookies
This website uses only cookies it needs to work, for example to keep a form from losing what you typed. We do not use advertising cookies and we do not track you across other websites.
If we add visitor analytics, we will ask your permission first through a cookie banner and list the tool here.
13. Children using this website
This website is meant for adults. You must be 18 or older to donate or to register as a volunteer. If you are under 18 and want to help, ask a parent or guardian to write to us. We do not knowingly collect data from children through this website, and we do not track, profile or target advertising at children.
14. Changes and languages
We will update this policy when the law or our work changes, and show the new date and version at the top. If a change affects how we use data you have already given us, we will tell you by email or WhatsApp before it applies.
This policy is also available in Hindi. Ask us and we will send it, or read it to you over the phone.
Contact
Data protection contact
For any question, request or complaint about your personal data, write or call. We acknowledge within 7 days.
Name and role
[name, role]
Phone
+91 87188 19093
Post
[full registered address], Barwani, Madhya Pradesh 451551