Privacy Policy
Your privacy and data protection rights under Indian law
Quick Navigation:
Table of Contents
Privacy Policy Overview
Action for Social Change (AFSC India) is committed to protecting your privacy and personal data in accordance with Indian data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.
Key Points
- We collect minimal data necessary for our social empowerment programs
- Your data is processed lawfully and transparently
- You have full control over your personal information
- We implement strong security measures to protect your data
- We never sell your personal data to third parties
Secure
Bank-grade encryptionPrivate
No data sellingCompliant
DPDP Act 2023Key Definitions
Personal Data
Any data about an individual who is directly or indirectly identifiable, including name, contact details, education information, and social category.
Sensitive Personal Data
Information about social category (caste), financial information, biometric data, and any data that could cause harm if disclosed.
Data Principal
You, the individual whose personal data is being processed by AFSC India.
Data Fiduciary
AFSC India, as the organization that determines the purpose and means of processing your personal data.
What Personal Data We Collect
We collect personal data that is necessary for providing our social empowerment services to the Scheduled Caste community. The data we collect includes:
Identity Information
- Full name and father's name
- Date of birth
- Government ID numbers (when required for programs)
- Photographs (for identification and certificates)
Contact Information
- Mobile and WhatsApp numbers
- Email address
- Permanent and communication addresses
- PIN code and location details
Educational & Professional
- Current education status and qualifications
- School/college information
- Employment and occupation details
- Skills and interests
Sensitive Information
- Social category and sub-category (SC classification)
- Family income information (for scholarship eligibility)
- Bank account details (for fund transfers)
- Medical information (for health programs only)
Automatic Data Collection
We also automatically collect certain technical data when you use our website:
- Device information and browser details
- IP address and location data
- Website usage patterns and analytics
- Cookies and similar tracking technologies
How We Use Your Personal Data
We use your personal data solely for legitimate purposes related to our mission of empowering the Scheduled Caste community. Specific uses include:
Educational Services
- Processing scholarship applications and disbursements
- Providing educational guidance and mentorship
- Tracking academic progress and outcomes
- Connecting students with educational resources
Community Building
- Managing referral network and community connections
- Facilitating peer-to-peer support and mentoring
- Organizing community events and programs
- Building local support networks
Employment Services
- Job placement assistance and career guidance
- Skills training and professional development
- Connecting with potential employers
- Entrepreneurship support and funding
Program Management
- Measuring program effectiveness and impact
- Reporting to stakeholders and funding agencies
- Improving service delivery and outcomes
- Research for policy advocacy (anonymized data only)
Legal Basis for Data Processing
Under the Digital Personal Data Protection Act, 2023, we process your personal data based on the following legal grounds:
Consent
Your explicit consent for joining our programs and receiving our services, which you can withdraw at any time.
Contractual Necessity
Processing necessary to fulfill our service commitments and program delivery to you.
Legal Compliance
Compliance with applicable laws, regulations, and reporting requirements for NGOs and social programs.
Legitimate Interest
Our legitimate interest in advancing social justice and community empowerment, balanced against your privacy rights.
When We Share Your Data
Our Commitment
We never sell, rent, or commercially exploit your personal data. We only share data when necessary for program delivery or legal compliance.
We may share your data with:
Your Data Protection Rights
Under the DPDP Act 2023, you have the following rights regarding your personal data:
Right to Access
You can request to know:
- What personal data we hold about you
- How we use your data
- Who we share it with
- How long we keep it
Right to Correction
You can request us to:
- Correct inaccurate information
- Complete incomplete data
- Update outdated information
Right to Erasure
You can request deletion when:
- Data is no longer necessary
- You withdraw consent
- Data was processed unlawfully
Right to Data Portability
You can request:
- Copy of your data in structured format
- Transfer to another organization
- Machine-readable format
Right to Withdraw Consent
You can:
- Withdraw consent at any time
- Opt-out of marketing communications
- Limit data processing activities
Response Timeline
We will respond to your requests within 30 days as required by the DPDP Act. For complex requests, we may extend this by another 30 days with proper notification.
How We Protect Your Data
We implement comprehensive security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
Technical Safeguards
- 256-bit SSL/TLS encryption
- Encrypted database storage
- Regular security updates
- Intrusion detection systems
- Multi-factor authentication
Administrative Controls
- Role-based access controls
- Employee background checks
- Regular security training
- Data handling procedures
- Incident response protocols
Physical Security
- Secure data center facilities
- Restricted physical access
- CCTV monitoring
- Environmental controls
- Secure disposal procedures
Monitoring & Auditing
- 24/7 security monitoring
- Regular security audits
- Penetration testing
- Activity logging
- Vulnerability assessments
Data Breach Notification
In the unlikely event of a data breach that may harm you, we will notify you and the relevant authorities within 72 hours as required by law, along with details of the incident and steps being taken to address it.
How Long We Keep Your Data
We retain your personal data only as long as necessary for the purposes outlined in this policy or as required by law:
| Data Type | Retention Period | Reason |
|---|---|---|
| Registration Information | 7 years after account closure | Legal compliance, audit requirements |
| Educational Records | 10 years from program completion | Certification, follow-up support |
| Financial Information | 7 years from last transaction | Tax compliance, audit requirements |
| Communication Data | 3 years from last interaction | Service quality, dispute resolution |
| Website Analytics | 2 years | Service improvement, analytics |
| Marketing Preferences | Until withdrawal of consent | Consent-based processing |
Automatic Deletion
We have automated systems in place to delete data once retention periods expire, unless there are legal or regulatory requirements to retain it longer.
Cross-Border Data Transfers
Data Localization Commitment
Your personal data is primarily stored and processed within India. When international transfers are necessary, we ensure adequate protection through approved safeguards.
Limited International Transfers
We may transfer your data internationally only in the following circumstances:
- Cloud Services: Secure cloud storage with Indian or adequately protected international providers
- Technical Support: Software vendors providing essential services under strict data protection agreements
- Partnership Programs: International educational or developmental programs with your explicit consent
- Legal Requirements: When required by law or court orders
Safeguards for International Transfers
Standard Contractual Clauses
EU-approved data transfer agreements
Adequacy Decisions
Transfers to countries with adequate protection
Children's Privacy Protection
Special Protection for Minors
We provide additional privacy protections for users under 18 years of age, in compliance with Indian child protection laws.
Parental Consent
For users under 18, we require verifiable parental or guardian consent before collecting or processing personal data.
Limited Data Collection
We collect only the minimum necessary data for educational and developmental programs.
Enhanced Security
Additional security measures and access controls for children's data.
No Marketing
We do not send marketing communications directly to children or use their data for commercial purposes.
Rights for Children and Parents
- Parents can review their child's personal data
- Request correction or deletion of child's data
- Withdraw consent at any time
- Receive notifications of any changes to data practices
Grievance Redressal Mechanism
We have established a comprehensive grievance redressal mechanism as required under Indian law:
Submit Complaint
File your grievance through our online portal, email, or postal mail with detailed description of the issue.
Acknowledgment
We will acknowledge receipt of your complaint within 48 hours and provide a reference number.
Investigation
Our grievance team will investigate the matter and may request additional information if needed.
Resolution
We will provide a detailed response and resolution within 30 days of receiving your complaint.
Escalation Process
If you're not satisfied with our resolution, you can:
- Appeal to our Senior Grievance Officer
- Approach the Data Protection Board of India
- File a complaint with relevant regulatory authorities
- Seek legal remedies through courts
Contact Our Data Protection Team
Data Protection Officer
Name: Dr. Rajesh Kumar
Designation: Chief Data Protection Officer
Mon-Fri: 9:00 AM - 6:00 PM IST
Grievance Officer
Name: Ms. Priya Sharma
Designation: Senior Grievance Officer
Mon-Fri: 10:00 AM - 5:00 PM IST
Postal Address
Action for Social Change (AFSC India)Data Protection Office
123, Community Development Block
Bhagalpur, Bihar - 812001
India
Our Response Commitment
- Email inquiries: Within 48 hours
- Data requests: Within 30 days
- Grievances: Within 30 days
- Complex matters: Up to 60 days with notification
Privacy Policy Updates
Staying Informed
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
How We Notify You of Changes
Email Notification
For significant changes, we'll send email notifications to all registered users at least 30 days before the changes take effect.
Website Banner
Prominent notifications on our website homepage and user dashboard about policy updates.
SMS/WhatsApp Alert
Direct notifications via SMS or WhatsApp for critical privacy-related changes.
Policy Version History
| Version | Date | Major Changes |
|---|---|---|
| v2.0 | 2026-08-11 | Updated for DPDP Act 2023 compliance, enhanced rights section |
| v1.5 | 2023-06-01 | Added children's privacy protections, cookie management |
| v1.0 | 2022-01-01 | Initial privacy policy publication |