Privacy Policy

Last updated: 30 October 2026

This policy explains what personal data we collect through this website, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It follows the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

In this policy, “we”, “us” and “our” mean the public charitable trust that runs this website. “You” means the person whose data we handle.

1. What we collect

1.1 Shop orders and event tickets

  1. Your name, phone number, email address and, for items that are shipped, your delivery address.

  2. Details of what you ordered or booked, and the payment status and transaction reference.

  3. Payments are handled by our payment gateway, Razorpay. We do not see or store your full card number, CVV, UPI PIN or net banking password.

  4. If you create an account on the site, we also keep your username, password (stored in encrypted form) and order history.

1.2 Contact form

Your name, email address, the subject and your message.

1.3 Donations

  1. Your name, phone number, email address, postal address and the amount you give.

  2. Your phone number is verified with a one-time code sent by SMS through an SMS provider.

  3. Your PAN, which is checked against Income Tax Department records through a PAN verification provider to confirm it matches your name. We need your PAN to issue an 80G receipt and to report your donation to the Income Tax Department.

  4. As with orders, payment is handled by Razorpay and we do not store your card or bank details.

1.4 Volunteer, internship, membership and update sign-ups

If you fill in a form to volunteer, intern, become a member or receive updates from us, we collect the details asked for in that form, such as your name, phone number, email address, and your interests, skills or availability.

1.5 Comments

  1. If you leave a comment, we collect the name, email address and website (if any) you enter, along with your IP address and browser details to help detect spam.

  2. A scrambled code made from your email address (called a hash) may be sent to the Gravatar service to check whether you have a profile picture there. If you do, it is shown next to your comment once it is approved. Gravatar’s privacy policy is at automattic.com/privacy.

  3. Your name, website and comment are visible to the public. Your email address is not.

1.6 Website use, cookies and statistics

  1. Cookies: the site uses small files called cookies to keep items in your cart, keep you logged in if you have an account, and remember your details for your next comment if you choose that option. Login cookies last up to two weeks if you select “Remember Me”. Comment cookies last one year. You can block or delete cookies in your browser, but parts of the site, such as the cart and checkout, may not work without them.

  2. Visit statistics: we use Jetpack Stats, provided by Automattic, to count visits. It records things like the pages viewed, the site you came from, your browser and device type, and your approximate location based on your IP address. We see only totals and trends, not who you are.

  3. Server logs: our hosting provider records basic technical details of each visit, such as IP address, browser and time of access, for security and to keep the site running.

1.7 Embedded content

  1. Some pages include videos, maps, posts or other content from sites such as YouTube, Google Maps, Instagram or Facebook.

  2. This content behaves as if you had visited that site directly. Those sites may collect data about you, set cookies, and track your interaction with the content, especially if you are logged in to them. Their own privacy policies apply.

1.8 Photos you upload

If you upload images to the site, please remove any embedded location data (GPS) first. Anyone can download images from the site and read that data.

2. Why we use your data

  1. To process and deliver your orders, and to confirm and manage your event bookings, including telling you about changes or cancellations.

  2. To answer your questions, complaints and requests.

  3. To issue donation receipts and 80G certificates, and to file Form 10BD with the Income Tax Department, as the Income Tax Act requires.

  4. To keep proper accounts and have them audited, as the law requires of a charitable trust.

  5. To prevent fraud, spam and misuse of the site, including by verifying phone numbers and PANs.

  6. To respond to volunteer, internship and membership requests, and to send you updates if you asked for them. You can stop updates at any time.

  7. To understand how the site is used so we can improve it.

  8. To comply with the law, court orders and lawful requests from government authorities.

We use your data only for these purposes. We do not use it for automated decisions that affect you, and we do not build profiles of you for advertising.

3. Your consent

  1. When you place an order, book a ticket, donate or submit a form, you agree to us using your data as described in this policy for that purpose.

  2. You can withdraw your consent at any time through our Contact page. Withdrawing it does not affect anything we did before, and we may still keep data that the law requires us to keep, such as donation and tax records.

  3. If you withdraw consent, we may not be able to complete an order, booking or donation that depends on it.

4. Who we share your data with

We share only what each party needs to do its job, and only for the purposes above.

  1. Payment gateway: Razorpay, to process payments and refunds.

  2. Courier partners: Shiprocket and the courier companies it works with, to deliver your orders. They receive your name, phone number and delivery address.

  3. Verification providers: our SMS provider, to send one-time codes, and our PAN verification provider, to check your PAN against Income Tax Department records.

  4. Website and service providers: our hosting provider, and the providers of tools we use to run the site and our email, such as Automattic (Jetpack and Gravatar). They store or process data on our behalf.

  5. Chartered accountants and auditors: to prepare and audit our accounts and file tax returns and Form 10BD.

  6. Government authorities: the Income Tax Department, and other authorities, courts or law enforcement where the law requires it.

  7. Organisers of partner events: if you book an event run by another organiser, we share the details they need to run it, such as your name, phone number and number of tickets.

We do not sell, rent or trade your personal data.

Some of these providers may store or process data outside India. Where they do, we rely on them to protect it, and we transfer data only as Indian law allows.

5. How long we keep your data

  1. Donation, order and accounting records, including PAN and receipts, are kept as long as tax and accounting laws require. This is generally about 8 years, and longer if a tax assessment, audit or legal case is still open.

  2. Event booking details are kept for as long as needed for the event, refunds and our accounts.

  3. Contact form messages and other enquiries are kept until the matter is closed and we no longer need them.

  4. Comments are kept while they remain on the site, so that we can recognise follow-up comments.

  5. Account details are kept until you ask us to delete your account, subject to the records in point 1.

  6. Records of how data was processed are kept for at least one year, as the Digital Personal Data Protection Rules require.

When we no longer need data and the law does not require us to keep it, we delete it or make it anonymous.

6. How we protect your data

  1. The site uses HTTPS, so data sent between your browser and the site is encrypted.

  2. Access to personal data is limited to the people who need it for their work.

  3. Admin accounts are protected by passwords and security tools.

  4. Payments are handled by Razorpay, which follows card industry security standards.

No method of storing or sending data online is completely secure, but we take reasonable steps to protect your data from loss, misuse and unauthorised access.

7. Data breaches

If a breach affects your personal data, we will:

  1. Take steps to contain it and limit any harm.

  2. Tell you without delay what happened, what it may mean for you, what we are doing about it, and what you can do to protect yourself.

  3. Report it to the Data Protection Board of India and to CERT-In, within the time limits the law sets.

8. Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

  1. Access: ask for a summary of the personal data we hold about you, how we use it, and who we have shared it with.

  2. Correction: ask us to correct, complete or update data that is wrong or out of date.

  3. Erasure: ask us to delete your data once it is no longer needed, unless the law requires us to keep it.

  4. Withdraw consent: at any time, as explained in section 3.

  5. Nominate: name another person to exercise these rights for you if you die or become unable to do so.

  6. Grievance redressal: raise a complaint with us about how we handle your data.

To use any of these rights, write to us through our Contact page. We may ask you to confirm your identity before acting on a request. We will acknowledge your request within 48 hours and respond as soon as we can, and in any case within the time limit set by the Digital Personal Data Protection Rules, 2025 (currently 90 days).

If you are not satisfied with our response, you can complain to the Data Protection Board of India. Please contact us first so that we have a chance to resolve the matter.

9. Children

  1. Our shop, donations and event bookings are meant for adults. If you are under 18, please ask a parent or guardian to buy, book or donate for you.

  2. For children’s events, a parent or guardian makes the booking and gives the child’s details, such as name and age, with their consent.

  3. We do not knowingly collect a child’s data without a parent’s or guardian’s consent, and we do not track children or target them with advertising. If you believe we have a child’s data without consent, tell us through the Contact page and we will delete it.

10. Links to other sites

The site links to other websites, including partner organisations and news articles. We are not responsible for their content or how they handle your data. Please read their privacy policies.

11. Changes to this policy

We may update this policy from time to time, for example when the law changes or we add a new service. The date at the top shows the latest version. If we make a significant change, we will say so clearly on this page.

12. Grievance Officer

If you have a question or complaint about your personal data or this policy, please contact our Grievance Officer through our Contact page. We will acknowledge your complaint within 48 hours and aim to resolve it within 15 days of receiving it.