1 | Objective

The purpose of this policy is to maintain the privacy of and protect the personal information of employees, contractors, vendors, interns, associates, donors, sponsors, beneficiaries and partners of Deepalaya and ensure compliance with laws and regulations applicable to Deepalaya.

2 | What is this policy?

This document sets out the details of Deepalaya’s Privacy Policy, in relation to information collected about you on this website (www.deepalaya.org), as well as through other means including in person, by post, by telephone, by emails and social media platforms (Facebook, Twitter, LinkedIn, Instagram). We are committed to protecting and respecting your privacy. This policy explains when, how, and why we collect personal information about people who visit our website, take part in our projects, reserve or attend our events or performances, and donate money to us; how we keep this information secure, and the conditions under which we may share it with others. 

If you have any queries relating to our Privacy Policy, or how we use your personal data, please email: privacy@deepalaya.org 

3 | Who We Are

Deepalaya is a non-government organisation, registered under the Societies Registration Act of 1860. It is an ISO:9001:2015 certified organisation working in six different sectors education, healthcare, women empowerment, vocational training, institutional care and differently-abled. The main objective has, delivering projects designed to benefit some of the most underprivileged children, youth and people in India. Our registered address is: 

Deepalaya

Human Resource Centre

46, Institutional Area

D-Block, Janakpuri

New Delhi, India

Pincode – 110058

We are a registered charity organisation no. 11359.  We are a FCRA certified organisation, no. 231650025. 

4 | How and when we collect personal information

We collect personal information that you provide when you contact us, interact with us, or use our website. This can include when you sign up to receive e-newsletters from us via our mailing list, when you decide to make a donation to us, or when you take part in one of our projects, or work with us as a volunteer or intern or an employee. The data in all these situations is either stored through online activities or in files in offline mode.

We collect small pieces of information called cookies when you are using our website, to help us ensure we are providing the best possible experience for users. Please see the section on ‘Cookies’ below for more details. 

If you are aged 16 or under, you must have your parent or guardian’s permission before you provide us with your personal information. Unless you have their consent, you are not allowed to give us your information.

We collect personal information in a number of ways which include:

• When you use our website or a third party website (like Razopay, PayTm or any other platform, where we have made a fundraising campaign etc., ) to make a donation
• When you use our website or a third party website to sign up for a mailing list, complete a survey, enter a query, or attend an event
• When you call us by phone to make a donation, enquire about our projects, collaborations or take part in one of our projects
• When you contact us by post, such as when you submit a response, return a donation form, return a contact form, or return a sign up form to take part in one of our projects 
• When we partner with a funding agency or a partner for implementing a project
• When we employ staff or recruit volunteers or staff
• When we implement projects, we collect data for the beneficiaries
• When we publish a picture or a video or a success story, we collect details regarding the benficiaries
• We very infrequently receive data about some supporters from other sources, such as from partner organisations. Please see ‘What we do with your information’ for more details. In these instances, please also refer to the Privacy Policy of the organisation which is collecting your information for more guidance on how they will share your data.

Where we are working with children individually or over a sustained period of time, for example on one of our schools projects and learning centers, we need to collect additional information from the school or from a parent/guardian including, but not limited to: medical details, educational attainment, details of any learning difficulties, special access requirements, residence & Id proof of the parents, blood group etc. This information will be used by our staff working on the specific project, in order to plan and deliver the best learning experiences for our beneficiaries, and to keep them safe throughout their experience with Deepalaya. This information may be passed to emergency services (like Police, Fire stations, court, hospitals etc.) for use should any emergency situation arise.  Except for these circumstances, the data is kept in a safe

Where we need to collect this information in respect of children, we will always ask schools/Learning centers to ensure they have consent from parents or guardians to provide the information and consent to its use for the purposes described. It may be necessary to share this information with some of our partner organisations who participate in project functioning, but that will not be done without your knowledge or permission. It will be shared as per the child protection policy norms that we follow across all locations.

5 | The types of personal information we collect 

We collect and store personal information from you when we are required to do so, such as to fulfil a contract you have with us; and when you’ve opted to give it to us, such as to be kept informed about our work by email newsletters.

Information from Donors, employees, volunteers/interns

The following list of information is data we gather directly from you through this (https://www.deepalaya.org) website, over the phone or by post, or through third party processors such as Google Forms, MailChimp, and crowdfunding/volunteering platforms, Facebook which is usually collected when you make a donation, sign up to our mailing list, or interact with us:

• Your title, name, and date of birth
• Your postal address and/or billing address and proof
• Your email address and phone number
• Your PAN no. details & proof
• Your place of work
• Your IP address and information on what pages you accessed (see Cookies policy below)
• Your current professional interests or activities which may be related to Deepalaya’s work
• Your detailed curriculum vitae, experience certificates, qualification details, certificates, proof of accolades etc.

We will also collect and hold details of any contact you have with us as a customer or supporter of Deepalaya, which may contain details of:

• contact preferences;
• your age range 
• event registration, attendance, or purchases;
• gifts and donation information, such as Standing Order bank details if applicable;
• details of correspondence sent to you and received from you by email, post, and over the phone;
• donor status and donation assessment information;
• employment information and professional activities;
• where relevant, selected media coverage concerning you, such as performance reviews or interviews (if you are an employee or partner who worked with us on a project);
• where relevant, information accessed through social media sites such as Facebook, Twitter, and Instagram, LinkedIn (only where you have given permission for this to happen); 
• any other information provided by yourself, at the request of Deepalaya.

5.1 | Special Data

Some of the information which we collect from you or a third party may constitute sensitive personal data, for example data collected from a school, learning centre or a parent/guardian when signing up a child to take part in one of our education projects. We will only ever use this in accordance with this policy and shall maintain strict and necessary measures to protect this information and its confidentiality.

5.2 | Taking part in one of our education projects

When an individual, a school, a centre or a parent/guardian enrolls themselves or a child up to take part in a project, the information provided will be used solely for that specific project or any other allied activity that they are participating in. Deepalaya will securely hold and process the data provided to us for the purposes of joining the project, in accordance with this privacy policy, and future communication will be carried out with the person or organisation who provides us with the data. For example, Deepalaya will communicate solely with the school/centre who represents a class of pupils taking part in an education project, rather than with the parents or children individually.

When joining a Deepalaya project, we will securely hold and process the data provided for the purposes of your/your child’s involvement in this project, to enable us to plan and deliver the best learning and educational experience, and, in extreme circumstances, to ensure the safety of all participants, and to contact parents/guardians in case of an emergency. 

For more information on this, please read our Child Protection Policy [https://www.deepalaya.org/about/policies/]

If you are enrolled into the project, we will use the details provided for your/your child’s involvement as detailed below. After the project has ended and there is no longer a requirement to hold and process the data provided by you, we will delete this personal data within eight years of your last engagement with Deepalaya or in case a funding agency is involved as per the requirement of that funding partner. Thereafter, a minimum level of information necessary for our administrative records to meet legal requirements shall be stored with us.

Please note that for certain projects it may be necessary to share information with third parties for project, reporting and research purposes. With the beneficiary’s knowledge and consent from a parent/guardian, obtained by the school/centre, necessary data will be shared securely with relevant partner organisations when planning projects, such as to ensure that specific needs are catered for. Anonymised data may be shared for use in funding applications, reporting, and evaluation.

6 | What we do with your information

Depending on your relationship with Deepalaya, and the preferences you have indicated to us, the data we hold may be used by us for a number of purposes. 

In general, for our donor/sponsor relationships we rely on contractual necessity and legitimate interests as the legal basis for processing your personal data. We do not rely on consent as a legal basis for donor/sponsor relationships, other than when we are obliged to do so in accordance with data protection laws in India. For our relationships with donors and funders, we generally rely on consent and will use your most recent contact preferences to ensure we contact you only when you have asked us to, and in the ways you have told us to do so. Occasionally, we may use legitimate interests to contact you by post with relevant information, unless you have told us not to. 

The purposes for which your personal data may be used includes the following: 

• To fulfill an agreement we have made with you, such as completing an order or reservation made online, including sending payment receipts and order updates. 
• To send you promotional, marketing or fundraising information by electronic means, when you have told us you wish to receive these by opting in to our mailing list or where we have an existing customer relationship with you and we have a legitimate interest. These types of communications can include:
• Informing you of other products, services or events related to Deepalaya’s work, such as forthcoming projects, upcoming events and activities.
• News and updates about Deepalaya and our organizational values, such as via email, newsletter, and specific marketing or supporter e-newsletters.
• Information on our fundraising activity, including requests to consider giving financial support to Deepalaya, such as through ongoing or specific project appeals, or to ask you to consider supporting us in other ways.
• Invitations to special events, such as film screenings or project events.  
• If you are an existing supporter, we may contact you with information about opportunities and services similar to those that were the subject of a previous to you; you can unsubscribe from any mailings by letting us know or you can be removed from our contact list at any point.
• Surveys about our work and opportunities to be involved in market research related to Deepalaya.
• Additional research, to help us understand our sponsors, donors and potential donors, including gathering information from publicly available resources to give an insight into your philanthropic interests and ability to support Deepalaya. See How we analyse your data for further information.
• Tools may be used to monitor the effectiveness of our communications with you, including email tracking, which records when an e-newsletter from us is opened and/or how many links are clicked within the message. The data from this tracking is generally used in an anonymised form through MailChimp.

You can opt out of all our communications at any point simply by clicking the ‘unsubscribe’ button on the bottom of any email which we send to you. Alternatively, you can update your contact preferences for each type of mailing you receive by clicking the link which appears alongside ‘unsubscribe’. You may also make this request by contacting us directly by emailing privacy@deepalaya.org. In case, you are not interested to receive any information by post, you can write to us at privacy@deepalaya.org or at our registered office address by post.

There are some essential donation and transaction communications that we are required to send to you, regardless of your contact preferences. This would include Standing Order and Direct Debit payment confirmations, donation receipts and thank you letters, up to three renewal reminders, Gift in kind confirmation letters, birthday greetings, half yearly report, annual progress report and querying any bounced payments. If you have told us you do not wish to be contacted, these are the only communications we will have with you. You will not receive our newsletters or event invitations unless you update your communication preferences.

For employees, volunteers or interns, the data is stored in personal information files of the respective candidate. Such data is usually saved in physical files, which are kept in lock and key under the custody of Administrative & HR head. No one can access that information unless, it is authorized by the senior management.

Besides, we may enter into agreements, Memorandum of Understanding (MoU) or a contract for various purposes, either for receiving funds, supply of material, construction or any other contract necessary for carrying on the activities of the organization, such agreements/documents shall be safely stored and kept under lock and key under the custody of Administrative & HR head. No one can access that information unless, it is authorized by the senior management.

Documents relating to confidential decisions, meetings, executive committee, general body meetings shall also be kept under lock and key under the custody of Administrative & HR head. No one can access that information unless, it is authorized by the senior management.

7 | How we analyse your data

We may use data so collected for carrying out statistical analysis of our engagement or our relationship with you anonymously. In case, we wish to use your name, we will obtain your consent while publishing any such report. 

We may segment the information we hold about you in our database based on your previous purchase history or interactions with Deepalaya’s work. These segmentations are carried out using personal data collected at the point of sale, as well as how engaged with us you have previously been, and any indicators of future engagement. Analysis of this helps us understanding our customers, sponsors, donors and potential donors to ensure we are efficient, and that only relevant communications are sent to you. We will not send you any communications which you have opted out of. 

We may very occasionally carry out analysis and further research on a small number of our supporters and donors. This may include the appointment of an external party to undertake additional research based on information we currently hold, as well as from publicly available information, to better understand how we can evolve our future relationship with you. Any such arrangements will be subject to a formal contracted agreement between Deepalaya and that external partner, and will protect the security of your data. 

By making a donation or sponsoring or purchasing, our legitimate interest allows Deepalaya to analyse your personal data in the above ways. You can opt-out of your data being used for further analysis, with the aims of targeting communications with you appropriately, at any time, simply by contacting privacy@deepalaya.org

The above is one of the examples for analyzing data.

8 | Who we might share your information with

Your data will never be sold to any third party or external organisation for any purpose and will only be shared or passed to a third party on a temporary basis in order to provide an essential service (see examples below). Any third party with whom data has been shared in this way will be contractually required to ensure your data is secure, and will not be retained once that service has been fulfilled. Whilst Deepalaya is responsible for the safety of your data, we are not responsible for the privacy policies and practices of other organisations or websites, even if accessed using links through our website. It is recommended that you check the policy of each external website you visit and contact them directly if you have any concerns or questions.

Examples of such purposes and the companies we work with include: 

• Give India or LetzChange, for the processing and storage of Direct Debit information for regular donations set up and made through their website
• Razorpay, for the processing of credit and debit card information for one-off and recurring donations or purchases  
• Google and Facebook, in order to identify similar customers to our audience, or to provide personalised advertising through third party websites. The data which is shared with these advertisers, through visiting our website, is anonymous to protect your personal information.

9 | How we store your personal information

We have robust security measures in place to protect the personal information that we have under our control, and to protect it from unauthorised access or improper use. Data you share with us through our website is encrypted, and stored on secure hard drives. We do not store any payment information ourselves. All Deepalaya employees who have access to, and are associated with the processing of data, are legally obliged to respect the confidentiality of our supporters’ and donors’ personal information.

The personal information you share with Deepalaya when purchasing or making a donation, may be transferred to countries outside of India, such as if the computer servers for third party processing companies are based in the USA. If we transfer your data in this way and outside of India, we will take all necessary precautions to maintain your privacy rights and protect your information as we have outlined in this privacy policy. 

We will retain your personal information on our IT systems only for as long as is reasonably necessary in order to carry out the purposes set out in this privacy notice, and to fulfil our legal obligations. We will not keep more information than we need. The retention period will vary according to the purpose we are holding your information for, however in general we will store your data for up to five years from the date of your last interaction with us e.g. the last time you purchased or did transaction, requested information from us, made a donation, or attended an event. After five years, we will remove all personal data we hold on you, except for the bare minimum we need to keep such as your name and donation history. Please contact us using the contact details at the bottom of this notice should you wish to find out more about how long we will keep your information. 

Our current IT systems for storing personal data include the following programmes and documents, which are all encrypted and password protected. Those with two-step authentication are clearly identified. 

• Google G Suite (two-step) (including Docs, Sheets, Drive, Forms, Gmail)
• Microsoft Office (including Microsoft Word, Excel)
• Manager Accounting Software
• Windows OS

If you ask us to stop sending direct marketing communications to you, we will only keep the minimum amount of information required to ensure we adhere with such requests, such as your name. If you exercise your right to be forgotten, we will ensure that your personal information is removed from our database, except where our legal obligations require us to retain it. In these instances, we will retain the minimum information necessary, and for the legally required length of time only.

The physical copies of the files or information provided by you shall be stored under the lock and key under the custody of Administrative & HR head. No one can access that information unless, it is authorized by the senior management.

10 | How you can access the information we store about you

You can ask us at any time if we are keeping any personal information about you and you can also request to receive a copy of that data as per Right to Access.

To make a Request you will need to provide adequate proof of identity such as a copy of your voter id card, passport, PAN card or driving licence before your request can be processed. 

Please try to be as clear as possible about the information you are seeking, so we are able to process your request as quickly as possible.

Once we have received your Request, and proof of identity, you will receive a response from us within 28 days and you will be able to get electronic copies of any information we hold on you.

Right to Access Requests should be sent to:

Deepalaya

Human Resource Centre

46, Institutional Area

D-Block, Janakpuri

New Delhi, India

Pincode – 110058

Email: privacy@deepalaya.org. 

At any time, you may request that we delete or correct your personal information. If you wish to correct any information on you held by Deepalaya, simply contact us using the details above.

11 | Cookies

In order to make the Deepalaya website easier to use and improve our service, we sometimes place small pieces of information on your computer. These are known as cookies and they are used by most major websites. Deepalaya currently uses cookies when you visit this website; remembering your preferences, recording your donation transactions, and counting the number of people looking at a website.

We use cookies for a variety of reasons detailed below. Unfortunately in most cases there are no industry standard options for disabling cookies without completely disabling the functionality and features they add to this site. It is recommended that you leave on all cookies if you are not unsure whether you need them or not in case they are used to provide a service that you use.

You can prevent the setting of cookies by adjusting the settings on your browser (see your browser Help for how to do this). Be aware that disabling cookies will affect the functionality of this and many other websites that you visit. Disabling cookies will usually result in also disabling certain functionality and features of this site. Therefore, it is recommended that you do not disable cookies. The Cookies We Set

•          Cookies may be used to remember if you have already registered for our email newsletter and signed up for regular news updates to ensure you only get relevant notifications

•          Cookies are used to ensure that your donation payment is processed properly and that your details are remembered throughout the transaction. 

•          In some special cases we will also use cookies provided by trusted third parties. This site uses Google Analytics which is one of the most widespread and trusted analytics solution on the web for helping us to understand how you use the site and ways that we can improve your experience. Google Analytics generates statistical and other information about website usage by means of cookies, which are stored on users’ computers. The information collected by Google Analytics about usage of our website is not personally identifiable. The data is collected anonymously, stored by Google and used by us to create reports about website usage. Google’s privacy policy is available at http://www.google.com/privacypolicy.html.

•          We also use social media buttons and/or plugins on this site that allow you to connect with your social network in various ways. For these to work the following social media sites including; Facebook, Twitter, Instagram, LinkedIn, will set cookies through our site which may be used to enhance your profile on their site or contribute to the data they hold for various purposes outlined in their respective privacy policies.

Hopefully that has clarified things for you and as was previously mentioned if there is something that you aren’t sure whether you need or not it’s usually safer to leave cookies enabled in case it does interact with one of the features you use on our site. However, if you are still looking for more information then you can contact us at privacy@deepalaya.org

12 | Changes to our privacy policy

We regularly review this privacy policy, and may make changes throughout the year. Any changes made will be posted to this page, and will apply from the time we post them. This privacy notice was last changed on 1^st April 2020 and is due to be reviewed on or before 31^st March 2021.

13 | How to contact us

If you have any comments on our privacy policy, or any of the personal information we hold about you which are not covered by the points above, please contact us:

• by email to privacy@deepalaya.org 
• or writing to us at Deepalaya, Human Resource Centre, 46, D-Block, Janakpuri, New Delhi – 110058