Policies
Privacy notice
How we protect your personal data, and how to exercise your rights.
Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Last updated 12 October 2026.
SEVA Foundation, a public charitable trust at Room 20, 2nd Floor, 40 Weston Street, Kolkata 700013, decides why and how your personal data is used (the "Data Fiduciary" under the Act). This notice explains what we collect, why, and the rights you have.
What we collect and why
| Where | What we collect | Purpose |
|---|---|---|
| Donation and bank-transfer forms | Name, email, mobile, PAN, address, amount, payment reference, any dedication | Process your gift, send your receipt, and report donations to the Income Tax Department where the law requires |
| Enquiry form | Name, email, phone, topic, message | Reply to you |
| CSR form | Company, name, work email, phone, interests, budget | Discuss a CSR partnership |
| Volunteer form | Name, city, email, mobile, interests, availability | Contact you about volunteering |
| PoSH consultation form | Organisation, name, work email, phone, size, needs | Arrange your consultation |
| Newsletter | Email and, if given, name | Send stories and updates, only if you opt in |
Card, UPI and bank login details are entered only on the payment gateway's page. SEVA never sees or stores them.
Consent
We ask for your consent on each form, for that form's purpose only. Updates by email are a separate, optional choice that is never pre-ticked. You can withdraw consent at any time, as easily as you gave it, using the form below or by replying to any of our emails. Withdrawal does not affect what was done before, or records we must keep by law.
Who we share it with
- Our payment gateway, email and website hosting providers, who act only on our instructions
- Our auditors
- Government authorities where the law requires, such as the Income Tax Department for donation reporting
We never sell, rent or trade your personal data.
How long we keep it
- Donation records: for as long as tax and accounting laws require, then deleted
- Enquiry, CSR, volunteer and PoSH records: until three years after our last contact with you, then deleted
- Newsletter: until you unsubscribe
Children
Our website forms are for adults. We do not knowingly collect personal data of anyone under 18 without verifiable consent from a parent or lawful guardian. Information about children in our programmes is collected offline, only with a parent's or guardian's consent, and never used for advertising.
Security and breaches
Records are encrypted in transit, access is limited to authorised trustees and staff, and access is logged. If a breach affects your data, we will tell you without delay, in plain language, with what happened and what we are doing, and we will inform the Data Protection Board of India as the law requires.
Your rights
- Get a summary of your personal data we hold and how we use it
- Correct, complete or update it
- Have it erased, unless the law requires us to keep it
- Withdraw your consent
- Nominate another person to act for you in case of death or incapacity
- Raise a grievance with us, and then with the Data Protection Board of India
You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution.
Make a request or raise a grievance
Our Grievance Officer responds within 30 days. Write to sevaind@outlook.com or use this form.