Privacy Policy

1. Who we are

1.1 The Saath Foundation ("Saath Foundation", "we", "us") is a public charitable trust registered in Delhi on 20 December 2016 (PAN AASTS4419F). Our registered address is 754, Guru Apartments, Sector 14, Rohini, Delhi 110085. We work across India.

1.2 Saath Foundation does not run children's homes. We support registered partner shelter homes (Child Care Institutions) and families.

1.3 For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), Saath Foundation is the Data Fiduciary for the personal data described in this policy. The services we use to process data on our behalf are Data Processors (section 8).

1.4 Contact for anything in this policy: Grievance Officer, Anshu Aggarwal, help@thesaathfoundation.com, +91 85913 18882, 754, Guru Apartments, Sector 14, Rohini, Delhi 110085. This contact is also published in the Grievance Redressal Policy and in every reply we send to a rights request.

1.5 Until the DPDP Rules take effect (expected in May 2027), we also comply with section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). Until then we resolve personal-data grievances within one month, and we collect sensitive personal data, such as health information, only with written consent.

2. Whom this policy covers

This policy covers the following people. Each group also receives a short, separate consent notice at the point where we ask for their data. The notice lists the exact data items and purposes.

3. What we collect, and why

3.1 Donors

We never see or store your card number, CVV or UPI PIN. Razorpay handles these.

3.2 Donors giving from abroad (FCRA route)

In addition to 3.1: citizenship status; country; passport number (for Indian citizens abroad, to confirm citizenship); for foreign sources, full name, address, country, nationality, passport or ID details, currency, foreign amount, and the rupee amount credited by the bank; your signed declaration. We keep these because the Foreign Contribution (Regulation) Act, 2010 ("FCRA") requires us to report them.

3.3 Visitors (Meet Your Saathi and Saath Milan)

Photo ID (copy kept), police character or verification certificate (or a foreign police check), self-declaration of no offences against children, two references, names of household adults who will attend, visit history, orientation and quiz results, signed Visitor Code of Conduct, visit reports and any safeguarding notes. Purpose: safeguarding children. Basis: consent, given when you accept the Visit Policy and sign the Visitor Code of Conduct; s.7(a).

3.4 Volunteers

Application details, ID, police verification, references, training and code-of-conduct records, session attendance, and any safeguarding notes. Purpose: screening, matching, supervising sessions, and meeting our duties under the POCSO Rules, 2020 (rule 3(4)).

3.5 Children and their guardians

See section 4. It applies in addition to everything else in this policy.

3.6 Website users

Essential cookies only, unless you accept optional analytics. Analytics are counted by our own system on our own server, and no other company receives them. See the Cookie Policy (/en/policies/cookies). We keep server and security logs (IP address, time, page requested) for security.

3.7 Children and families in our programs

Records we keep to run a program for a child or family: enrolment, board-exam dates and the costs we fund, notes staff write about the family's needs, the household members named in the family's record and each one's consent, See to Learn camp records, and the papers a family gives the Document & Scheme Desk (for example an Aadhaar or ration card) to apply for a document or scheme. Health records are kept apart, collected only with the parent's or guardian's written consent, and opened only by staff who first record a reason. Purpose: running the program the family asked for. Basis: consent of the adult, or of the parent or lawful guardian for a child (section 4).

3.8 People who report a concern

What you tell us through Report a Concern, your contact details if you give them, and details of the people the report is about. Purpose: keeping children safe and reporting to the police or Child Welfare Committee where the law requires. Basis: s.7(a) for what you chose to tell us; s.7(d) where the law requires us to report.

3.9 Pledgers, people named by a donor, and people who contact us

Pledgers: name, contact details and pickup address, to collect and track the books or clothes. People named by a donor: the name (and contact details, if the donor gives them) of someone honoured with an occasion card or named as a nominee, used only for that card or nomination. People who contact us: what you send and how to reply to you. CSR representatives: name, role and contact details, for the company's partnership. Basis: s.7(a), or consent where we ask for it.

3.10 Sign-in and ID checks through other services

If you choose to sign in with Google or Facebook, we receive your name and email address from them. If you verify your ID through DigiLocker, we receive only your verified name.

3.11 Grouping Saathis

We group Saathis by giving pattern to choose which updates to send. This never affects a child's support or your rights.

3.12 What we do not do

• We do not sell or rent personal data.
• We do not use personal data for targeted advertising.
• We do not buy data about you from brokers.
• We do not make automated decisions that have legal or similarly significant effects on you.

4. Children's data

4.1 Who is a child. Anyone under 18 (DPDP Act s.2(f)).

4.2 Consent comes first. We do not process the personal data of any child supported through our programs until we hold verifiable consent from the child's parent or lawful guardian (DPDP Act s.9(1)). For a child living in a partner home, consent is given by the person legally responsible for the child, the home's person in charge (see the Partner Home Due-Diligence Checklist).

4.3 How we verify the adult. Before relying on consent, we check that the person giving it is an identifiable adult and is the parent or lawful guardian (DPDP Rules, rule 10). We do this by one of:

• (a) a DigiLocker or other authorised virtual token;
• (b) identity and age details the adult gives us, checked against the original document by trained Saath Foundation staff, who record the check (name of staff, date, document type, the last four characters only of the document number);
• (c) for a partner home, the home's registration under the Juvenile Justice (Care and Protection of Children) Act, 2015 ("JJ Act") s.41, and proof of the person in charge's authority.

4.4 Consent is itemised and separate. The guardian's consent notice lists each use separately, and each can be given or refused on its own:

• (a) creating a private record for the child (needed for any support);
• (b) a public profile (first name or chosen name, age band, district, interests, needs, itemised costs);
• (c) a photo, and which form (real, blurred, or an illustrated avatar);
• (d) sharing progress updates with the child's Saathis;
• (e) showing the names of vendors Saath Foundation pays for the child to that child's Saathis inside their login (see 4.8);
• (e1) showing a short summary of the family's situation, written by our staff, to the child's guardian: a verified Saathi whose own gifts, or whose Saathi Circle's gifts together, cover the share of the child's year set by Saath Foundation (currently half). It never names anyone or gives an address, a school or a number;
• (f) Meet Your Saathi and Saath Milan participation;
• (g) online classes, and separately, any recording of a class;
• (h) stories told in the child's words.

Refusing any item except (a) never affects the child's support.

4.5 The child's own view. Staff also ask the child, in an age-appropriate way, whether they are happy with their profile, photo and visits. A child's "no" is respected even where the guardian said yes.

4.6 What is never public. Surname, exact age, address, village or street, school name, parents' names, phone numbers, caste, religion, health details, case history, and image metadata (we strip EXIF and location data from every file on upload). Child profile pages are noindex and their URLs carry a code, never a name.

4.7 No tracking, no ads, no harm. On any page about a child or used by a child, we run no analytics, no tracking or behavioural monitoring, and no advertising or marketing pixels (DPDP Act s.9(3)). This includes child profile pages, the children listing, the online classroom and any login a child uses. The site's security policy blocks third-party scripts on these pages. We do not process a child's data in any way likely to harm the child's well-being (s.9(2)).

4.8 Vendor names. The Rupee Trail shows each Saathi the names of the vendors Saath Foundation paid from their gifts. A child's school is named only to a Saathi whose own gift was for that child, who has verified their ID and accepted the Donor Terms, and only with the guardian's consent. It is never named for a child who lives in a partner home, never for a child in any legal proceeding, and never to a Saathi who has met the child at a visit or a Saath Milan. Everyone else sees "a school in {district}". The original invoice is never shown; a copy of the bill may be, with anything that could identify a child or a family covered. Every view is logged. Saathis must accept Donor Terms that forbid contacting the school, partner home, child or family outside Saath Foundation.

4.9 Children in legal proceedings. If a child is, or may be, involved in a JJ Act or POCSO case, the child never has a public profile, photo or story, and no identifying detail is shared with anyone outside Saath Foundation's safeguarding staff (JJ Act s.74; POCSO Act s.23).

4.10 Withdrawal. A guardian may withdraw any consent at any time, as easily as it was given: through staff, by phone, or in writing. We unpublish the profile or photo within 24 hours and tell the child's Saathis only that the profile is no longer shown.

4.11 When a child leaves a program. We unpublish the profile at once, archive the private record, and anonymise or delete it on the schedule in section 10.

4.12 Who can see a child's private record. Only staff whose role needs it (role-based access). Consent documents and photos are encrypted at rest, served only through short-lived signed links, and every access is logged.

4.13 Under-18s using the site. Giving and opening an account are for adults only: checkout and sign-up ask you to confirm that you are 18 or older. If we learn that someone under 18 has given or opened an account, we stop, may return the gift to their parent or guardian, and delete their data except what the law makes us keep. Anyone, including a child, can use Report a Concern (/en/report-a-concern); we use what they tell us only to keep children safe.

5. Consent and how to withdraw it

5.1 We ask for consent with a clear notice, in plain language, that lists each data item and each purpose. Boxes are never pre-ticked.

5.2 You can withdraw consent at any time in your account (Privacy & data), by replying STOP on WhatsApp, through the telecom opt-out for SMS (the DND service, 1909), by using the unsubscribe link in any email, or by writing to the Grievance Officer. Withdrawing is as easy as giving consent.

5.3 Withdrawal does not undo processing already done lawfully. It also does not let us delete records the law requires us to keep, such as donation and tax records (section 10).

5.4 We keep a consent record: who consented, to which notice version, when, how, and any withdrawal.

5.5 This notice is in English and Hindi. You can ask for it in any other language listed in the Eighth Schedule to the Constitution, and we will provide it (DPDP Act s.5(3)).

5.6 From 13 November 2026 you may also manage consent through a registered Consent Manager if we integrate one. We are not required to.

6. Legitimate uses without consent

We may process personal data without consent only where the DPDP Act allows it (s.7), for example: to comply with a law or court order (tax, FCRA, POCSO reporting); to respond to a medical emergency or threat to someone's life or safety; or for purposes you voluntarily gave the data for and have not objected to.

7. Messages we send

• Transactional (receipts, payment and mandate notices, visit bookings): sent by email; by WhatsApp or SMS only if you opted in.
• Updates and appeals: only if you opted in, on each channel separately. You can opt out at any time.
• Every WhatsApp message names "The Saath Foundation" as the sender.

8. Who we share data with

8.1 Data Processors. We use these services under contracts (usually the provider's standard data-processing terms) that require security, confidentiality, use only on our instructions, and deletion when the work ends (DPDP Act s.8(2)). Saath Foundation remains responsible for them.

We will update this table before adding a processor.

Payment companies that also keep data under their own legal duties. Razorpay Software Private Limited handles domestic payments and UPI Autopay mandates. It receives your name, contact details, the amount and the payment details you enter on Razorpay's page. As an RBI-regulated payment aggregator, it also keeps transaction data under its own legal duties.

Sign-in and ID services (see 3.10): Google or Facebook, only if you choose to sign in with them, and DigiLocker, if you verify your ID that way. They are independent services, not our processors.

8.2 Vendors. Vendors we pay (schools, shops, service providers) receive only what they need to supply the service. They do not receive donor data.

8.3 Saathis of a child. A child's Saathis see progress updates and the vendor names described in 4.8 (a school's name only as 4.8 allows). A child's guardian (4.4(e1)) also sees the family summary. They never see the child's surname, address, family contacts or case history.

8.4 Partner homes. We share with a partner home only what it needs to support the child it cares for.

8.5 Government and law. We disclose data when the law requires, for example: donor details to the Income Tax Department (Form 113); foreign-contribution details to the Ministry of Home Affairs (FCRA returns); reports to the police, Special Juvenile Police Unit or Child Welfare Committee under POCSO or the JJ Act; and responses to lawful orders.

8.6 Professional advisers (auditors, lawyers) under confidentiality.

9. Where data is stored

Our platform is hosted in Mumbai, India. Some processors (for example an email or WhatsApp provider) may process data outside India. We transfer data outside India only as the DPDP Act s.16 and any government restrictions allow, and never children's records except as needed to deliver a message the guardian agreed to or to run a live online class. Children's private records, consent documents and photos are stored on our servers in India. Encrypted backups are kept by our cloud backup storage provider, in an India region where the provider offers one. Live online classes run on our video-meeting provider, which may process class video outside India; we never store class video on our servers.

10. How long we keep data

We keep data only as long as the purpose needs it, then erase it (DPDP Act s.8(7)), unless a law requires us to keep it longer. We keep processing logs for at least one year (DPDP Rules, rule 8(3)).

Our ledger cannot be edited. Donation entries are never changed or deleted. When you ask us to erase data, we erase or pseudonymise your personal details where the law allows, and keep the financial entry the law requires.

11. Security

We use reasonable security safeguards (DPDP Rules, rule 6), including: encryption in transit and at rest for consent documents, photos, PAN, Aadhaar and passport numbers; masking of PAN and ID numbers on screen; role-based access; passkeys for staff; access logs kept at least one year; backups; security terms in processor contracts; and staff training.

12. If something goes wrong (personal data breach)

12.1 To you. If a breach affects your data, we will tell you without delay, through your account, email or registered mobile. We will explain what happened, the likely consequences, what we have done, what you can do, and whom to contact.

12.2 To the Data Protection Board. We send a first notice without delay, and a detailed report within 72 hours of becoming aware of the breach, covering the facts, cause, mitigation, the person responsible, steps to prevent it happening again, and the notices sent to you (DPDP Rules, rule 7).

12.3 To CERT-In. We report cyber incidents covered by the CERT-In Directions of 28 April 2022 within 6 hours.

12.4 Children's data. A breach involving children's data is also a safeguarding matter. The Safeguarding Officer is told at once and decides, with the guardian, what else is needed to keep the child safe.

13. Your rights

You have the right to (DPDP Act ss.11–14):

• (a) access: a summary of your data, how we process it, and whom we shared it with;
• (b) correction, completion and updating;
• (c) erasure, subject to records the law requires us to keep;
• (d) withdraw consent (section 5);
• (e) grievance redressal (section 14);
• (f) nominate someone to exercise your rights if you die or become unable to.

For a child, these rights are exercised by the parent or lawful guardian.

How to ask. Use Privacy & data in your account, or write to the Grievance Officer. Tell us your name and the email or mobile number you used with us. We may ask for proof of identity before acting. We do not charge a fee.

14. Grievances

Write to Anshu Aggarwal at help@thesaathfoundation.com. We acknowledge within 2 working days and resolve personal-data grievances within one month at most (SPDI Rules, rule 5(9)); we aim for sooner. If you are not satisfied, you may complain to the Data Protection Board of India after using our process (DPDP Act s.13). See the Grievance Redressal Policy (/en/policies/grievance).

If a child may be at risk, do not wait for a grievance process. Use Report a Concern (/en/report-a-concern) or call +91 96258 68882 (9 am to 7 pm). In an emergency, call 112.

15. Changes

We will post changes here with a new version number and date. If a change affects how we use data you consented to, we will ask for fresh consent.