Privacy Policy

Effective from 1 September 2026

Akshara Spoorthi Foundation ("the Foundation", "we", "us") is a public charitable trust registered in Telangana, India, with its registered office in Hyderabad. We work with government schools in rural Telangana and Andhra Pradesh.

This notice explains how we process your personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it. It covers this website, online and offline donations, the donor and volunteer portals, events, and the records we keep for our school programmes.

If anything here is unclear, write to our Grievance Officer at privacy@aksharaspoorthi.org. This notice is available in Telugu on request.

1. Who is responsible for your dataLink to the section 1. Who is responsible for your data

The Foundation decides why and how your personal data is processed, and is responsible for it. Where service providers process data for us (see section 7), they act as our Data Processors under a written contract and may use it only on our instructions.

2. The personal data we collectLink to the section 2. The personal data we collect

When you donate

Your name, email address, mobile number and postal address.
Your PAN, when you ask for an 80G receipt or when a donation must be reported to the Income Tax Department in Form 10BD. Aadhaar or passport details are collected only if you choose one of them as your identifier for that report.
Payment references from our payment gateway: transaction ID, amount, date and payment method type. We never receive or store card numbers, CVVs, UPI PINs or net-banking passwords.
For foreign contributions, the details the Foreign Contribution (Regulation) Act, 2010 requires us to record.

When you volunteer: your contact details, date of birth, education or occupation, skills, languages, availability, preferred districts, an emergency contact and, for roles that involve repeated contact with children, references and police verification status.

When you create an account, register for an event, subscribe or write to us: your name, email address, phone number, the details of your registration or message, and your communication preferences.

When you use the website: the technical data needed to deliver and secure it, such as your IP address, browser type and the pages requested, kept in server logs. Our Cookie Policy explains what is stored in your browser.

About the children in our programmes: name, school, class, gender, attendance and learning assessments and, only where a scholarship or health camp requires it, family circumstances or basic health information. Section 5 sets out the additional safeguards that apply.

3. Why we process it, and on what basisLink to the section 3. Why we process it, and on what basis

We process personal data only for a clear and lawful purpose:

With your consent — to send you updates, newsletters and appeals; to publish your testimonial or photograph; and to consider your volunteer application. You give consent by a clear affirmative action, and you can withdraw it just as easily (section 8).
For a legitimate use permitted by Section 7 of the DPDP Act — where you have voluntarily given us data for a specific purpose, such as making a donation and receiving its receipt or registering for an event; and where we must process data to comply with the law, such as issuing 80G receipts, filing Form 10BD, keeping books of account, meeting FCRA reporting duties, or answering a lawful request from a court or authority.

We do not use personal data for a purpose unrelated to the one it was collected for, and we do not make decisions about you by automated means alone.

4. How long we keep itLink to the section 4. How long we keep it

Donation, receipt and tax records: eight years from the end of the financial year of the donation, so that we can answer any assessment or reassessment under the Income-tax Act, 1961.
Foreign contribution records: for as long as the FCRA rules require.
Volunteer records: three years after your last activity with us, after which they are deleted or anonymised.
Newsletter and communication preferences: until you unsubscribe or withdraw consent.
Contact messages and grievances: two years after the matter is closed.
Server logs: up to 180 days, unless they are needed to investigate a security incident.

When the purpose has been served and no law requires us to keep the data, we erase it and instruct our processors to erase it too.

5. Children's personal dataLink to the section 5. Children's personal data

Under the DPDP Act a child is anyone under eighteen. Because our work happens in schools, this is the part of this notice we take most seriously.

We process a child's personal data only with verifiable consent from a parent or lawful guardian, recorded on a written form explained in Telugu, except where the law permits processing without it.
We do not track, behaviourally monitor or target advertising at children, and never process their data in a way likely to harm their well-being, as Section 9 of the DPDP Act requires.
Children's data is never sold, never shared with donors, and never used in fundraising without separate consent for that specific use.
A photograph or story of an identifiable child is published only under a consent record that is granted, in scope and unexpired. Our systems will not publish the image otherwise, and they remove it when consent is withdrawn or expires. Location data is stripped from every photograph when it is uploaded.
Access to beneficiary records is limited to named staff, and every access is logged.

Our Child Protection Policy sets out these commitments in full.

6. How we protect itLink to the section 6. How we protect it

We take reasonable security safeguards, as Section 8(5) of the DPDP Act requires: encryption in transit, individual role-based accounts, audit logs of access to sensitive records, regular backups, and contractual security obligations on every processor.

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person, in the form and within the time the rules prescribe, and tell you what we are doing about it and what you can do to protect yourself.

We share personal data only as far as each recipient needs it:

our payment gateway and banks, to process donations and refunds;
our email and SMS providers, to send receipts, confirmations and, with your consent, updates;
our hosting, storage and backup providers, which run this website and our systems;
our statutory auditors and professional advisers, who are bound by confidentiality;
the Income Tax Department, the Ministry of Home Affairs and other authorities, when the law requires it, for example in Form 10BD and FCRA returns.

We do not sell, rent or trade personal data. Some providers may store data outside India; any such transfer is made only as permitted by Section 16 of the DPDP Act and under contractual safeguards.

8. Your rightsLink to the section 8. Your rights

As a Data Principal you have the right to:

Access information about the personal data we hold about you, how we use it, and whom we have shared it with.
Correct, complete, update or erase your personal data, unless we must keep it to comply with a law, such as tax records.
Withdraw consent at any time for processing that relies on consent. Withdrawal does not affect processing already carried out, or donations already made.
Have your grievance redressed by our Grievance Officer.
Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, write to privacy@aksharaspoorthi.org from the email address you gave us, or use the settings in your donor or volunteer portal. We may ask you to confirm your identity. We acknowledge requests within 3 working days and resolve them within 30 days.

You also have duties under Section 15 of the DPDP Act: to give accurate information, not to impersonate anyone, and not to register false or frivolous grievances.

9. Grievances and the Data Protection BoardLink to the section 9. Grievances and the Data Protection Board

Grievance Officer, Akshara Spoorthi Foundation, Hyderabad, Telangana — privacy@aksharaspoorthi.org

If you are not satisfied with our response, you may complain to the Data Protection Board of India once you have used our grievance process, as Section 13 of the DPDP Act provides.

10. Changes to this noticeLink to the section 10. Changes to this notice

We will publish any change on this page with a new effective date. If a change materially affects how we use personal data you have already given us, we will tell you by email and, where the law requires, ask for your consent again.