Privacy Policy

About this policy

Prerit Welfare Foundation ("the foundation", "we", "us") respects your privacy. This policy explains what personal data we collect through this website, why we collect it, how long we keep it, who we share it with and the choices and rights you have.

We follow the principles of India's Digital Personal Data Protection Act, 2023 (DPDP Act): we collect personal data only for clear purposes, use it only for those purposes, keep it only as long as needed and protect it with reasonable security safeguards. This policy applies to this website and the online services on it, such as donations, applications, accounts and forms.

Information we collect

We collect only the information you choose to give us, and a limited amount of technical information needed to run the website securely.

Account information

• Name, email address and mobile number, and optionally your address, city, state and PIN code.
• Your password, stored only in encrypted (hashed) form - we cannot read it.
• Your communication preferences and the date you accepted this policy.

Donations

• Name, email, mobile number, and - if you provide them - your PAN and address (needed for tax receipts where applicable).
• Amount, campaign, your message and whether you wish to remain anonymous on the website.
• Payment references from the payment gateway (order and payment IDs, status and payment method type).

Applications and requests for support

• Volunteer, volunteer teacher, staff and internship applications: contact details, date of birth, gender, education or qualifications, skills, availability, experience and, where requested, a resume.
• Membership, scholarship and help requests: the details needed to assess the request, which may include family and income information and supporting documents.
• Event registrations: name, email and mobile number.

Messages and newsletter

• Enquiries, grievances, fraud reports and feedback: your contact details, the message and any reference numbers you include.
• Newsletter: your email address, optional name, the consent text you agreed to, when and where you subscribed.

Uploaded documents

Resumes, identity or income documents and similar files you upload are stored in private storage. They are not publicly accessible and can be opened only by authorised staff through the secure admin panel.

Technical information

When you submit a form or sign in, we record your IP address and browser type together with the action, to prevent spam and misuse, to keep a security record and to investigate problems.

How we use your information

• To process donations, verify payments with the payment gateway, issue receipts and keep the accounting records required by law.
• To review applications, contact applicants, arrange orientation and interviews, assign volunteer activities and issue certificates for verified service.
• To assess and respond to requests for help and scholarships.
• To reply to enquiries, resolve grievances and act on reports of fraud or misuse of our name.
• To send newsletters - only if you have subscribed.
• To manage your account, keep it secure and show you your donations, receipts, applications, certificates and notifications.
• To understand, in aggregate, how the website is used so we can improve it.
• To meet legal, tax and regulatory obligations.

We do not use your personal data for automated decisions that significantly affect you, and we do not sell it or use it for third-party advertising.

Consent and legal basis

We process your personal data on the basis of your consent, which you give when you submit a form, create an account, donate or subscribe, and for the legitimate uses permitted under the DPDP Act - for example, using the details you voluntarily provided for the purpose you provided them, or complying with a legal obligation such as keeping donation records.

You may withdraw your consent at any time - for example, by unsubscribing from the newsletter with the link in any email, by changing your analytics choice with the Cookie settings link (when Google Analytics is in use), or by asking us to close your account. Withdrawal does not affect processing already carried out, and we may need to keep certain records where the law requires it.

Payments

Online donations are processed by our payment gateway, Razorpay. When you pay, you enter your card, UPI or bank details directly in Razorpay's secure checkout. The foundation never sees or stores your card number, CVV, UPI PIN or net banking password.

We receive only the information needed to confirm and record your donation, such as the payment reference, amount, status and payment method type. Razorpay processes payment data under its own privacy policy and the applicable regulations for payment providers.

Payments through Cashfree

Depending on the options shown on the donation page, an online donation may also be processed by Cashfree Payments (Cashfree Payments India Private Limited). If you choose Cashfree, you enter your card, UPI or bank details directly in Cashfree's secure checkout. The foundation never sees or stores your card number, CVV, UPI PIN or net banking password.

To start the payment we share your name, email address, mobile number (Cashfree requires a mobile number for every payment), the amount and the donation reference with Cashfree. We receive back only what is needed to confirm and record your donation, such as the payment reference, amount, status and the type of payment method. Cashfree processes payment data under its own privacy policy and the regulations that apply to payment providers.

Website analytics and cookies

Privacy-friendly analytics

We use our own first-party statistics to count page visits, the pages people find useful and how they reached us (for example a search engine or a campaign link). These statistics do not store your IP address: a visitor is represented by a code that changes every day and cannot be used to identify you. We respect your browser's "Do Not Track" and "Global Privacy Control" signals.

Google Analytics (optional)

If the foundation turns on Google Analytics, it loads only after you agree in the cookie notice. If you choose "No, thanks", it is not loaded and the website works fully.

Cookies and browser storage

• Session cookie - keeps you signed in while you use the website and protects forms against misuse. It is deleted when you close the browser.
• "Remember me" cookie - only if you choose it when signing in, so you stay signed in on that device. It can be removed by signing out.
• Your choices - your analytics choice and whether you have closed a notice are remembered in your browser. You can change your analytics choice at any time with the "Cookie settings" link at the bottom of every page.
• Google Analytics cookies (_ga, _ga_*) - set only if Google Analytics is turned on and you choose "Allow analytics"; removed if you later change your choice to "No, thanks".

We do not use advertising cookies. Analytics cookies - Google Analytics (if it is turned on) and our own return-visit cookie pwf_vid - are set only if you choose "Allow analytics" in the cookie notice. See Website analytics: details.

Website analytics: details

To understand how the website is used and to improve it, we keep our own first-party statistics on our own server. No advertising or third-party tracking scripts are used for this, and the website works the same whether or not you allow analytics cookies.

What we measure

• Your visit - the pages you open, in which order and when, the page where you arrived and the one you left from; how long each page was actually visible and in use (the timer pauses when the tab is hidden or after 30 seconds without activity), how far you scrolled (25, 50, 75 or 100%) and how quickly the page loaded.
• Actions on a page - clicks on buttons such as Donate or Apply, links to other websites, downloads, phone, email and WhatsApp links, share buttons and video plays; that a form was sent (only the name of the form and its address on this website - never what you typed); words typed into the website's search boxes (email addresses and long numbers such as phone numbers are removed); technical errors on the page; and quick repeated clicks that suggest something did not work.
• How you found us - the website that linked to us (its domain only), campaign tags in the link (utm_source, utm_medium, utm_campaign) and the resulting channel, such as search engine, social media, email or direct.
• Your device - device type (mobile, tablet or desktop), browser and operating system with their main version number, a screen-size range, the browser language and time zone.
• Approximate location - country, state or region and city, worked out from your IP address at the time of the visit, using the location information of our network provider or a location lookup service, if enabled. Your IP address is not stored in these statistics: a lookup result is kept for at most 24 hours in a cache under a coded value that changes every day, so that the same address is not looked up again. When no lookup is enabled, only the country suggested by your browser's time zone is recorded.
• Results - whether the visit led to a donation, an application, a registration or a similar action on this website, so that we can see which pages help people get involved.

Signed-in members

If you are signed in to your account, your visits are linked to your account, so that authorised staff can understand how members use the website and help you when you contact us. Staff accounts are never measured.

Recognising return visits - only with your consent

The pages of one visit are grouped with the website's normal session (the session cookie that also protects forms), which ends when you close the browser or after 30 minutes without activity. Only if you choose "Allow analytics" in the cookie notice do we set our own first-party cookie, pwf_vid, with a random code, for up to 13 months, so that we can tell first visits from return visits. It is never shared with anyone. If you later choose "No, thanks" (use the "Cookie settings" link at the bottom of any page), the cookie is deleted and your earlier visits are no longer linked together.

Do Not Track and Global Privacy Control

If your browser sends a "Do Not Track" or "Global Privacy Control" signal, none of these statistics are recorded for your visit.

Who can see it and how long we keep it

These statistics are stored on our own server, can be seen only by authorised staff in the admin panel, and are never sold or used for advertising. They are deleted automatically after the retention period set by our administrator (400 days by default).

Google Analytics and Google Tag Manager (optional)

The foundation may turn on Google Analytics (or load it through Google Tag Manager) to understand how the website is used. If it is turned on, it loads only after you choose "Allow analytics" in the cookie notice. If you choose "No, thanks", or make no choice, nothing from Google Analytics or Google Tag Manager is loaded. Advertising storage, ad personalisation and sending data for advertising stay off in every case: the foundation does not run advertising through this website.

What is sent if you allow it

• The address of the page you view and of the previous page, shortened to the page path: private codes and personal details that can appear in an address (such as payment, email-verification or password-reset codes) are removed before anything is sent. Only a few harmless parts are kept, such as the page number of a list, a category filter and campaign tags (utm_source, utm_medium, utm_campaign).
• That a form was sent (for example a volunteer application, an enquiry, an event registration or a newsletter sign-up), with its type only, and the steps of an online donation. Never your name, email address, phone number, what you typed, or any donation, receipt or reference number. Donation amounts are sent only if our administrator turns this on.
• The technical information that Google Analytics itself collects, such as browser and device type and an approximate location derived by Google.

Pages where it never loads

Google Analytics and Google Tag Manager are not loaded on donation result and receipt pages, password-reset, email-verification and sign-in pages, your member area, application-status and letter-verification pages, unsubscribe links, private event joining pages or any page opened through a personal link.

Changing your choice

Use the "Cookie settings" link at the bottom of any page. If you change to "No, thanks", Google Analytics cookies (_ga, _ga_*) are removed and it is not loaded again. If your browser sends a Global Privacy Control signal and you have not made a choice, we treat it as "No, thanks".

AI assistant

Our website may offer a website assistant - an automated chat that answers questions about the foundation and helps you find the right page or form. It is optional and is shown only when the foundation has switched it on. It is an AI system, not a person, and it can make mistakes: please check important details on the relevant page or with our team.

What is sent to our AI provider

• When you use the assistant, the text you type, the last few messages of the same conversation and publicly available information from this website (for example pages, programmes, events and FAQs) are sent to OpenAI, our AI service provider, to generate the reply. OpenAI may process this data on servers outside India.
• We do not send your name, email address, IP address or account details. Numbers and email addresses that look like personal details (phone, Aadhaar, bank or card numbers, OTPs) are removed automatically before your message is sent.
• Under OpenAI's API terms, content sent through its API is not used to train its models by default; OpenAI may keep it for a limited period to monitor for abuse.

Please do not share personal information

Do not type Aadhaar, PAN, bank account, card, UPI PIN, OTP, password, health or other sensitive details in the chat. Applications, donations and requests for help are made only through the forms on this website. The foundation never asks for an OTP, PIN or password.

Conversation records

When conversation records are switched on, we keep each question and reply (shortened, without your IP address or name; a random code groups the messages of one visit) to improve the website's answers. Only authorised staff can see them, and they are deleted automatically after a limited period set by our administrator (30 days by default). To prevent misuse, we count requests using a temporary code derived from your IP address that cannot be turned back into the address and is deleted within two days. The last few messages of your conversation are kept only for your current visit (in your session on our server), until you close the browser or clear the chat.

Your choice

Using the assistant is entirely optional. If you do not want your questions processed by OpenAI, simply do not use it - every page, FAQ and form on this website works without it, and you can always contact us directly. The assistant is not an emergency service: in an emergency, call 112.

Authorization letters for volunteer teachers

When a volunteer teacher is placed in a school, our coordinators may issue an authorization letter addressed to that school. The letter record keeps the volunteer's name, the type of identity document with only its last four characters, the last two digits of the mobile number, the name and address of the school, the letter date and which staff member issued it. We never store or print a full Aadhaar number.

Anyone can check that a letter is genuine on our letter verification page by entering the reference number and verification code printed on it. That page shows only whether the letter is valid or revoked, its date, a partly hidden name and the school name - never identity or contact details.

Letter records are seen only by authorised staff and are kept as part of our volunteer records, as explained under "How long we keep your information".

Programmes and event registrations

When you register for a workshop, seminar, session, hackathon or other event, or register your interest in a programme, we collect the details asked for on the form - usually your name, email address, mobile number and city, and where relevant your school, college or organisation and team name. For participants under 18 we also record the name and mobile number of the parent or guardian who gives consent.

• We use these details only to manage your registration: to confirm your place, send joining instructions and updates, keep an attendance record and, where the event page confirms it, issue a participation certificate.
• Joining links for online sessions are sent only to registered participants, by email or through a private link that works only for your registration.
• Only authorised staff and the coordinators of that event can see participant details. We do not publish participant names, and any participant numbers we publish come from verified attendance records.
• Photos and videos of participants are published only with consent.
• Partnership enquiries are handled like other enquiries sent through our contact forms.

You can ask us to cancel your registration or delete your details at any time through the Contact Us page.

How long we keep your information

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires:

• Donation and receipt records are kept for the period required under tax and accounting laws.
• Applications that are not successful are deleted or anonymised after a limited period; records of volunteers, interns and staff are kept while the association continues and for a reasonable period afterwards, including to verify certificates.
• Enquiries, grievances and feedback are kept for a limited period after they are resolved.
• Security logs are kept for a limited period, normally up to one year.
• Newsletter records are kept while you are subscribed; after you unsubscribe we keep only what is needed to respect your choice.

When data is no longer needed, it is deleted or anonymised.

Who we share information with

We do not sell, rent or trade your personal data. We share it only when necessary:

• Service providers who help us run the website and process donations - the payment gateway (Razorpay), our web hosting provider and our email service - only for providing their service to us.
• Government authorities where required by law, for example tax authorities for donation reporting where applicable, or law enforcement in response to a lawful request or a report of a crime.
• Auditors and professional advisers bound by confidentiality, for statutory audits and compliance.

Information shared with partner organisations for a specific programme is limited to what is necessary and shared only with your knowledge.

How we protect your information

• The website uses an encrypted connection (HTTPS).
• Passwords are stored only as secure hashes; password reset and email verification links expire and work once.
• Forms are protected against automated misuse and repeated attempts are limited.
• Uploaded documents are kept in private storage and are delivered only to authorised staff.
• Staff access the admin panel with individual accounts, role-based permissions and optional two-step login; staff actions are recorded in an audit log.

No system is completely secure. If we become aware of a personal data breach that affects you, we will inform you and the authorities as required by law.

Children's information

Our services are meant for adults. Information about a child (anyone under 18) - for example in a scholarship application or a request for help - should be submitted by a parent or lawful guardian, whose consent we rely on. We do not knowingly create accounts for children, track children's behaviour or direct advertising at them.

Photographs of children are published only with the written consent of a parent or guardian, as described in our Child Protection Policy.

Your rights

Under the DPDP Act and this policy, you have the right to:

• Access - ask for a summary of the personal data we hold about you and how it is used.
• Correction and updating - correct inaccurate or incomplete data. You can edit most profile details yourself in your dashboard.
• Erasure - ask us to delete your data or close your account, unless we must keep it by law.
• Withdraw consent - for example, unsubscribe from the newsletter at any time.
• Grievance redressal - raise a complaint about how your data is handled.
• Nominate - nominate another person to exercise your rights in the event of your death or incapacity.

To use these rights, use the data request option in your dashboard or write to us through the Contact Us page. We may need to verify your identity before acting on a request.

Questions and grievances

If you have a question about this policy or a concern about how your personal data is handled, please contact us through the Contact Us page or raise it on the Grievance Redressal page. We will acknowledge your concern and respond as early as possible.

If you are not satisfied with our response, you may approach the Data Protection Board of India in accordance with the DPDP Act.

Changes to this policy

We may update this policy when our services or the law change. The date of the latest update is shown at the end of this page. Significant changes will be highlighted on the website.

Last updated: 16 Oct 2026