Privacy policy.

Who we are#

Proud Indian is a volunteer-run charitable trust in Bengaluru, registered under registration number INT-4-00864-2018-19. Our registered office is at #206, 8th A Main Rd, LBS Nagar, Kaggadasapura, Bengaluru 560017.

For the personal data described here, Proud Indian is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act). That means we decide why and how the data is used, and we are responsible for it.

To ask a question about your data or to use any of your rights, write to connect@proudindian.ngo. You can also call or WhatsApp us on +91 99864 31321, or write to the registered office above.

What we collect#

What we hold depends on how you deal with us. We only ask for what we use.

If you visit this website#

This website sets no cookies and does not ask you for any personal data. The fonts and images are served from our own site, so loading a page does not contact Google Fonts or other font and image services.

Cloudflare hosts the website. Like any web host, Cloudflare receives your IP address, browser details and the pages you request so that it can deliver the site and protect it from attacks.

We use Cloudflare Web Analytics to count visits. A small script from Cloudflare records each page view: the page address, the page you came from, your browser and device type, your approximate country, and how quickly the page loaded. Cloudflare says this analytics does not use cookies or local storage and does not track you across other websites. We see only totals, never individual visitors. Cloudflare handles this data under its own privacy policy.

The “Volunteer” section lists upcoming sessions. To keep that list fresh, your browser may ask our dashboard at dash.proudindian.ngo for the current list of public events. That request carries no personal data beyond what any web request carries, such as your IP address.

If you press “Pause motion” in the footer, your browser remembers that choice. See Cookies and local storage.

If you donate#

Donations go through a Razorpay payment page. The form asks for:

• your name, email address and phone number;
• your city and pincode, and optionally your address;
• optionally, your PAN, if you want an 80G receipt for a tax deduction;
• the amount you give.

You pay by card, UPI, net banking or another method on Razorpay’s page. Your card, UPI and bank details go to Razorpay and its payment partners. Proud Indian does not see or store them. We receive your donor details and a record of the payment (amount, date, status and Razorpay’s reference numbers).

We use these to email your donation receipt and 80G certificate, to answer questions about your donation, and to meet our duties under the Income Tax Act, 1961. Those duties include reporting donations to the Income Tax Department in Form 10BD and issuing donation certificates in Form 10BE, which need your name, address and PAN.

Razorpay handles your payment under its own privacy policy.

If you volunteer through the dashboard#

You sign up at dash.proudindian.ngo to volunteer. Volunteer accounts are for people aged 18 and over. When you register, we ask for your name, email address, phone number, date of birth and gender, and you choose a password. We store the password only in hashed form, so nobody at Proud Indian can read it. If you sign up from a link for a particular group or event, we note that too.

The dashboard asks for your date of birth and gender at sign-up. We don’t currently use them for anything.

We use your phone number for WhatsApp messages and for adding you to the WhatsApp groups of your teams and events. We check whether the number you gave is registered on WhatsApp so we know whether to message you there.

While you use the dashboard, we also keep:

• your profile photo, if you upload one;
• the teams you belong to, your role, and the events you sign up for or show interest in, with any message you send;
• attendance, which event leads mark after a session;
• your answers to event polls on WhatsApp, matched to your phone number;
• feedback, updates and event photos you post;
• your notification settings for email, WhatsApp and the in-app inbox;
• a record of the actions you take in the dashboard, with your name and role, so we can trace changes;
• sign-in details: your session, the IP address you signed in from and your browser type.

If you don’t upload a photo, the dashboard shows a picture from Gravatar if your email address has one, or else a generated cartoon avatar from DiceBear. To do this it sends Gravatar a scrambled (hashed) form of your email address, and your browser loads the cartoon from DiceBear using a scrambled code. Neither service receives your email address in readable form.

If you claim a reimbursement or an advance for programme costs, we keep the claim, its line items, your bills and receipts, approval screenshots, and the bank account the money should go to (account holder name, account number and IFSC code). We need these to pay you and to keep proper accounts.

The dashboard sends page views and error reports to PostHog, an analytics service, linked to your account ID and role. Session recording is turned off. PostHog stores this data in the United States. We use it to find and fix problems.

Kalakriti#

Kalakriti is our yearly arts festival for children. To run it we keep:

• for each child taking part: name, date of birth, gender, the centre that registered them, the competitions they enter, any music files for their performance, and event-day records such as pickup, check-in, meals, attendance, drop-off and results;
• for the centre coordinators (Guardians) who register children: name, email address and phone number, and a dashboard login;
• for judges and guests: name, phone number and optional email address;
• for drivers on transport routes: name and phone number.

Children are registered by their partner centre, school or care home, which we ask to check with the child’s parent or guardian first. We use the date of birth only to place a child in the right age category. Each child gets an ID and a QR code for the day so volunteers can check them in and out safely. See Children’s data.

If you contact us#

If you email us (connect@, hr@ or finance@proudindian.ngo), call or WhatsApp us, or message us on social media, we receive your name, contact details and whatever you choose to tell us. We use it to reply. Messages on social media are also handled by those platforms under their own policies.

Vendors and suppliers#

If you supply goods or services to us, we keep your name, contact details, address, bank account details, PAN and GST number, invoices and payment records. We need these to pay you and for our accounts and tax filings.

Children and families in our programmes#

Our programmes work with children in schools, shelters and communities. Apart from Kalakriti, we do not keep records about individual children in our systems. Volunteers take photos at sessions and events. Some of these photos, including photos of children, appear on this website and on our social media. See Children’s data.

Why we use it, and on what basis#

We process personal data for these purposes:

The DPDP Act calls the uses that do not need fresh consent “legitimate uses”. Meeting a legal obligation, such as keeping tax records, is one of them.

We do not sell personal data, and we do not use it for advertising.

Who we share it with#

We share personal data only with the services that help us run Proud Indian, and with authorities when the law requires it.

We store event photos in Immich, a photo library that we run ourselves, so photos uploaded there are not shared with an outside company. Our WhatsApp messages go out through a WhatsApp account we connect ourselves, so they pass through WhatsApp’s own systems.

Inside Proud Indian, volunteers see only what their role needs. For example, event leads see the people signed up for their events, and the finance team sees reimbursement claims.

Where your data is stored#

The dashboard, its database and our Immich photo library run on a server in Germany. Uploaded files are stored in Cloudflare R2 object storage. Donation records are held by Razorpay and in our accounts.

This means some of your data leaves India. The dashboard data and event photos are stored in Germany. PostHog stores dashboard analytics and error reports in the United States. Cloudflare may process website and file requests in data centres outside India. The DPDP Act allows this except to countries the Government of India restricts. We will stop using a service if the law no longer allows the transfer.

How long we keep it#

We keep personal data until it is deleted, either because you ask us to delete it or because we no longer need it. Some records have to be kept longer by law.

• Volunteer accounts and your dashboard activity, such as teams, sign-ups, attendance and posts, are kept until they are deleted on request or when we no longer need them. When we delete your account, we also delete your sessions, preferences and memberships, and remove you from our WhatsApp groups.
• Event photos are kept until they are deleted on request or when we no longer need them.
• Kalakriti records are kept until they are deleted on request or when we no longer need them.
• The record of dashboard actions is kept until it is deleted when we no longer need it. It keeps the name and role of the person who acted, even after their account is deleted, so that changes to money and records stay traceable.
• Financial records, including donations, PAN details, reimbursements, bills and vendor payments, are kept for as long as the Income Tax Act and other accounting laws require us to keep them for audits and tax assessments. We can’t delete these on request before that time is up.
• In-app notifications are deleted automatically 90 days after you archive them, or 180 days after you read them.
• Unfinished uploads are deleted after 24 hours.
• Sign-in sessions expire after 7 days unless you keep using the dashboard.
• Emails and messages you send us are kept as long as we need them to deal with your request.

How we protect it#

• All our sites use HTTPS.
• Passwords are stored only as hashes.
• The dashboard gives each volunteer access only to what their role needs, and it records who changed what.
• Uploaded files are kept in private storage. The dashboard checks that you are allowed to see a file and then gives your browser a link that works for a few minutes.
• Sign-in and sign-up are rate-limited to slow down password guessing.
• We never see your card or UPI details.

If a personal data breach affects you, we will tell you and the Data Protection Board of India, as the DPDP Act and Rules require.

Your rights#

Under the DPDP Act you can:

• ask for a summary of the personal data we have about you, how we use it, and who we have shared it with;
• correct or update it. You can edit your name, phone, date of birth, gender and photo yourself in the dashboard’s settings, or ask us;
• ask us to delete it, unless the law requires us to keep it, as it does for tax and accounting records;
• withdraw your consent at any time. This stops future use. It does not undo what we did before, and we may no longer be able to offer the service that needed it;
• nominate someone to use these rights for you if you die or become unable to act;
• complain to our Grievance Officer, and then to the Data Protection Board of India.

To use any of these rights, write to our Grievance Officer, Somasundaram A (Secretary), at connect@proudindian.ngo from the email address we know you by, or tell us how we can confirm it is you. Somasundaram A also handles requests to correct or delete your data. You can’t delete your own volunteer account in the dashboard yet, so write to connect@proudindian.ngo and we will delete it for you. We usually reply within a few days.

You can turn off email or WhatsApp notifications yourself in the dashboard’s settings.

Grievances#

If you are unhappy with how we have handled your data, write to our Grievance Officer:

Somasundaram A, Secretary, Proud Indian Email: connect@proudindian.ngo Address: #206, 8th A Main Rd, LBS Nagar, Kaggadasapura, Bengaluru 560017

We usually reply within a few days, and always within the time the DPDP Rules allow. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Cookies and local storage#

This website sets no cookies. Cloudflare Web Analytics, which counts our page views, sets no cookies either. If you press “Pause motion” in the footer, it saves one small value (pi-motion-paused) in your browser’s local storage so the site stays still on your next visit. It never leaves your device. You can clear it by pressing the button again or by clearing your browser’s site data.

The dashboard at dash.proudindian.ngo uses a cookie to keep you signed in. It is needed for the dashboard to work. The dashboard also stores a PostHog identifier in a cookie and in local storage to count page views.

Razorpay’s payment page sets its own cookies under Razorpay’s policy.

Children’s data#

We take extra care with children’s personal data, as section 9 of the DPDP Act requires.

We hold two kinds of personal data about children.

• Photos. Volunteers photograph sessions and events, and some photos of children appear on this website and our social media. We use them to show our work and to raise support. Before photos are taken or published, we ask the child’s parent or guardian, or the partner centre the child comes through.
• Kalakriti records. For the festival we keep each child’s name, date of birth, gender, centre, competitions and event-day records, as listed under Kalakriti. We use them only to run the festival and keep children safe on the day. The partner centre registers the child, and we ask it to check with the parent or guardian first.

We do not track children’s behaviour online, and we do not use their data for advertising. Volunteer accounts are for people aged 18 and over, and children do not have accounts.

If you are a parent or guardian and want a photo of your child taken down, or your child’s details removed, write to connect@proudindian.ngo. We will remove the photo from our website and our social media accounts, and delete the record unless the law requires us to keep it.

Changes to this policy#

We will update this policy when what we collect or how we use it changes. When we do, we will change the effective date at the top of this page.