Sarv Sambhav
From Possibilities to Transformation
Legal & Regulatory Compliance

Privacy Policy & DPDP Act Notice

Governed by the Digital Personal Data Protection Act, 2023 & Information Technology Act, 2000 (Republic of India)

Notice Version: DPDPA-2023-V1 • Last Reviewed: October 2026

Statutory Notice to Data Principals (Section 5 & 6, DPDP Act 2023)

Sarv Sambhav Trust acts as a Data Fiduciary in processing digital personal data provided by visitors, donors, volunteers, and partners (the "Data Principal"). We collect and process your data strictly on the grounds of free, informed, specific, and unambiguous consent, or for specified legitimate charitable purposes.

Key Commitments:
  • No commercial sale, trading, or monetization of your personal data.
  • End-to-end cryptographic protection for all verified profile avatars (16-character encryption key per profile).
  • Full statutory rights to access, correct, erase, or withdraw consent at any time.
  • Dedicated Grievance Redressal Officer with legally binding response timeframes.

1. Identity of the Data Fiduciary

Sarv Sambhav Trust ("Sarv Sambhav", "we", "us", or "our") is a non-governmental public charitable trust registered and operating under the laws of India, headquartered in New Delhi. We operate the official website https://www.sarvsambhav.org and associated digital portals.
Registered Address: Amar Colony, New Delhi, India, 110041
Official Email: info@sarvsambhav.org
Helpline: +91 98997 82983

2. Personal Data We Collect & Specific Purpose (Itemized Notice)

Under Section 5(1) of the DPDP Act 2023, the following itemizes the digital personal data collected and the precise purpose for which each category is processed:

Data Category Data Fields Collected Lawful Purpose & Usage
Google OAuth Verification Display Name, Google Verified Email, Google Profile Avatar (DP) To verify identity, prevent automated spam / bot abuse, and maintain authentic communication threads.
Contact Inquiries Inquiry message content, designated reply-to email address To understand community queries, partnership proposals, and dispatch official replies via our secure mail relay.
Newsletter Subscriptions Email Address, subscription timestamp To deliver educational impact reports, vocational project updates, and trust newsletters.
Donation Correspondence Donor name, contact email, transfer reference / UTR number To generate official donation receipts, acknowledge contributions, and comply with Indian accounting and tax statutes.
Technical & Telemetry Data IP Address, Browser User-Agent, Date/Time Stamp, Consent Log Network security, rate-limiting, prevention of cyber attacks (Section 43A IT Act), and statutory audit trails of consent (Section 6(10) DPDP Act).

3. Google Profile Avatar (DP) Archival & Encryption Architecture

When you send a message through our verified contact system, our backend performs the following secure operations regarding your profile avatar:

  • Master Resolution Fetch: We request your master uncompressed profile photo directly from Google's secure user content CDN (googleusercontent.com) via verified TLS 1.3 channels with strict domain validation to eliminate spoofing.
  • 16-Character Profile Encryption Key: Our server generates an individual, cryptographically random 16-character encryption key for your profile.
  • Isolated Cloud Object Storage (AeroFiles): The photo payload is uploaded to our private Cloudflare R2-style object storage infrastructure (files.aerochrome.in) with password protection enforced at the storage engine level.
  • Access Restrictions: The photo cannot be viewed publicly without the matching 16-character access key (?p=<key>). Any attempt to access without the authorization key results in an immediate HTTP 401 Unauthorized response.
  • Purpose Limitation: Your photo is archived strictly to verify sender authenticity, prevent impersonation, and assist our trustees and administrators in managing official communication threads in AeroPanel.

4. Consent Architecture (Section 6, DPDP Act 2023)

Consent obtained on our website is:
(a) Free: You are never forced to submit inquiries through our online form; you may also contact us via telephone or physical post.
(b) Specific & Informed: Explicitly detailing each item of data collected, including the profile photo encryption.
(c) Unconditional & Unambiguous: Requires an affirmative, un-checked checkbox action before any submission is accepted.
(d) Revocable: You have the statutory right to withdraw your consent at any time with equal ease.

5. Rights of the Data Principal

Under Chapter III (Sections 11–14) of the Digital Personal Data Protection Act, 2023, you enjoy the following enforceable rights:

  • Right to Access Information (Section 11): You may request a summary of the personal data being processed about you, the identities of all Data Fiduciaries / processors involved, and any other relevant processing details.
  • Right to Correction & Erasure (Section 12): You may request correction of inaccurate or misleading data, completion of incomplete data, or erasure of your personal data when the purpose for which it was collected is no longer served.
  • Right of Grievance Redressal (Section 13): You have the right to readily available grievance redressal mechanisms regarding any act or omission by us in respect of our obligations.
  • Right to Nominate (Section 14): You have the right to nominate another individual who shall exercise your rights in the event of death or incapacity.
  • Right to Withdraw Consent: You may withdraw consent at any time by contacting our Grievance Redressal Officer. Upon receipt, we shall cease processing your data within a reasonable timeframe, unless retention is mandated by law.

6. Protection of Children & Persons with Disabilities (Section 9)

In compliance with Section 9 of the DPDP Act 2023, Sarv Sambhav does not knowingly process personal data of children under 18 years of age without verifiable consent of a parent or lawful guardian. We do not engage in tracking, behavioral monitoring, or targeted advertising directed at children. If you believe a minor has submitted personal data without parental authorization, please notify our Grievance Officer immediately for expedited erasure.

7. Reasonable Security Practices & Procedures (Section 8 DPDPA & Section 43A IT Act)

We implement comprehensive technical, operational, and managerial safeguards to protect your personal data from loss, unauthorized access, disclosure, alteration, or destruction:

  • Mandatory SSL/TLS 1.3 encryption across all website endpoints.
  • Parameterized PDO SQL queries preventing SQL injection attacks.
  • Session hardening with HttpOnly, SameSite=Lax, and Secure cookie attributes.
  • OAuth 2.0 State validation preventing Cross-Site Request Forgery (CSRF).
  • SSRF protection restricting image retrieval strictly to verified Google CDN endpoints.
  • Cryptographic password protection on remote object storage buckets.
  • Role-based access control restricting administrative panels strictly to authenticated trustees.

8. Data Retention & Erasure Schedule

We retain personal data only for as long as necessary to fulfill the purposes set out in this notice or as required under Indian law (such as financial records under the Income Tax Act, 1961). Contact messages and associated profile avatars are reviewed periodically and purged when no longer required for ongoing correspondence or audit compliance.

9. Statutory Grievance Redressal Mechanism & Grievance Officer

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023, Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Redressal Officer & Data Protection Lead is:

Officer Name: Vineet Saini
Designation: Grievance Redressal Officer & Data Protection Lead
Organization: Sarv Sambhav Trust
Physical Address: Amar Colony, New Delhi, India, 110041
Helpline: +91 98997 82983
Statutory Timelines: Grievance acknowledgement within 24 to 48 hours; full investigation and resolution within 15 days of receipt.

Escalation to Regulatory Authority: If your grievance is not resolved by our Grievance Officer within the prescribed timeframe or to your satisfaction, you retain the statutory right under Section 13(4) of the DPDP Act 2023 to register a complaint with the Data Protection Board of India (DPBI).

10. Jurisdiction & Governing Law

This Privacy Policy and all matters arising out of or related to the processing of personal data on this website shall be governed by and construed in accordance with the laws of the Republic of India. The courts of New Delhi, India shall have exclusive jurisdiction over any disputes arising hereunder.