At Sobera Foundation, we respect the privacy, dignity, and rights of individuals who interact with us. This Privacy Policy explains how Sobera Foundation may collect, use, process, store, disclose, and protect personal information when you visit, access, or use our official website, submit information through our forms, make a donation, contact us, volunteer, seek support, or otherwise interact with our online services. We are committed to handling personal information responsibly and in accordance with applicable laws and regulations of India, including applicable provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, as and when applicable to the relevant processing activity. 1. Scope of this Privacy Policy This Privacy Policy applies to personal information collected through: - Our official website; - Online donation and payment processes; - Contact and enquiry forms; - Volunteer or participation forms; - Support or assistance forms; - Communications with donors, volunteers, supporters, beneficiaries, and website visitors; and - Other online interactions with Sobera Foundation. This Policy may not apply to third-party websites, applications, payment services, social-media platforms, or other external services that are independently operated by third parties. 2. Personal Information We May Collect Depending on how you interact with us, we may collect personal information such as: A. Information provided directly by you - Full name; - Email address; - Mobile or telephone number; - Address or other location information voluntarily provided by you; - Donation amount and donation-related information; - Transaction or payment reference information; - Information submitted through contact, volunteer, support, application, or enquiry forms; - Information you voluntarily provide when communicating with us; and - Other information reasonably necessary for the purpose for which it is provided. B. Technical and usage information When you access our website, certain technical information may be collected automatically, depending on the website's configuration and technologies being used, such as: - IP address; - Browser type and version; - Device type; - Operating system; - Website pages visited; - Approximate usage information; - Date and time of access; - Referring or exit pages; and - Other technical information necessary for website security, functionality, and performance. We will seek to limit the collection of personal information to information that is reasonably necessary for the relevant purpose. 3. Purposes for Which We Use Personal Information Personal information may be processed for legitimate and lawful purposes, including: - Processing and acknowledging donations; - Processing payment-related requests; - Issuing donation receipts or other applicable documentation; - Responding to enquiries, requests, complaints, or communications; - Communicating with donors, volunteers, supporters, beneficiaries, and other persons who interact with the Foundation; - Administering volunteer, support, participation, or assistance-related activities; - Providing information regarding our charitable activities, programmes, and initiatives; - Maintaining appropriate administrative, accounting, financial, legal, regulatory, and organisational records; - Protecting the security and integrity of our website and systems; - Detecting, preventing, and investigating fraud, misuse, unauthorised activity, or security incidents; - Improving website functionality, performance, accessibility, and user experience; and - Complying with applicable legal, regulatory, governmental, or lawful requirements. We will not knowingly process personal information for purposes that are unlawful or incompatible with the applicable legal basis for processing. 4. Lawful Basis and Consent Where applicable law requires consent for processing personal information, we will seek consent in the manner required by applicable law. Where processing is permitted on another lawful basis recognised under applicable law, consent may not be required for that particular processing activity. Where consent is relied upon, consent should be informed, specific, clear, and capable of being withdrawn in accordance with applicable law. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal, and may not affect processing that is otherwise permitted or required under applicable law. 5. Notice and Transparency Where personal information is collected directly from you, we will endeavour to provide appropriate information about: - The personal information being collected; - The purpose for which it is being processed; - How you may exercise applicable rights; - How you may contact us regarding your personal information; and - Any other information required to be provided under applicable law. Where applicable, such information may be provided through this Privacy Policy, a website notice, a form-specific notice, or another appropriate communication. 6. Donation and Payment Information Online donations may be processed through third-party payment gateways, banks, UPI providers, card networks, or other payment service providers. Sobera Foundation does not intend to store complete debit-card numbers, credit-card numbers, banking passwords, UPI PINs, CVV numbers, or other confidential payment credentials on its own servers, unless such storage is specifically required and lawfully permitted through an authorised payment service or system. Payment information may be processed directly by the relevant payment service provider in accordance with its own terms, privacy policy, security procedures, and applicable law. Sobera Foundation may receive limited transaction information necessary to identify, reconcile, acknowledge, verify, or administer a donation, such as transaction/reference numbers, payment status, donation amount, date, and other information made available by the payment provider. 7. Sharing and Disclosure of Personal Information Sobera Foundation does not sell, rent, or trade personal information for commercial purposes. Personal information may be shared with or made available to appropriate third parties where reasonably necessary for legitimate and lawful purposes, including: - Payment gateways and payment processors; - Banks, UPI providers, card networks, and financial institutions; - Website hosting, technology, security, maintenance, or IT service providers; - Communication or email service providers; - Professional advisers, auditors, accountants, legal advisers, or consultants; - Government authorities, regulators, law-enforcement agencies, or other authorised bodies where required or permitted by law; - Service providers assisting the Foundation with its charitable, administrative, or operational activities; and - Other parties where disclosure is necessary to protect the rights, safety, security, property, or legitimate interests of the Foundation, website users, donors, beneficiaries, or other persons, subject to applicable law. Third-party service providers may process personal information on behalf of the Foundation and may have their own privacy and security obligations. 8. Data Processors and Third-Party Services Some services used by the Foundation may involve third-party service providers processing personal information on the Foundation's behalf. Depending on the website's actual configuration, such services may include: - Website hosting; - Payment processing; - Website security; - Email or communication services; - Website analytics; - Technical maintenance; and - Other technology or operational services. The Foundation will seek to use appropriate service providers and reasonable safeguards in accordance with applicable law. Specific third-party services may change from time to time as the Foundation's website and operations develop. 9. Cookies and Similar Technologies Our website may use cookies and similar technologies for purposes such as: - Essential website functionality; - Security; - Session management; - Performance; - Website analytics; - User experience improvement; and - Other purposes disclosed through the website where applicable. Some cookies may be necessary for the website to function properly. Where applicable, users may manage cookies through their browser settings or any cookie-management controls made available on the website. Disabling certain cookies may affect the functionality or performance of some parts of the website. Where consent is legally required for non-essential cookies or similar technologies, the Foundation will seek to obtain such consent in the manner required by applicable law. 10. Data Security Sobera Foundation will take reasonable technical, organisational, and administrative measures appropriate to the nature and risks of the personal information processed to help protect it against unauthorised access, misuse, alteration, disclosure, destruction, loss, or other unlawful processing. Security measures may include appropriate access controls, technical safeguards, organisational procedures, and security practices appropriate to the circumstances. However, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure. In the event of a personal-data breach, the Foundation will take such steps as may be required under applicable law, including applicable notification, mitigation, investigation, and reporting requirements. 11. Data Retention Sobera Foundation will retain personal information only for as long as reasonably necessary for the purposes for which it was collected or processed, or for as long as required or permitted under applicable law. The period of retention may depend on: - The nature and purpose of the information; - Whether the information is required for ongoing services or communication; - Accounting, financial, tax, audit, or donation-record requirements; - Legal or regulatory obligations; - Dispute resolution; - Fraud prevention and security; and - Other legitimate organisational requirements. When personal information is no longer required and there is no legal or legitimate reason to retain it, the Foundation will take reasonable steps to delete, erase, anonymise, or otherwise dispose of it in accordance with applicable requirements. 12. Children's Personal Information Sobera Foundation respects the privacy and safety of children. We do not knowingly seek unnecessary personal information directly from children through the website. Where our charitable programmes or activities involve children and personal information is required, such information will be handled with appropriate safeguards and in accordance with applicable laws and requirements relating to children's personal data. Where applicable law requires verifiable parental or legal-guardian consent, the Foundation will take reasonable measures to comply with such requirements. We will not knowingly undertake activities involving children's personal data in a manner prohibited by applicable law. 13. Personal Information Relating to Beneficiaries Some of the Foundation's charitable activities may involve individuals or families who require assistance. Where information relating to beneficiaries is collected or processed, the Foundation will seek to handle such information respectfully, responsibly, and only for legitimate purposes connected with the relevant charitable activity, subject to applicable law. The Foundation will take reasonable care when handling information that may be sensitive or could adversely affect the dignity, safety, privacy, or wellbeing of beneficiaries. 14. Your Rights Subject to applicable law and any lawful limitations, individuals may have rights relating to their personal information, including applicable rights to: - Obtain information about the processing of their personal data; - Request correction of inaccurate or incomplete personal information; - Request erasure of personal information where legally applicable; - Withdraw consent where processing is based on consent; - Raise a grievance regarding the processing of personal information; and - Exercise any other rights available under applicable data-protection law. Requests may be subject to reasonable verification requirements to protect against unauthorised access to personal information. Where applicable, requests will be handled within the time and manner prescribed by law. 15. How to Exercise Your Rights If you wish to exercise an applicable privacy or data-protection right, raise a concern, request correction, or ask a question about the processing of your personal information, please contact Sobera Foundation through the contact details published on our official website: https://soberafoundation.org Please provide sufficient information to help us identify your request and verify your identity where reasonably necessary. We may request additional information where required to protect personal information from unauthorised disclosure or misuse. 16. Grievance Redressal If you have a concern or grievance regarding the processing of your personal information, you may contact Sobera Foundation through the designated privacy/contact channel published on our official website. We will review and address applicable grievances in accordance with our internal procedures and applicable law. Where applicable law provides a right to approach the Data Protection Board of India or another competent authority after following the prescribed grievance process, that right will remain available to the individual. The Foundation will not prevent or restrict any statutory right or remedy that cannot legally be excluded. 17. International or Cross-Border Processing Some third-party technology or service providers used by the Foundation may process personal information outside India. Where personal information is transferred, stored, or processed outside India, the Foundation will take such steps as may be required under applicable Indian law, including any applicable restrictions, safeguards, or government requirements relating to cross-border processing. 18. Third-Party Websites and External Services Our website may contain links to third-party websites, payment gateways, social-media platforms, applications, or other external services. Sobera Foundation does not control the privacy practices, security, content, or policies of such third parties. Users should review the privacy policies and terms of the relevant third-party services before providing personal information through them. Information submitted directly to a third-party service may be governed by that third party's privacy policy rather than this Privacy Policy. 19. Accuracy of Personal Information Users are requested to provide accurate, complete, and up-to-date personal information when submitting information to Sobera Foundation. If any information provided to us becomes inaccurate or outdated, you may request correction where applicable. The Foundation may rely on information provided by the individual unless there is a reasonable basis to believe that the information is inaccurate or incomplete. 20. Changes to This Privacy Policy Sobera Foundation may update or amend this Privacy Policy from time to time to reflect changes in: - Applicable laws or regulations; - Data-protection requirements; - Website functionality; - Technology; - Payment systems; - Third-party services; - Our charitable activities; or - Our privacy and data-handling practices. Any updated version will be published on the official website with the revised effective date. Where applicable law requires additional notice or consent for a material change, the Foundation will take the required steps. 21. Applicable Law This Privacy Policy shall be interpreted in accordance with the applicable laws of India. Nothing in this Privacy Policy is intended to exclude, restrict, or override any right, remedy, obligation, requirement, or protection that cannot lawfully be excluded or restricted under applicable law. If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions will continue to apply to the extent permitted by law. 22. Contact Us If you have any questions, concerns, requests, or grievances relating to this Privacy Policy or the processing of your personal information, please contact Sobera Foundation through the contact information published on our official website: https://soberafoundation.org Please include sufficient information in your communication to enable the Foundation to understand, verify, and appropriately respond to your request. --- Sobera Foundation Working with compassion, dignity, and responsibility for the welfare of people, animals, and communities. Privacy, dignity, and responsible handling of personal information are important to us.