Privacy Policy

This Privacy Policy describes how The Nivaar Project ("we", "us", or "our"), operating from F12, Sector 8, Noida — 201301, Uttar Pradesh, India, collects, uses, stores, and protects personal data provided to us through our website, donation forms, recipient applications, and volunteer portal.

This Policy is framed in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and rules thereunder. By using our website or services, you agree to the terms of this Policy.

1. Data We Collect

We collect the following categories of personal data depending on how you interact with us:

Category	Data Collected	Source
Donors	Full name, email address, phone number (optional), city, donor type, garment details, preferred drop-off date	Donor Registration Form
Recipients	Full name, email, phone, age group, gender, city, clothing sizes, purpose of request, referral source	Recipient Application Form
Volunteers	Full name, email, phone, assigned role, hours logged	Volunteer Portal Registration
General Contact	Name, email, message content, reason for contact	Contact Form on Website
Technical Data	No cookies beyond strictly essential session preferences (dark mode toggle) are set. No IP addresses, browser fingerprints, or tracking data are collected.	Browser session

We do not collect sensitive personal data as defined under the DPDP Act (such as health data, caste, religious belief, or financial data) unless voluntarily shared in free-text fields, in which case it is treated with the highest confidentiality.

2. Purpose of Processing

Your personal data is processed only for the following specified, lawful purposes:

• Donors: To process and acknowledge your donation, coordinate drop-off logistics, and maintain internal donation records.
• Recipients: To review and fulfill clothing requests, coordinate collection appointments, and maintain internal service records.
• Volunteers: To manage volunteer registrations, assign roles, and maintain activity records.
• Contact Enquiries: To respond to your message and assist with your query.
• Operational: To maintain internal statistics (e.g., garments distributed) for programme evaluation. This is done using aggregated, non-identifiable data.

We will not process your personal data for any purpose other than those described above without obtaining fresh, specific consent from you.

3. Legal Basis for Processing

Under the DPDP Act, 2023, our legal basis for processing your personal data is:

• Consent (Section 6, DPDP Act): All forms on our website require your explicit, informed, and affirmative consent before we process your data. Consent is obtained through clearly worded checkboxes. Consent is not bundled or obtained by default.
• Legitimate Use: Processing necessary to fulfil a service you have requested (e.g., processing a donation or clothing request).

Consent may be withdrawn at any time by writing to hello@nivaartproject.org. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

4. Data Retention

Data Category	Retention Period
Donor records	24 months from the date of donation, then permanently deleted
Recipient records	12 months from the date the request is fulfilled, then permanently deleted
Volunteer records	Duration of active volunteering + 12 months, then permanently deleted
Contact form submissions	6 months from submission, then permanently deleted

After the applicable retention period, your personal data is permanently and irreversibly deleted from all our systems.

5. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights:

Right	Description	How to Exercise
Right to Access (Sec. 11)	Request a summary of personal data we hold about you and the purposes for which it is processed.	Email us at hello@nivaartproject.org
Right to Correction (Sec. 12)	Request correction of inaccurate or outdated personal data.	Email us
Right to Erasure (Sec. 12)	Request deletion of your personal data, subject to any legal obligation to retain it.	Email us
Right to Grievance Redressal (Sec. 13)	Lodge a complaint with our Data Protection Officer if you believe your rights have been violated.	Email hello@nivaartproject.org. We respond within 7 working days.
Right to Withdraw Consent (Sec. 6)	Withdraw consent for any data processing at any time, without affecting prior lawful processing.	Email us
Right to Nominate (Sec. 14)	Nominate another individual to exercise your rights in the event of your death or incapacity.	Email us with written nomination

We will respond to all data rights requests within 7 working days. Where a request cannot be fulfilled within this period, we will inform you of the timeline and reasons.

6. Data Sharing and Disclosure

We do not share your personal data with any third party for commercial, marketing, or any other purpose, except in the following limited circumstances:

• Legal Obligation: Where we are required by applicable law, court order, or government authority to disclose personal data.
• Referral Partners (Recipients only): If you were referred by an NGO or institution, we may confirm your application status with that organisation, but only if you have consented to this in your application.

We do not use any third-party analytics, advertising, or tracking services on our website. We do not use cloud CRM platforms, email marketing services, or data brokers that would process your data outside our direct control.

7. Data Security

We adopt appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. These include:

• Access to donor, recipient, and volunteer records is limited to authorised volunteers only via the password-protected Volunteer Portal.
• Forms are transmitted over HTTPS-encrypted connections.
• Data is not stored in unsecured formats, shared drives, or public-facing systems.
• Access credentials are reviewed and rotated periodically.

In the event of a personal data breach that is likely to result in harm to you, we will notify you as required under applicable law.

8. Cookies

Our website uses only one browser storage mechanism: a localStorage key to remember your dark/light mode preference. This is not a tracking cookie and does not collect any personal data.

We do not use Google Analytics, Facebook Pixel, or any other behavioural or advertising tracking technology.

9. Children's Data

Our services are directed at individuals aged 18 and above. We do not knowingly collect personal data from persons under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at hello@nivaartproject.org and we will delete such data promptly.

10. Grievance Officer (Data Protection Officer)

In accordance with Section 13 of the DPDP Act, 2023, our designated Grievance Officer / Data Protection Officer is:

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India once established under the DPDP Act.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or the services we offer. Any material changes will be communicated to registered donors, recipients, and volunteers by email. Continued use of our website after the effective date of any update constitutes acceptance of the revised Policy.

The latest version of this Policy is always available at nivaartproject.org/privacy.html.

12. Governing Law

This Privacy Policy and any disputes arising therefrom shall be governed by the laws of India, including the Digital Personal Data Protection Act, 2023, and shall be subject to the exclusive jurisdiction of the courts at Noida / Gautam Buddh Nagar, Uttar Pradesh.