Privacy Policy

Effective date: 8 July 2026  ·  Alorah Foundation, registered charitable trust (Reg No. 4/82/2026)

Alorah Foundation (“the Trust”, “we”, “us”) respects your privacy. This policy explains what personal information we collect on alorah.org, why we collect it, and how we protect it. It is published in accordance with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023.

1. Information we collect

• Donor details submitted through the donation form or given to us directly: name, donor type (individual / company / trust), PAN, Aadhaar (optional), GSTIN / TAN / CIN (optional, for organisations), mobile number, email address, postal address, and the amount, date, purpose, payment mode, and transaction reference of your donation.
• Beneficiary details collected offline in the course of our charitable work: name, contact details, village/area, and the benefit provided.
• Technical data: our server logs record IP addresses for security and rate-limiting. We do not use analytics trackers or advertising cookies on the public website.

2. Why we collect it

• To verify your donation against our bank records and issue your 80G donation receipt.
• To meet statutory obligations of the Income-tax Act, 1961, in particular the annual Form 10BD statement of donations and Form 10BE donor certificates, which require donor name, PAN/Aadhaar, and address.
• To contact you about your donation or receipt.
• To maintain honest, auditable records of the Trust’s work.

We collect only what these purposes require, and we do not sell, rent, or trade personal information to anyone.

3. Publication in masked form

As part of our transparency commitment, donor and beneficiary lists may be shown on the Website in masked form only (for example “R****h K.”), never with full names, and never with identity numbers, contact details, or addresses. Donors and beneficiaries can ask to be excluded from public lists entirely at any time.

4. Payments

Bank transfers and UPI payments are made directly to the Trust’s bank account. When card / net-banking checkout is offered, payment is processed by an RBI-regulated payment gateway (such as Razorpay); your card or banking credentials are handled by the gateway under its own security standards (PCI-DSS) and are never stored on our servers. We receive only the payment confirmation and reference needed to issue your receipt.

5. Storage, security, and retention

• Donor records are stored in a secured database on our own server, accessible only to authorised trustees through a password-protected admin system over HTTPS.
• We retain donation records for as long as the Income-tax Act and other applicable laws require (generally at least eight years), after which they may be securely deleted.
• We share personal information only with government and tax authorities as required by law, and with no one else.

6. Your rights under the DPDP Act, 2023

The Trust is a Data Fiduciary under the Digital Personal Data Protection Act, 2023. Section 7 of the Terms & Conditions sets this out in full, and these are the rights it gives you.

• Ask for a copy of the personal data we hold about you, and a summary of how it has been used.
• Ask us to correct or complete anything that is wrong or out of date.
• Ask us to erase it, and withdraw your consent at any time, as easily as you gave it.
• Nominate somebody to exercise these rights on your behalf if you die or become unable to.
• Ask to be excluded from the masked public donor list, and to opt out of any communication from us.
• Write to alorahfoundation@gmail.com or telephone the number below; we answer within 15 days.

What withdrawal does and does not do. We stop using your data for that purpose and erase what we hold, except where a law requires us to keep it: 80G receipts, Form 10BD returns, donation records and the audit trail are kept for the periods the Income Tax Act and our audit obligations require. We say this here rather than promising an erasure we cannot lawfully perform.

Consent is never a price. Permission to publish a beneficiary's name, photograph or story is asked for separately, only after a decision on their application, and refusing it changes nothing about the help they receive.

If a concern is not resolved to your satisfaction by the Managing Trustee, you may complain to the Data Protection Board of India.

7. Cookies

The public website does not set tracking or advertising cookies. The admin area used by trustees stores a short-lived login token in the browser session only.

8. Children

The Website is not directed at children, and we do not knowingly collect personal information from children online. Beneficiary records concerning children are collected from parents or guardians in the course of charitable work.

9. Grievance officer and changes

For any privacy concern or grievance, contact the Managing Trustee using the details below; grievances are acknowledged within 48 hours and resolved within 15 days. We may update this policy from time to time; the version on this page, with its effective date, is the version in force.