Privacy Policy

Who we are

Sneha Karma Foundation, Inc. is a California nonprofit public benefit corporation recognised as tax-exempt under section 501(c)(3) of the US Internal Revenue Code (EIN 47-3774368; California entity no. C3783680), with its office at 45039 Insight St, Unit 1006, Fremont, CA 94538-6664, USA. Our India operations are carried out by Sneha Karma Foundation, a Section 8 company incorporated in India (CIN U85300AS2022NPL022501; PAN ABHCS7601Q), with its corporate office at A2402 Oberoi Enigma, LBS Marg, Mulund (W), Mumbai 400080, Maharashtra, India.

In this Policy, “SKF”, “we”, “us” and “our” refer to the entity that processes your information. The US entity is the controller for US and international visitors and donors. The India entity is the data fiduciary for India-resident data principals.

Scope

This Policy covers snehakarma.org and the services we provide through it, including one-time and recurring donations, the donor portal, newsletters, volunteer, ambassador and fundraiser applications, partner, CSR and grant-maker inquiries, events, and our offline communications. It does not cover third-party websites we link to, or the separate safeguarding rules that protect the girls and families in our programs.

Summary

• We collect only the information we need to run our programs, process gifts, communicate with you and keep our services secure.
• We do not sell personal information, and we do not share it for third-party marketing.
• You can ask us to access, correct or delete your information, and to stop marketing.
• Analytics and marketing cookies are set only with consent where the law requires it.

Information we collect

What we collect depends on how you interact with us:

• Visitors — IP address, device and browser information, pages viewed, referring pages, and cookie identifiers.
• Donors — name, email, phone, address, country, gift amount, fund or program, tribute details, employer (for matching gifts), and receipt history. Card and bank details are handled by our payment processors; we do not store full card numbers.
• Recurring donors — subscription identifier, amount, frequency and status.
• Newsletter subscribers — name, email, subscription status and consent record.
• Volunteers and ambassadors — contact details, location, skills, availability, CV or portfolio, references, and screening results where lawful.
• Fundraisers — contact details, campaign content, and donations received through the campaign.
• Grant makers, CSR and corporate partners — organization, contact details, role, and due-diligence documents.
• Applicants — application, CV, contact details and interview notes.
• Event attendees — registration, attendance, and any accessibility or dietary needs you choose to share.
• Beneficiaries and guardians — program data, guardian consent and media consent, handled under our Safeguarding Policy.

How we collect information

We collect information when you complete a form, make a donation, create or use a donor-portal account (including by signing in with Google), subscribe to our newsletter, apply to volunteer or become an ambassador, create a fundraiser, register for an event, contact us, or interact with us offline. We also receive limited technical data automatically through cookies and server logs, and we may receive information from payment processors, partners who run matching-gift programs, and publicly available sources used for due diligence.

Why we use information and our lawful basis

We use personal data to process and acknowledge gifts, issue receipts, administer recurring gifts, provide the donor portal, send the newsletter you asked for, assess volunteer and ambassador applications, run fundraising pages, answer inquiries, carry out safeguarding and due diligence, prevent fraud, meet tax and accounting obligations, and improve our services.

Depending on the context, our lawful basis is performance of a contract (for donations, accounts and orders), consent (for marketing and non-essential cookies), legal obligation (tax, accounting, safeguarding and fraud records), or our legitimate interests (running and improving our charitable services, provided your rights are not overridden). Where we rely on consent, you can withdraw it at any time.

Visiting anonymously

You can browse the Site without identifying yourself. We obtain personally identifying information only when you choose to provide it — for example when you request information, contact us, subscribe, apply or make a donation. When you do, you provide the same kind of information you would give in person, by mail or by telephone. We maintain electronic and physical safeguards to protect it.

Online tracking and server logs

We and our service providers use cookies and similar technologies to track activity and transactions on an individual basis where you apply for or use a service online, and to protect against actual or potential fraud. We also gather information about visitors’ browsing to improve the Site and serve donors better.

Server log files. Your IP address is logged with other information about your activity. We use it to calculate usage levels, diagnose server problems and administer the Site. Collecting IP addresses is standard practice on the internet.

Types of cookies and analytics

Cookies may be “persistent” or “session” cookies. A persistent cookie remains valid until its expiry date unless you delete it; a session cookie expires when you close your browser. Persistent cookies can recognize a returning visitor or donor, which is useful if you have set a password and want the site to identify you.

Analytics cookies. We use Google Analytics to analyze use of the Site. Our analytics provider generates statistical information about website use through cookies, and we use it only to create reports about how the Site is used. Google’s privacy policy is at policies.google.com/privacy.

Refusing cookies

You may choose not to accept cookies. Your browser can alert you and let you refuse a cookie when it is offered, and newer browsers let you refuse cookies automatically. If cookies are a concern, check that your browser has this capability and set it to alert you. Some features and services require a cookie to work — for example, to establish a link between you and the application server. Those cookies contain only a unique session ID and no other data. You can also browse anonymously by disabling or deleting cookies, or by using a private window, though blocking cookies may affect usability. See our Cookie Policy for details.

Cookies and analytics

We use cookies and similar technologies for essential site functions, preferences, analytics and advertising measurement. Our analytics and marketing tools include Google Analytics 4 and Google Ads; we also use Cloudflare Turnstile for bot protection, and our payment and portal providers set their own cookies during checkout and sign-in. Analytics and marketing cookies are set only with consent where the law requires it. For the full list and how to change your choice, see our Cookie Policy.

How we protect donor information

We take a number of steps to protect donor information. When donors provide bank account, credit or debit card numbers together with a security code, access code or password that could permit access to a financial account, those details are not stored on our servers and are not accessible to our employees or contractors. They are passed to our banking and payment partners directly, encrypted and protected using Secure Socket Layer (SSL) or equivalent technology.

Profile information — such as a first name or initial and last name combined with other data elements — is disclosed only to employees and organizations with restricted access who need it to operate, develop or improve our services. Those individuals are bound by confidentiality obligations and may face discipline, including termination and criminal prosecution, if they fail to meet them. We do not sell, share or trade donors’ names or personal information with any other entity, and we do not send mailings to donors on behalf of other organizations. This applies to information received online and offline, on any platform (including our website and any mobile applications), and in electronic, written or oral communications.

Where donations are processed by a third party, donor information is used only for the purposes necessary to process the donation. When we provide business partners with donor information to fulfill requests, we require them to process it on our instructions with appropriate confidentiality and security. We may disclose information where required by law. We keep information under physical, electronic and procedural controls that comply with applicable federal and Indian standards, and we review our data collection, storage and processing practices and security measures, including physical security measures.

Examples of when we may share

We may share information about you as required or permitted by law, for legal and routine business reasons. For example, we may share information with regulators and law enforcement officials; to protect you, Sneha Karma Foundation and others against fraud; with your consent; and with payment processors to the extent necessary to process a donation. We do not share personal information for third-party marketing.

Email communications

If you send us an email or provide your email address on the Site, we may retain the content, your address and our response to serve your needs. If you agree to receive email offers or messages, we may use the data you provide to send offers that may interest you. If you unsubscribe, you will stop receiving those messages. Some services or online programs require a valid email address to register or continue, and you will receive service alerts or notifications unless you un-enrol from those services. We do not ask for or collect bank account, card, security code, access code or password details by email, text or telephone.

Email opt-out or unsubscribe

If you no longer wish to receive email offers or solicitations, unsubscribe using the link in the email you received, or contact [email protected]. Instructions are usually at the bottom of our emails. If you opt out of solicitations, we reserve the right to contact you to service and maintain your profile — for example to notify you about fraudulent activity, respond to an inquiry, or alert you to website changes or outages. If you change your privacy choices, you may still receive communications when you contact us, or offers connected with maintaining and servicing your account.

Sharing and processors

We do not sell personal information and we do not share it with third parties for their own marketing. We share information with service providers who process it on our instructions, including Stripe and PayPal (card and PayPal donations), Razorpay and UPI (India donations), Cloudflare (security and delivery), Google (analytics, advertising, maps and portal sign-in), our email service provider, and our e-signature provider. We require these providers to protect the information and to use it only for the purposes we specify.

We may also disclose information where required by law, to regulators and law enforcement, to protect you or others from fraud or harm, to enforce our terms, or with your consent.

International transfers

We operate in the United States and India, and our service providers may process information in other countries. Where we transfer personal data from the EU or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum. Where we transfer data out of India, we do so in accordance with the Digital Personal Data Protection Act 2023 and applicable rules. You can ask us for more information about the safeguards we use.

Links to third-party sites

We are not responsible for the information practices of sites linked to or from the Site. Links to non-SKF websites are usually provided as pointers to information that may be useful. Because third-party sites may have different privacy policies and security standards, review their policies and terms before providing personal information.

Updates to this Privacy Policy

We review this Privacy Policy at least annually or as required. The current version is always available on this page. We will post any changes here with a new revision date, and where changes are material we will notify you as required by law.

Alerting us to your privacy choices

You may contact us to update your privacy choices, including telling us not to contact you. Email [email protected] or use the unsubscribe route described above. Please allow up to four to six weeks for a request to take effect, though we aim to act sooner.

How long we keep information

We keep information only as long as we need it for the purpose we collected it, or as the law requires:

• Donation and receipt records — 8 years.
• Volunteer and ambassador records — 3 years after your last activity.
• Job and role applicants — 12 months.
• Contact and form submissions — 2 years.
• Analytics — 14 months.
• Newsletter — until you unsubscribe, plus a suppression record so we do not contact you again by mistake.

We may keep limited records longer where we are legally required to, or to establish, exercise or defend legal claims.

Security and breaches

We use physical, technical and organizational safeguards, including access controls, encryption in transit, and payment processing through PCI-compliant providers. No method of transmission or storage is completely secure, but we review our controls and limit access to those who need it. If we become aware of a personal-data breach that requires notification, we will notify the relevant regulator and affected individuals without undue delay and within the time required by law.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your information, to receive a portable copy, to withdraw consent, and to complain to a regulator.

• EU/UK (GDPR) — you may also lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA) — you may request to know, delete or correct personal information, opt out of “sale” or “sharing” (we do neither), limit the use of sensitive personal information, and exercise your rights without discrimination. We honour Global Privacy Control signals.
• India (DPDP Act 2023) — as a Data Principal you may access, correct, erase and nominate, and you may raise a grievance with us before approaching the Data Protection Board of India.

To exercise a right, email [email protected]. We may need to verify your identity. We respond within 30 days (GDPR and DPDP) or 45 days (CCPA), unless a longer period is permitted. Authorised agents may act on your behalf with proof of authority.

Children and minors

Our website is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the site, consistent with the US Children’s Online Privacy Protection Act. Under India’s DPDP Act 2023, a child is a person under 18; where we process a child’s data for our programs, we obtain verifiable consent from a parent or guardian and do not use it for behavioral monitoring or targeted advertising. Media involving beneficiaries is governed by our Safeguarding, Minors & Media Consent policy. Guardians can contact us to review or withdraw consent.

Marketing, changes and contact

We send marketing email only where we have a lawful basis to do so, and every marketing email includes an unsubscribe link. If you unsubscribe, we will stop marketing messages but may still contact you about a donation, an account, a transaction or a legal matter. We review this Policy at least annually and will post any changes on this page with a new revision date. Material changes will be notified where required.

Privacy contact and Data Protection Officer: [email protected]. India Grievance Officer: [email protected]. You can also write to us at the addresses in the “Who we are” section.