Draft. This is a working draft. It describes what we actually do today, and it is being reviewed by a lawyer, so the wording may change.
1. What we hold, and why
We keep only what we need to do the work and to keep honest accounts.
- If you write to us through this website: your name, email address, phone number if you give one, organisation if you give one, the topic and your message. We use them to reply to you and to follow up on what you asked about.
- If you give money: what our bank statement shows about the payment - usually your name, and sometimes your phone number, UPI ID or a note you added. We need this to keep our accounts and meet tax and audit rules.
- If you volunteer: your name, contact details and when you can help.
- The people we give food to: we do not collect their names for this website. Where we record a distribution, we record the place, the date and how many people, meals or kits - numbers, not names.
- Visitors to this website: our server keeps a short technical log (IP address, the page asked for, the browser) to keep the site running and secure. We do not run analytics or advertising trackers.
2. What we publish about donors
We publish our bank ledger entry by entry, but never a private person's name. Each person who sends us money is shown by a numbered alias such as “Individual #3”. Phone numbers, UPI IDs, account numbers and the notes people add to payments are never published. Companies and banks are shown by name, because they are not private persons.
The bank statement files themselves are never published, because they contain all of the above.
3. Photographs and videos
We photograph our work so people can see it was done. Before a photo is published we remove its location data, and we do not name the people in it. We ask before photographing anyone up close, and we do not publish a photo that would let someone identify or find a child. If you appear in one of our photos and want it taken down, write to us and we will remove it.
Sometimes we film it too. A video is converted on our own server before it is published, and all of its metadata is removed, including where and when it was recorded. We may also remove its sound. The same rules apply as for photos: we do not publish a video in which someone can be identified without their permission, or one that would let someone identify or find a child. If you appear in one of our videos and want it taken down, write to us and we will remove it.
A photo or video we delete or unpublish stops being served by this website at once, and drops out of the caches that keep copies of it within minutes.
4. Who sees it
The members of the Foundation who answer messages and keep the accounts. Our bank, our auditor and government authorities, where the law requires it. Nobody else: we do not sell personal information, and we do not share contact lists with anyone, including other charities.
This website, and the messages sent through it, are stored on a server we rent in Singapore. If we have set up email delivery, a copy of your message is also sent to our email inbox.
5. How long we keep it
Messages sent through the website: for up to two years after our last contact with you, unless they are part of the record of a gift. Records of gifts: for as long as Indian tax and audit law requires. Server logs: a few weeks.
6. What you can ask us
You can ask what we hold about you, ask us to correct it, ask us to delete it where the law does not require us to keep it, and ask us not to contact you again. Write to [email protected], or by post to Dollu Foundation, Gohana Road, near R.K. Hindu School, Sonipat 131001, Haryana, India. We reply within thirty days. We aim to meet the requirements of India's Digital Personal Data Protection Act, 2023.
Asking us any of this never affects help you receive from us.