Privacy Policy

Last Updated: Nov 01, 2026
Karmastic Foundation (“Karmastic Foundation,” “we,” “us,” or “our”) is an Indian not-for-profit company incorporated under Section 8 of the Companies Act, 2013, with Corporate Identity Number U86909HR2023NPL110975, registered in Haryana on 22 April 2023. Our registered office is H 022 DLF Primus, Sector-82A, Narsinghpur, Gurgaon, Narsinghpur, Haryana 122004, India. Our mission is to empower underprivileged children and communities to break the cycle of poverty and achieve their potential.
We are committed to protecting your privacy and safeguarding your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information in connection with our website https://karmastic.org/ (the “Website”), our charitable programmes, fundraising, community engagement and related communications.
Please read this Privacy Policy carefully. This Privacy Policy should be read in conjunction with our Terms and Conditions [https://karmastic.org/terms/].
This Privacy Policy shall be construed to be provided in compliance with the laws of the Republic of India (“India”) including the Information Technology Act 2000 (“IT Act”) and The Digital Personal Data Protection Act 2023 (“DPDP Act”), and applicable rules framed thereunder, as amended from time to time.
1. Who and what this policy covers
This Policy applies, as relevant, to Website visitors and commenters; donors and prospective donors; people who enquire about sponsorship or CSR support; volunteers, applicants and community partners; individuals who communicate with us; and beneficiaries of charitable initiatives, including children and their parents or guardians. It also describes the personal data we may handle through activities conducted offline that are subsequently recorded in digital systems.
2. Information we collect
2.1 Information You Provide to Us
We collect only the information we need for a specific purpose described in this Privacy Policy. Depending on how you interact with us, the information you voluntarily provide may include:
• Donors and sponsors: your full name, email address, phone number, postal address, donation amount, date and mode of payment, transaction reference, your preference to be recognised or to remain anonymous, and, where you ask for a tax receipt, your PAN or other details the law requires for that receipt.
• Education sponsors: in addition to the above, your sponsorship preferences and how you wish to receive updates on the programme you support.
• Volunteers and event participants: your name, contact details, city, availability, skills and interests, emergency contact details, any accessibility or dietary requirements you choose to share, attendance records, and photographs or videos taken at events.
• People who contact us: your name, email address, phone number, the content of your message, and our correspondence with you. Emails sent to us are routed through, and stored in, our email systems.
• Blog commenters: your name, email address (not published), website address (optional), your comment, and your IP address. Your name and comment are displayed publicly.
• Partners, institutions and suppliers: business contact details of representatives of partner organisations, schools, relief organisations, vendors and service providers, and records of our collaboration.
• Proof of donation: where we invite you to share a screenshot or other proof of a donation (for example, to a campaign or fundraiser), we use it only to verify and acknowledge your contribution. Please hide any information that is not needed for that purpose, such as full account numbers.
Information about children and persons with disabilities who benefit from our Activities is dealt with separately in Section 6.
2.2 Payment Information
Donations may be made by bank transfer to the account published on our Website, by UPI or other digital payment methods, or through a third-party payment gateway. Your payment is processed by your bank or payment service provider. We do not collect or store CVV codes, UPI PINs, OTPs or net-banking credentials. When you make a donation , we collect payment information including payer’s name, amount, date, transaction or reference number, the UPI ID or account reference shown on our bank statement, and any contact details you give us.
2.3 Information Collected Automatically
When you visit our Website, we automatically collect certain technical and usage information through cookies and similar tracking technologies, including your IP address, browser type and version, operating system, device type (mobile, tablet, desktop), pages visited and time spent on pages, clickstream data, referring and exit pages, date and time of visits and search queries entered on the Website.
2.4 Cookies and Tracking Technologies
We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your browsing activities and to enhance your experience on our Website. Cookies are small text files stored on your device that help us recognize your browser, remember your preferences, analyze Website traffic and usage patterns, and deliver relevant content. You can manage cookie preferences through your browser settings, though disabling certain cookies may affect Website functionality. For more information about the types of cookies we use and how to manage them, please refer to Section 12 of this Privacy Policy.
2.5 Information from Third-Party Sources
We may receive information about you from: (a) our bank and payment service providers, who confirm donations made to us; (b) partner schools, institutions and relief organisations, who may share limited information needed to deliver an Activity (in which case we expect them to have obtained any consent the law requires); (c) analytics providers, who give us aggregated usage insights; (d) social media platforms, if you contact us or interact with our pages on them; and (e) publicly available sources, such as the Ministry of Corporate Affairs or NGO Darpan portals, when we carry out due diligence on partners.
2.6 Information We Do Not Seek
We do not ask for, and do not need, your biometric data, caste, religion or political affiliation. Please do not send them to us. If we learn that we have received such information without a lawful need for it, we will delete it.
3. Representations
1 You represent that the Personal Information you provide is correct, current and up to date and that you have all the rights, permissions and consents to provide such information or data. Your providing the information and our consequent storage, collection, usage, transfer, access or processing of the same shall not be in violation of any third-party agreement, laws, judgments, orders or decrees.
2 If you give us personal information about another person (for example, a family member as an emergency contact, a person in whose name you are making a donation, or a colleague at a partner organisation), you must have that person’s authority to do so and should make them aware of this Privacy Policy, including who we are, why we collect the information, how to contact us, their rights, and how to complain. You must not give us personal information about a child or a person with a disability unless you are that person’s parent or lawful guardian.
4. How we use your information
We use personal information only for the purposes below, all of which relate to our Mission and our legal obligations. We rely on your consent (Section 6 of the DPDP Act) or, where applicable, on the “certain legitimate uses” recognised by Section 7 of the DPDP Act.
4.1 Receiving, Recording and Acknowledging Donations
To receive and reconcile contributions, issue acknowledgements and receipts, verify proof of donation, prevent fraud and misuse, and maintain the books of account and records that we are legally required to keep.
4.2 Delivering Programmes and Relief Drives
To plan and carry out our Activities such as procuring and distributing blankets, food, beds and other relief material, supporting children’s education, and running community initiatives. This includes coordinating with partner schools, institutions and relief organisations, and giving sponsors and donors updates on how their contribution was used.
4.3 Volunteers and Events
To organise, staff and run volunteer activities and events, contact participants about logistics, ensure safety (including reaching an emergency contact), accommodate accessibility needs you tell us about, and record attendance.
4.4 Communications
We use your information to send you service communications by email, SMS, WhatsApp or phone, such as acknowledgements, receipts, event details and important updates about an Activity you have supported. With your consent only, we also send newsletters, impact reports and appeals about new campaigns. You can withdraw that consent or unsubscribe at any time by using the unsubscribe link, replying to the message, or writing to us at karmastic.foundation@gmail.com. Withdrawing consent to updates and appeals will not stop essential communications such as receipts or notices we are legally required to send. We do not send promotional messages on behalf of third parties.
4.5 Transparency, Accountability and Impact Reporting
In keeping with our value of Accountability, we report on our work through our Website, blog and reports. We usually publish only aggregated figures (for example, total contributions or items distributed). We publish the name or photograph of a donor, sponsor, volunteer or beneficiary, or tell an individual’s story, only with the consent of that person (or, for a child or a person with a disability, the parent or lawful guardian), and we honour requests to remain anonymous.
4.6 Website Improvement and Personalization
We use your information to understand how visitors use the Website, keep it working and secure, improve its content and usability, and identify and prevent abuse such as spam comments or unauthorised access.
4.7 Legal and Compliance Purposes
We use your information to comply with our obligations as a Section 8 company and as a charitable organisation, including filings with the Registrar of Companies, tax authorities and other regulators, statutory audit, and responding to lawful requests from authorities; to enforce our Terms and Conditions [https://karmastic.org/terms/] and other policies; to protect our rights, property and safety and those of our donors, volunteers, beneficiaries and partners; and to establish, exercise or defend legal claims.
5. How we share your information
We do not sell, rent, or trade your personal information. We share it only with the following categories of recipients, and only to the extent needed for the purposes in Section 4.
5.1 Partner Organisations and Institutions
We deliver some Activities together with other charitable organisations, schools and institutions. We share with them only the information needed for that purpose (for example, details of a donation earmarked for their campaign, or the logistics details of a distribution). We share a donor’s or sponsor’s identity with a partner only if that is necessary for the purpose you gave it for or you have consented. Partners are independent organisations and are responsible for their own handling of information once they receive it; we ask them to treat it in line with applicable law.
5.2 Banks and Payment Service Providers
We use third-party payment processors to process payments securely. Banks, UPI and payment service providers and payment gateways process donations and may collect and process your payment details directly in accordance with their own privacy policies and security standards.
5.3 Professional Advisers and Auditors
Statutory auditors, chartered accountants, company secretaries and legal advisers, who need access to financial and donation records for audit, tax, regulatory filings and legal advice, and who are bound by professional duties of confidentiality.
5.4 Technology and Service Providers
We share information with third-party service providers who perform services on our behalf, including website hosting and cloud storage providers, analytics services to analyze Website usage and performance, email and communication services to send transactional and marketing communications, user support tools to manage inquiries, marketing and advertising platforms for online advertising, and security and fraud prevention services to detect and prevent fraudulent transactions. These service providers are contractually obligated to use your information only for the purposes of providing services to us and to protect your information in accordance with this Privacy Policy.
5.5 Restructuring or Transfer of Activities
In the event Karmastic Foundation merges with, or transfers all or part of its undertaking to, another charitable organisation or is wound up, personal information relating to the affected Activities may be transferred to the successor, which must use it only for purposes consistent with this Privacy Policy. We will notify you of any such change in ownership or control of your personal information.
5.6 Legal and Regulatory Authorities
We may disclose your personal information to government authorities, law enforcement agencies, regulators (including the Registrar of Companies and tax authorities), the Data Protection Board of India, courts, or other third parties when we believe in good faith that disclosure is required by applicable law, regulation, legal process, or governmental request, necessary to enforce our Terms and Conditions [https://karmastic.org/terms/] or other agreements, necessary to protect our rights, property, safety, or the rights, property, or safety of others, or necessary to detect, prevent, or investigate fraud, security issues, or illegal activities.
5.7 With Your Consent
We may share your information with other third parties when you have given us explicit consent to do so.
5.8 Aggregated and Anonymized Information
We may share aggregated, de-identified, or anonymized information that cannot reasonably be used to identify you with third parties or the public for research, analytics or reporting purposes. Such information does not constitute personal information and is not subject to the restrictions in this Privacy Policy.
6. Children, persons with disabilities and beneficiaries
Children are at the heart of our Mission, so we apply particular care to their information. In this Privacy Policy, a “child” is any person under 18 years of age.
6.1 Our Website, Donors and Volunteers
Our Website and online services are intended for adults. Donations, sponsorships, blog comments and volunteer registrations must be made by persons who are at least 18 years of age. Young people under 18 may take part in supervised events only together with a parent or guardian, and we collect their information only through that parent or guardian.
6.2 Children Who Benefit from Our Activities
For some Activities, such as education sponsorship or school-based events, we may handle limited information about child beneficiaries, such as first name, age or class, school, general circumstances, progress updates and photographs. We usually receive it through the child’s parent or lawful guardian or through a partner school or institution. We process a child’s personal information only with the verifiable consent of the child’s parent or lawful guardian, as required by Section 9 of the DPDP Act and the DPDP Rules, unless the Act or Rules permit processing without it. In addition, we will not:
• track or behaviourally monitor children, or direct targeted advertising at them; or
• process a child’s personal information in any manner likely to cause a detrimental effect on the child’s well-being.
6.3 Photographs, Videos and Stories
We take and publish photographs, videos and stories of children only with the consent of the parent or lawful guardian (which may be obtained through the partner school or institution that has the direct relationship with the family, if it confirms it has done so). Wherever possible we avoid publishing a child’s full name, home address, school name or other details that could identify or locate the child, and we depict every child with dignity. A parent or guardian may withdraw this consent at any time and we will stop further use and remove the material from our Website and social media accounts within a reasonable time, although we cannot recall material already printed or distributed.
6.4 Persons with Disabilities
Some of our Activities involve persons with disabilities, including students of special schools. Where a person with a disability has a lawful guardian, we obtain verifiable consent from that guardian before processing the person’s personal information. We handle any information about a person’s disability or health only where it is needed to support them or to make an event accessible.
6.5 Parents and Guardians
If you are a parent or guardian and believe that your child or ward has given us personal information without your consent, or you wish to review, correct or delete it, please contact us immediately at karmastic.foundation@gmail.com . If we become aware that we hold a child’s personal information without the required consent, we will delete it as soon as possible.
7. Data security
We implement reasonable technical, physical, and administrative security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. These measures include encryption of data in transit using SSL/TLS technology, secure authentication and access controls, regular security assessments and monitoring, employee training on data protection and confidentiality, and firewalls and intrusion detection systems.
All payment transactions are processed through secure, industry-standard compliant payment gateways. We do not store card numbers, CVV codes or UPI PINs. Karmastic Foundation will never ask you for your card PIN, CVV, OTP or UPI PIN. Please make donations only to the bank account or payment details published on our official Website, and tell us at karmastic.foundation@gmail.com if you receive a suspicious request that claims to come from us.
While we strive to protect your personal information, please be aware that no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials and for any activities that occur under your account. To protect your account, choose a strong, unique password, do not share your password with others, log out after using shared or public computers, and notify us immediately if you suspect unauthorized access to your account at karmastic.foundation@gmail.com .
If a personal data breach affects your personal information, we will inform you without delay, explaining in plain language what happened, its likely consequences, what we have done and what you can do to protect yourself, and who to contact. We will also report the breach to the Data Protection Board of India and to any other authority (such as CERT-In) as required by law.
8. Data retention
We retain personal information only for as long as needed for the purpose for which it was collected, or for as long as the law requires or permits, and then erase it or anonymise it. Our standard retention periods are:
Category of information
Retention period
Donation and transaction records (donor name, amount, reference, PAN or receipt details where applicable)
At least eight years, as required for books of account under the Companies Act, 2013, or longer if required by tax or other law
Volunteer and event participant records
For the duration of your involvement and three years afterwards. Event-specific details such as emergency contacts and accessibility or dietary needs are kept only for the event and up to six months afterwards unless needed to deal with an incident
Information relating to child beneficiaries and sponsorship
For the duration of the programme and up to three years afterwards for audit and impact reporting, or earlier erasure on a parent’s or guardian’s request, subject to any legal requirement to retain
Enquiries and correspondence
Three years from our last communication, for quality assurance and dispute resolution
Blog comments and commenter details
Until you ask us to remove your comment or we moderate it out
Subscriptions to updates and appeals
Until you withdraw consent or unsubscribe
Photographs and videos
For as long as consent remains in place; removed from active publications within a reasonable time if consent is withdrawn
Website usage, analytics and server log data
Twelve to twenty-four months
We decide retention periods based on the nature and sensitivity of the information, the purposes for which we process it, legal, regulatory, tax and accounting requirements, the need to resolve disputes and enforce agreements, and good practice. When the applicable period ends, or earlier where you withdraw consent or ask us to erase your information and no legal reason to keep it remains, we will securely delete it or anonymise it so that it can no longer identify you, and we will ask our Data Processors to do the same.
9. Your rights and choices
As per the applicable data protection laws you may have certain rights regarding your personal information.
9.1 Right to Access
You may ask us for a summary of the personal information we process about you and the processing activities we undertake, the identities of the other Data Fiduciaries and Data Processors with whom we have shared it together with a description of what was shared, and any other related information prescribed by law. To exercise this right, contact us at karmastic.foundation@gmail.com.
9.2 Right to Correction, Completion and Updating
You may ask us to correct inaccurate or misleading personal information, complete incomplete information, and update information that has changed.
9.3 Right to Erasure
You may ask us to erase your personal information. Please note that we may retain certain information where required by law, such as to complete transactions, maintain records for tax and accounting purposes, resolve disputes, or enforce our agreements.
9.4 Right to Withdraw Consent
Where we process your personal information on the basis of your consent, you may withdraw that consent at any time, and withdrawing will be as easy as giving it. You bear the consequences of withdrawal (for example, we may no longer be able to send you updates). Withdrawal does not affect the lawfulness of processing done before it. After you withdraw, we will stop processing your information for the relevant purpose, and cause our Data Processors to do so, unless the law requires or permits us to continue.
9.5 Right to Grievance Redressal
If you have a concern about how we handle your personal information or about the exercise of your rights, you may raise it with our team using the details in Section 14. We will acknowledge your grievance promptly and respond within the period prescribed by law, which will not exceed thirty days, and we aim to respond sooner.
9.6 Right to Nominate
You may nominate another individual who will exercise your rights under the DPDP Act on your behalf if you die or become incapacitated.
9.7 Right to Approach the Data Protection Board of India
If you are not satisfied with our response to your grievance, you may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act and DPDP Rules. The Act expects you to first use our grievance redressal process.
9.8 How to Exercise Your Rights
To exercise any of the above rights, please contact us at karmastic.foundation@gmail.com with the subject line “Data Privacy Request” and include your full name, email address, and specific request. We will respond to your request within thirty days or as required by applicable law. We may require additional information to verify your identity before processing your request to ensure the security of your personal information. If you are a parent or guardian, you may exercise these rights on behalf of your child or ward.
9.9 Your Duties
The DPDP Act also places duties on Data Principals. You must comply with applicable law when exercising your rights; must not impersonate another person or suppress material information when providing us with personal information for any document or proof of identity; must not make false or frivolous grievances or complaints; and must provide only verifiably authentic information when asking for correction or erasure. Breach of these duties can attract a penalty under the Act.
9.10 Communications Opt-Out
You can opt out of receiving updates and appeals from us at any time by clicking the “unsubscribe” link in marketing emails or contacting us at karmastic.foundation@gmail.com. Please note that even if you opt out of marketing communications, we will still send you essential communications such as receipts.
10. Third-party websites and links
Our Website may contain links to third-party websites, services, payment gateways, or social media platforms that are not owned or controlled by Karmastic Foundation. We are not responsible for the privacy practices, content, or security of third-party websites. This Privacy Policy does not apply to third-party websites, and we encourage you to review the privacy policies of any third-party websites you visit before providing any personal information.
Our Website may also embed third-party content or features, such as social media share buttons, embedded videos or feeds. These can collect your IP address, record which pages you visit, and set cookies, and are governed by the privacy policies of the respective providers.
11. International data transfers
Your personal information is primarily stored and processed within the Republic of India. However, some of our third-party service providers may be located in other countries, which may result in your personal information being transferred to, stored in, or processed in jurisdictions outside India.
We transfer personal information outside India only as the DPDP Act permits, that is, not to any country or territory that the Central Government has restricted by notification, and subject to any stricter requirements of Indian law that apply. Where we do so, we use contractual and technical safeguards to ensure that the information continues to be protected in line with this Privacy Policy.
12. Cookies and tracking technologies
12.1 What Are Cookies
Cookies are small text files that are stored on your device when you visit a website. Cookies help websites recognize your device and remember information about your visit, such as your preferences.
12.2 Types of Cookies We Use
We use different types of cookies on our Website for various purposes.
Essential cookies are required for the Website to function properly and enable core functionality such as security, authentication, and session management. These cookies cannot be disabled without significantly affecting Website functionality.
Performance and analytics cookies collect information about how visitors use the Website, including which pages are visited most often, how users navigate the Website, and any error messages encountered. This information helps us understand user behavior and improve Website performance and user experience.
Functionality cookies remember your preferences and settings to provide personalized features and content, such as language preferences, display settings, and saved search queries.
Embedded-content cookies may be set by third-party content on our pages, such as social media features or videos.
Marketing and advertising cookies track your browsing activity across websites to display targeted advertisements based on your interests and browsing history. These cookies may be set by us or by third-party advertising networks and are used to deliver relevant ads and measure advertising campaign effectiveness.
12.3 Third-Party Cookies
Some cookies on our Website are placed by third-party service providers, including analytics providers, advertising networks, payment processors, and social media platforms. These third parties may collect information about your online activities over time and across different websites. We do not control third-party cookies, and you should refer to the respective third party’s privacy policy for information about their data practices.
13. Changes to this privacy policy
We may update this Privacy Policy from time to time to reflect changes in our Activities, technology or legal requirements. When we make material changes, we will update the “Last Updated” date at the top and shall post a notice on the Website or email you where we hold your email address. Where a change affects the purposes for which we use your information and the law requires fresh consent, we will seek it before applying the change to you. If you do not agree with the revised Privacy Policy, you may stop using the Website and may withdraw any consent you have given. We encourage you to review this Privacy Policy periodically.
14. Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Karmastic Foundation
Privacy Inquiries: Email: karmastic.foundation@gmail.com Phone: +91 8901 997799
Mailing Address: Sector-82A, Narsinghpur, Gurgaon, Haryana – 122004, India
Website: https://karmastic.org/
We will acknowledge your message promptly and respond within the periods stated in Section 9. This Privacy Policy is available in English, and on request we will provide it in any language specified in the Eighth Schedule to the Constitution of India.
15. Consent and acknowledgment
By ticking the consent box on our forms, making a donation or sponsorship, registering as a volunteer, or otherwise giving us your personal information after being shown a link to this Privacy Policy, you acknowledge that you have read and understood it and, where our processing relies on consent, you give your consent for the specific purposes described in it. You may withdraw your consent at any time as described in Section 9. If you are giving consent on behalf of a child or a person with a disability, you confirm that you are that person’s parent or lawful guardian.