Privacy policy
Effective date: 9 Sep 2026
1. Introduction
At Zenith Society for Socio Legal Empowerment (“Zenith”, “we”, “us” or “our”), we value your privacy as a right that is core to your dignity, autonomy, and identity. Through this Privacy Policy, we intend to bring our value system into practice and explain to you how we deal with the personal information we collect through sehr.org.in (“Website”), how we use, share and protect it, and the choices and rights available to you.
This Policy is framed with reference to:
the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
the Digital Personal Data Protection Act, 2023 (“DPDPA”) and the Digital Personal Data Protection Rules, 2025 framed thereunder, to the extent their respective provisions are in force from time to time;
(Note: Several substantive DPDPA obligations, including most consent, notice and security requirements, are being brought into force in a phased manner. This Policy is drafted to be consistent with the Act and Rules as a matter of good practice, even where a specific provision is not yet in force.
for visitors from the European Union, the European Economic Area or the United Kingdom, the EU General Data Protection Regulation (GDPR) and the UK GDPR; and
for visitors from the United States, applicable state privacy laws, to the extent they apply to Zenith's processing.
By using the Website, you agree to the collection and use of information in accordance with this Policy. This Policy applies only to information collected through the Website and not to information collected offline, for example during in-person legal assistance or case intake, which is governed separately by our confidentiality obligations and by applicable professional conduct rules.
2. Information We Collect
a) Information you provide directly
When you fill a contact form, volunteer form, financial contribution or case-enquiry form, subscribe to updates, or otherwise write to us, we may collect your name, email address, phone number, postal address, and any other information you choose to share, including details about your query or matter.
If you make a financial contribution for which you seek a tax-exemption receipt—for example, under Section 80G of the Income Tax Act, 1961—we may also collect your PAN (Permanent Account Number) and Aadhaar Number.
b) Sensitive personal data or information
Certain categories of information we may collect—such as your PAN, Aadhaar details, and bank account or UPI details where shared with us directly, for example for a refund—are treated by us as sensitive personal data or information (“SPDI”) within the meaning of the SPDI Rules, 2011, warranting a higher standard of care.
We collect such information only where reasonably necessary for the purpose stated at the point of collection, such as issuing a financial contribution receipt or processing a refund. We describe the additional safeguards that apply to it in Section 7 (Data Security) below.
c) Information collected automatically
Like most websites, we may automatically collect certain technical information when you visit, such as your IP address, browser type, device information, pages visited, and the date and time of your visit, typically through cookies or similar technologies. See Section 8.
d) Information collected by third parties
Certain functions of the Website—such as online payments, email or newsletter delivery, website hosting, and analytics—are provided through independent third-party service providers.
These third parties may collect information directly from you, for example card, UPI or bank details entered on a payment gateway's own page, and process it under their own privacy policies, for which they are independently responsible.
Zenith does not control, and does not accept responsibility for, the privacy or data-security practices of such independent third parties, beyond taking reasonable care in selecting service providers who are legitimate and bound to confidentiality. We encourage you to review the privacy policy of any third-party service before submitting information to it.
e) Payment information
If you make a financial contribution to us online, payment details are collected and processed directly by our third-party payment gateway, in accordance with subsection (d) above.
Zenith does not receive or store your full card, UPI, or bank account credentials.
3. How We Use Your Information
We use the information we collect to:
respond to your enquiries, requests for assistance, or correspondence;
process financial contributions, and issue receipts or acknowledgements, including tax-exemption receipts where PAN has been provided for that purpose;
keep you updated about our work, events and campaigns, where you have opted to receive such updates;
improve the content and functioning of the Website;
comply with applicable law, or respond to a lawful request from a court, regulator or government authority; and
protect the rights, property or safety of Zenith, our staff, volunteers, or the public.
We do not use information submitted through the Website for any purpose incompatible with the purpose for which it was collected without informing you.
4. Legal Basis for Processing
We process personal data on the basis of:
your consent, given through a clear affirmative action such as submitting a form or subscribing to updates;
our legitimate interest in responding to enquiries, running the Website, and pursuing our charitable objects; or
as otherwise permitted or required by applicable law, including the DPDPA's recognised “legitimate uses,” such as voluntarily provided data for a specified purpose or compliance with a legal obligation.
Where our processing is based on your consent, you may withdraw that consent at any time in the manner described in Section 10, without affecting the lawfulness of processing carried out before withdrawal.
5. Sharing and Disclosure of Information
We do not sell or rent your personal information. We may share information only:
with service providers who assist us in operating the Website, sending communications, or processing financial contributions, and who are bound to use such information only for the purpose for which it is shared;
where you have given consent for a specific disclosure;
where required to comply with a law, regulation, court order, or lawful government request; or
to protect the rights, property or safety of Zenith, our staff, volunteers, users, or the public.
As explained in Section 2(d), some information may also be collected directly by independent third-party service providers, such as our payment gateway, rather than shared by us. Zenith is not responsible for such providers' independent processing, which is governed by their own privacy policies.
6. Data Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or as required by applicable law. As a general guide:
enquiry, contact and volunteer form data is retained for so long as needed to respond to and follow up on the relevant request, and is thereafter deleted or anonymised unless you have opted in to further communications;
Financial contribution records, PAN, and related financial information are retained for the period required under applicable tax, accounting and audit requirements, including the record-retention requirements under the Income Tax Act, 1961, and are not used for any other purpose;
website analytics and log data are retained in accordance with our analytics provider's standard retention settings, or for a shorter period where we are able to configure this; and
where the DPDPA or rules made thereunder prescribe a minimum retention period for personal data and associated logs for specified classes of data fiduciaries, we will comply with such requirement once, and to the extent, it applies to us.
Once the applicable purpose has been fulfilled and no further retention is required by law, we securely delete or irreversibly anonymise the information, except where continued retention is necessary for the establishment, exercise or defence of legal claims.
7. Data Security
We take reasonable technical and organisational measures to protect the personal information we hold against unauthorised access, alteration, disclosure or destruction.
In particular, sensitive information such as PAN and financial details is held on a restricted, need-to-know basis and, where feasible, in encrypted or masked form. Access to such information is limited to individuals who require it for the purposes described in this Policy.
However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
In the event of a personal data breach that affects your personal information, we will take reasonable steps to notify you and, once the corresponding provisions of the DPDPA and DPDP Rules, 2025 are in force and applicable to us, the Data Protection Board of India, within the timelines prescribed under applicable law.
8. Cookies and Tracking Technologies
The Website may use cookies or similar technologies to remember your preferences and understand how visitors use the Website, including through analytics tools.
You can control or disable cookies through your browser settings. However, doing so may affect certain features of the Website.
9. Children's Privacy
The Website is not directed at children. Consistent with the DPDPA, we do not knowingly process the personal data of a child—an individual below eighteen years of age—without the verifiable consent of a parent or lawful guardian.
We do not carry out tracking, behavioural monitoring, or targeted advertising directed at children.
If you believe a child has provided us with personal information without such consent, please contact us so that we may take appropriate action, including deletion of that information.
10. Your Rights
Subject to applicable law, including the DPDPA once its relevant provisions are in force, you may:
ask us for a summary of the personal information we hold about you and how it is being processed;
ask us to correct or complete inaccurate or outdated information;
request erasure of personal information you have submitted, where it is no longer necessary for the purpose for which it was collected, subject to any legal or record-keeping obligation that requires us to retain it;
withdraw consent to marketing or update communications, or to any other consent-based processing, at any time;
raise a grievance with our Grievance Officer in Section 13 and expect it to be acknowledged and addressed within the timelines prescribed under applicable law; and
nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
To exercise any of these rights, please write to us using the contact details in Section 16.
11. Visitors from the European Union, European Economic Area or United Kingdom
If you access the Website from the EU, the EEA or the UK, we process your personal data in a manner consistent with the EU General Data Protection Regulation (GDPR) and the UK GDPR, to the extent they apply to our processing—for example, where you contact us, subscribe to updates, or make a financial contribution from these regions.
Our legal basis for processing is generally your consent, our legitimate interest in responding to enquiries and running the Website, or compliance with a legal obligation. We do not sell your personal data.
In addition to the rights set out in Section 10 above, you have the right to:
access the personal data we hold about you;
request rectification or erasure;
request restriction of or object to processing;
request data portability, where technically feasible; and
withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Because Zenith is based in India, any personal data you share with us will be transferred to and stored in India. By using the Website and providing your information, you acknowledge this transfer.
You also have the right to lodge a complaint with your local data protection supervisory authority.
12. Visitors from the United States
Zenith is a non-profit society and not a “business” as defined under the California Consumer Privacy Act (CCPA/CPRA), which generally exempts non-profit organisations.
We do not sell or share personal information for cross-context behavioural advertising, and we do not expect to meet the processing-volume thresholds under other US state privacy laws, including those, such as Colorado's, that do not categorically exempt non-profits.
As a matter of good practice, and regardless of whether a specific US state law formally applies to us, if you are a US resident you may still ask us to tell you what personal information we hold about you, correct it, or delete it, by writing to us using the contact details in Section 16.
We do not sell personal information to any third party.
13. Grievance Officer
In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDPA once its corresponding provisions apply to us, the Grievance Officer for the Website is:
Name: Abhay Jain
Designation: Co-Founder
Address: Pili Kothi, Kamlaganj, Theme Road, Shivpuri, Madhya Pradesh, India - 473551
Email: abhay@zenithsociety.in
Phone: +91-8319302356 (available on WhatsApp)
The Grievance Officer will acknowledge and address complaints relating to this Policy within the timelines prescribed under applicable law.
14. Third-Party Links and Services
The Website may contain links to third-party websites or embed third-party tools such as a payment gateway, social media plug-ins, or map or video embeds.
We do not control, and are not responsible for, the content, privacy practices, or security of such third-party websites or services.
Any information you provide directly to a third-party website or tool is governed by that third party's own privacy policy, and we encourage you to review it before providing your information.
15. Changes to This Policy
We may update this Privacy Policy from time to time by posting a revised version on the Website with an updated effective date. We encourage you to review this Policy periodically.
16. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please write to us at abhay@zenithsociety.in or at our registered office address:
Pili Kothi, Kamlaganj, Theme Road, Shivpuri, Madhya Pradesh, India - 473551.