Privacy & Data Protection Policy
Balarc Foundation

Last Updated: 1st April, 2025

1. Our Commitment to Your Privacy

The Balarc Foundation, referred to as "we," "our," or "us," is dedicated to maintaining the highest standards of data protection and privacy. As an organization that focuses on research, advocacy, and skill-building for the LGBTQIA+ community and other marginalized groups in India, we handle personal and often sensitive information. We are committed to being transparent and responsible with the data entrusted to us.

This Privacy Policy details how we collect, use, store, share, and protect personal data. It is designed in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and other relevant laws. This policy is applicable to all individuals whose data we process, including:

• Donors and Supporters

• Research Participants and Program Beneficiaries

• Employees, Interns, and Consultants

• Contractors and Vendors

By engaging with the Balarc Foundation, you acknowledge that you have read and understood this policy.

2. The Information We Collect

We only collect information that is necessary for us to fulfill our mission. The specific types of data collected depend on your relationship with us.

● For Research Participants and Program Beneficiaries:

• Personal Identifiers: This includes your name, age, gender, and contact details.

• Sensitive Personal Data: With your explicit, informed, and freely given consent, we may collect sensitive data as part of our research and programs. This can include health information (like HIV status and sexual health), sexual orientation, gender identity, personal experiences with discrimination, and feedback relevant to the program.

• Consent Records: We securely maintain records of the consent you provide. All research data is anonymized or pseudonymized as early as possible to protect your identity.
  

● For Employees, Interns, Consultants, Contractors, and Vendors:

• Professional and Identity Information: This includes name, contact information, residential address, resume/CV, educational history, professional certifications, and references.

• Legal and Financial Information: We may collect your PAN, Aadhaar number (where legally permissible), bank account details for payments, GST details for vendors, and signed contracts

• Joining and Onboarding Papers: We collect necessary documents to formalize our contractual relationship, such as identity and address proofs, and background verification reports where applicable and with your consent.

3. How We Use Your Information

The use of your data is purpose-driven and has a legal basis.

• To Fulfill Our Mission: To conduct research, run skill-building workshops, provide healthcare support, and advocate for human rights.

• To Manage Relationships: To communicate with you, process donations, manage activities for volunteers and employees, and fulfill contracts with vendors.

• For Legal & Financial Compliance: To process payroll, issue tax-exemption receipts, and maintain financial records as required by the Income Tax Act, 1961, and the Foreign Contribution (Regulation) Act, 2010 (FCRA).

• For Outreach & Communication: To send newsletters, updates, and event invitations. You can opt-out of these communications at any time.

• To Improve Our Operations: To analyze data for internal reporting, strategic planning, and improving the effectiveness of our programs.
  

4. Data Retention

We retain personal data only for the time necessary to fulfill the purpose for which it was collected, in accordance with the DPDP Act.

• Financial and Tax Records: Donation records, vendor invoices, and employee financial data are kept for up to 8 years from the end of the relevant financial year, as required by law.

• Employee and Contractor Records: Data is retained for the duration of the employment or contract and for a period afterward as required by labor laws.

• Research Data: Identifiable personal data from research is kept only until it is anonymized or pseudonymized. Anonymized or pseudonymized data may be retained indefinitely for analysis and archival purposes.

• Program Beneficiary Data: This information is retained for the program's duration and a reasonable period after for impact assessment and reporting.

• Newsletter Data: Your data is retained as long as you are subscribed to our communications and will be erased upon your request to unsubscribe.

Once the retention period ends, personal data is securely destroyed or permanently anonymized.

5. Sharing and Disclosure of Information

We do not sell your personal data. We may disclose your data in limited situations:

• With Service Providers: We engage trusted third parties like payment gateways and cloud hosting providers who are contractually bound to process data under our instructions.

• To Protect Our Rights: To protect the rights, safety, and property of the Balarc Foundation, our staff, and the communities we serve.
  

6. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have several rights regarding your personal data:

• Right to Access Information: You can ask for a summary of the personal data we hold about you.

• Right to Correction and Erasure: You can request to correct inaccurate data or erase data that is no longer needed.

• Right to Withdraw Consent: You can withdraw your consent for data processing at any time, which will not affect processing done prior to the withdrawal.

• Right to Grievance Redressal: You can have any grievances addressed by our designated officer.

• Right to Nominate: You can nominate another person to exercise your rights in the event of your death or incapacity.
  

To exercise any of these rights, please contact our Grievance Officer.

7. Data Security

We are committed to securing your data through robust technical and organizational measures. These include:

• Encryption: Data is encrypted both in transit and at rest.

• Access Control: Access to personal data is strictly limited to authorized personnel on a need-to-know basis.

• Data Minimization: We only collect data that is absolutely necessary for the specified purpose.

• Regular Audits: We conduct periodic security assessments to identify and address risks.

  8. Links to other websites:

Our website may contain links to other websites that are not owned or controlled by us. Please be aware that we are not responsible for such other websites or third parties' privacy practices. We encourage you to be aware when you leave our website and read the privacy statements of each website that may collect personal information.

9. Changes to This Privacy Policy

This policy may be updated to reflect changes in our practices or in the law. The updated policy will be posted on our website with the new effective date. We recommend that you review it periodically.

10. Grievance Redressal and Contact Information

For any questions, concerns, or to exercise your rights, please contact our Grievance Officer:

• Grievance Officer

• Balarc Foundation

• Lucknow, Uttar Pradesh, India

• Email: admin@balarcfoundation.org