Privacy Policy

1. Introduction

This Privacy Policy describes how G Systems ("G Systems," "we," "us," or "our"), the developer and operator of the Impact Saathi platform ("Impact Saathi," the "Platform," or the "Service"), collects, uses, discloses, and protects personal information of visitors to our website, donors, NGO users, corporate CSR users, volunteers, and platform administrators.

By accessing or using Impact Saathi, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use the Platform.

2. Information we collect

We collect the following categories of information depending on how you interact with the Platform:

3. How we use information

We use the information we collect to:

• Process donations and generate legally compliant 80G tax receipts
• Deliver fund-utilization updates and receipts via email and WhatsApp
• Verify NGO registration, certification status, and eligibility to receive donations
• Operate, maintain, and improve the Platform and its features
• Process subscription payments and manage your account
• Respond to support requests and platform inquiries
• Comply with applicable Indian tax, audit, and regulatory requirements
• Detect, prevent, and address fraud, abuse, or security incidents

4. DPDP Act 2023 consent

Impact Saathi is built in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Where we collect personal data for a specific purpose — such as processing a donation or sending a fund-utilization update — we obtain your explicit, informed consent before collection, and we record the timestamp and context of that consent.

You may withdraw consent at any time by writing to us at the contact details below, though withdrawing consent may affect our ability to provide certain features, such as issuing a tax receipt for a past donation.

5. Sharing of information

We do not sell personal information. We may share information in the following limited circumstances:

• With the NGO you donate to — your name, contact details, and donation amount, so the NGO can issue your 80G receipt and communicate fund updates
• With payment gateway providers — solely to process your payment securely; we do not store full card details
• With service providers — such as cloud hosting (AWS), email delivery (Amazon SES), and WhatsApp Business messaging providers, strictly to operate the Platform
• With CSR corporate partners — only the data necessary for the consolidated compliance view you have authorised as part of an NGO-CSR relationship
• Where required by law — including in response to valid requests from Indian tax, regulatory, or law enforcement authorities

6. Data security

We apply industry-standard safeguards to protect personal information, including:

• Encryption of sensitive fields such as PAN numbers using AES-256 encryption at rest
• Tenant-level data isolation, so one NGO's data is never visible to another
• Role-based access control restricting data visibility by platform role
• Password hashing using industry-standard algorithms; passwords are never stored in plain text
• Encrypted connections (TLS) for all data transmitted to and from the Platform

No system can guarantee absolute security. We continuously work to strengthen our safeguards but cannot warrant that unauthorized access, hardware failure, or other breaches will never occur.

7. Data retention

We retain personal information for as long as necessary to fulfil the purposes described in this policy, including:

• Donation and receipt records — retained for a minimum of 7 years to satisfy Indian Income Tax Act audit and compliance requirements
• Account information — retained for the duration of your active subscription and a reasonable period thereafter
• Audit logs — retained immutably for a minimum of 7 years

8. Your rights

Subject to applicable law, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, where retention is not legally required (for example, where no tax receipt obligation exists)
• Withdraw consent for processing that is based on consent
• Lodge a grievance with our Grievance Officer (see Contact section below)

9. Cookies

We use cookies and similar technologies to operate the website, remember your preferences, and understand how visitors use the Platform. You can control cookie preferences through your browser settings. See our Cookie Policy for full details.

10. Children's data

Impact Saathi is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

11. International data transfer

Impact Saathi's infrastructure is hosted on Amazon Web Services in the Mumbai (ap-south-1) region. In certain limited circumstances, data may be processed by service providers located outside India; where this occurs, we require appropriate safeguards consistent with the DPDP Act.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page with a revised "Last updated" date. Material changes will be communicated to registered users by email.

13. Contact us

For questions about this Privacy Policy, or to exercise your data protection rights, please contact:

G Systems — Impact Saathi Grievance Officer
Email: hello@impactsaathi.com
Subject line: "Privacy / Data Protection Request"