Privacy Policy

OFFICIAL PRIVACY & DATA PROTECTION POLICY

ETERNAL SOCIAL RESTORATION FOUNDATION is an incorporated Section 8 Not-for-Profit Company registered under the Companies Act, 2013, Ministry of Corporate Affairs, Government of India.
Corporate Identification Number (CIN): U86900GJ2026NPL177294
Governing Law: Digital Personal Data Protection Act, 2023 (DPDP Act) & Information Technology Act, 2000.
Registered Office: 333, 3rd Floor, Rajhans Ornate, Parle Point, Surat, Gujarat, India – 395007

Last Updated: October 2026

Governed by DPDP Act 2023 • ESRF Secretariat, Surat

1. Scope & Commitment to Citizen Privacy

The Eternal Social Restoration Foundation is committed to safeguarding the privacy, confidentiality, and constitutional dignity of every citizen, applicant, beneficiary, volunteer, and donor who interacts with us. This Privacy Policy governs the collection, processing, storage, and protection of personal data and sensitive case documents submitted through esrfhelp.org, our helpline (+91 91061 03153), or during offline intake drives. We handle all data in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

2. Categories of Personal Data We Collect

To provide complimentary legal guidance, administrative drafting, and welfare navigation, we collect only necessary and lawful data provided voluntarily by you:
• Basic Identity & Contact Data: Full name, gender, age/date of birth, residential address, mobile number, alternative phone number, and email address.
• Government Identification Proofs: Copies of Aadhaar card, Voter ID, Senior Citizen card, or PAN card submitted solely for applicant verification.
• Sensitive Case Evidence & Grievance Details: Factual descriptions of civil harassment or social disputes, domestic dispute records, police complaint/intake copies, administrative notices, and relevant communication records provided by applicants seeking aid.
• Donor & Transaction Metadata: Name, email, mobile number, and UPI/UTR transaction references for donations processed via direct State Bank of India (SBI) transfers.

3. Lawful Purpose Limitation & Use of Information

All personal and sensitive data collected by the Foundation is utilized strictly for non-commercial, statutory purposes:
• Assessing case eligibility for free legal aid and counseling within non-cognizable civil parameters.
• Verifying that matters are not actively sub-judice or pending before any court of law.
• Communicating with applicants regarding case status, legal counseling appointments, and field follow-ups.
• Issuing statutory donation receipts and maintaining audit accounts mandated by Section 8 of the Companies Act, 2013.
• Responding to verified inquiries, RTI requests, or law enforcement notices where legally compulsory.

4. Absolute Zero Commercial Monetization

The Eternal Social Restoration Foundation enforces an uncompromised institutional rule:
• We NEVER sell, rent, lease, trade, or commercially monetize any personal data, phone numbers, email addresses, or case documents belonging to applicants, beneficiaries, donors, or volunteers.
• Citizen data is never shared with third-party advertisers, telemarketers, credit bureaus, or commercial agencies under any circumstances.

5. Data Security, Storage & Encryption Protocols

We apply stringent technical and organizational measures to protect applicant records against unauthorized access, loss, or alteration:
• All digital data transmitted via esrfhelp.org is protected using modern Transport Layer Security (TLS 1.3 / SSL) encryption.
• Case files and evidence documents are stored in access-restricted, authenticated repositories accessible exclusively to authorized Legal Department coordinators.
• In compliance with Section 8 statutory recordkeeping rules, physical and digital records are securely archived once a case is closed and systematically purged in accordance with our data retention schedule.

6. Beneficiary Rights Under the DPDP Act, 2023

Under the Digital Personal Data Protection Act, 2023, every citizen (Data Principal) whose data is held by ESRF possesses the following statutory rights:
• Right to Access: You have the right to request a summary of the personal data and case records processed by the Foundation.
• Right to Correction & Updating: You have the right to request correction of inaccurate, outdated, or incomplete personal data.
• Right to Grievance Redressal: You have the right to register a grievance with our designated Data Protection Officer regarding data handling.
• Right to Withdraw Consent / Erasure: You may withdraw consent for data processing at any time, subject to legal and statutory recordkeeping obligations under the Companies Act, 2013.

7. Website Cookies & Analytics

Our website utilizes standard, essential technical cookies to ensure smooth page navigation, security verification, and accessibility features. We do not use third-party invasive behavioral tracking or cross-site commercial profiling cookies. Any aggregated statistical data collected (such as page view counts) is strictly anonymized to evaluate website performance and user accessibility.

8. Protection of Children’s & Minors’ Data (DPDP Act Sec 9 & POCSO 2012)

In strict adherence to Section 9 of the Digital Personal Data Protection Act, 2023 and the Protection of Children from Sexual Offences (POCSO) Act, 2012:
• The Foundation does NOT process any personal data of an individual below eighteen (18) years of age without verifiable consent from the parent, lawful guardian, or an authorized child welfare committee.
• We strictly prohibit any tracking, behavioral monitoring, or profiling of children.
• Any intake documents, identity proofs, or grievance narratives concerning a child are placed in sealed, access-restricted digital vaults accessible solely to the Foundation’s designated Child Safeguarding Officer.

9. Handling of Electronic Case Evidence (WhatsApp, Audio/Video & FIRs)

When applicants submit digital evidence—including WhatsApp chat screenshots, call recordings, CCTV footage, tenancy papers, or police complaint copies—to substantiate harassment or abuse:
• All digital evidence is treated as confidential legal matter under the Indian Evidence Act / Bharatiya Sakshya Adhiniyam.
• Volunteers and associates are strictly prohibited from transferring, forwarding, saving, or circulating case evidence on personal smartphones, cloud drives, or private messaging apps.
• Evidence is processed exclusively through centralized, encrypted foundation channels for factual verification and legal counseling.

10. Statutory Exceptions: Disclosures to Police & Judicial Authorities

While ESRF never sells or shares data with commercial parties, the Foundation may disclose specific applicant or grievance records strictly under the following statutory conditions:
• Upon receipt of a formal legal summons, warrant, or statutory order issued by a competent Court of Law, Judicial Magistrate, or National/State Human Rights Commission.
• In compliance with a written investigation notice issued by law enforcement authorities under Section 91 of the Code of Criminal Procedure (CrPC) / Bharatiya Nagarik Suraksha Sanhita (BNSS).
• When immediate disclosure is necessary to prevent severe physical harm, suicide, or an imminent life-threatening crime against a senior citizen, woman, or child.
All such disclosures are strictly reviewed and authorized by the Foundation’s Board of Directors and legal counsel prior to release.

11. Third-Party Technical Processors & Infrastructure

To operate a secure and reliable web infrastructure, ESRF engages vetted technical service providers who act strictly as Data Processors under contractual data protection terms:
• Web & Database Hosting: Enterprise cloud hosting located in Tier-3 data centers within Mumbai, India (LiteSpeed / Hostinger India).
• Security & DNS Filtering: Cloudflare edge network for SSL/TLS 1.3 encryption, DDoS mitigation, and firewall protection.
• Transactional Communications: Secure transactional SMTP mail servers for automated application receipts.
These technical partners are bound by strict non-disclosure obligations and are legally prohibited from accessing or using citizen data for any independent purpose.

12. Data Retention & Statutory Destruction Schedules

In accordance with Section 8 of the Companies Act, 2013 and Section 8(7) of the DPDP Act 2023:
• Statutory & Financial Records: Donation transaction records, bank transfer confirmations, and audit trail logs are retained for a minimum statutory period of eight (8) financial years to satisfy corporate audit and Ministry of Corporate Affairs compliance.
• Resolved Grievance Dossiers: Case files, applicant evidence, and intake drafts for non-active matters are securely archived upon case resolution and permanently shredded or cryptographically erased after three (3) years of inactivity, unless ongoing statutory inquiries require continued retention.

13. Data Breach Incident Management & Regulatory Reporting

The Foundation enforces a proactive cybersecurity and breach response protocol in alignment with CERT-In directives and DPDP Act provisions:
• In the event of a confirmed or suspected security incident involving unauthorized access, data loss, or system breach, our technical security team will initiate immediate containment within two (2) hours.
• If the incident poses a significant risk of harm to Data Principals, ESRF will notify the affected individuals and report the incident to the Data Protection Board of India (DPB) and the Indian Computer Emergency Response Team (CERT-In) within prescribed statutory timelines.

14. Domestic Data Sovereignity (Strict Prohibition on Cross-Border Transfers)

All primary web servers, donor databases, case tracking records, and digital archives belonging to the Eternal Social Restoration Foundation are hosted and maintained exclusively on servers physically located within the sovereign borders of the Republic of India. The Foundation enforces a strict policy against transferring, mirroring, or exporting sensitive applicant data or beneficiary records to foreign jurisdictions.

15. Right to Nominate in Case of Death or Incapacity (DPDP Act Sec 14)

In accordance with Section 14 of the Digital Personal Data Protection Act, 2023:
• Every registered applicant, member, or donor has the statutory right to designate a Nominee who, in the event of death or medical incapacity of the Data Principal, shall be empowered to exercise their rights regarding personal data held by ESRF.
• Nominations can be registered, modified, or revoked at any time by sending a verified written notice accompanied by government ID proof to our Data Protection Desk.

16. Data Protection Officer (DPO) & Statutory Grievance Redressal Desk

For any data access requests, corrections, consent withdrawals, nomination filings, or privacy complaints under the DPDP Act 2023, you may contact our designated statutory officer:

Data Protection Officer (DPO) & Grievance Custodian
Eternal Social Restoration Foundation
Registered Office: 333, 3rd Floor, Rajhans Ornate, Parle Point, Surat, Gujarat, India – 395007
Official Email: contact@esrfhelp.org (Subject: “Data Privacy Inquiry / DPDP Grievance”)
Foundation Helpline: +91 91061 03153

Timeframe: All verified privacy requests and grievances will be officially acknowledged within 48 hours and resolved within thirty (30) business days.