Data Retention & Security Policy

1. Purpose and scope

This policy explains how we retain, delete, anonymise and secure personal data. It supports our Privacy Policy and applies to all personal data we hold, whether in digital systems, email, paper records or backups.

2. Retention principles

• We keep personal data only for as long as needed for the purpose for which it was collected.
• We keep data longer where required by law, for safeguarding, for audit or to establish or defend legal claims.
• We review retention periods periodically and delete or anonymise data when they end.
• We do not keep data indefinitely “just in case”.

3. Retention schedule

Contact enquiries

Up to 2 years after resolution.

Volunteer records

Up to 3 years after the last activity.

Newsletter subscriptions

Until unsubscribe, plus up to 30 days for suppression records.

Donation and financial records

At least 8 years from the end of the relevant financial year, or the statutory period.

Grievance records

Up to 3 years after closure.

Safeguarding records

As long as necessary to protect the people involved and meet legal obligations.

Server and security logs

Approximately 90 to 180 days.

Tax and audit records

The period required by tax, accounting and audit law.

These periods are guidelines. A record may be kept longer if it is subject to a legal hold, investigation, audit or dispute.

4. Deletion and anonymisation

When a retention period ends, we delete the data from active systems and, within a reasonable period, from backups in the ordinary course. If deletion is not immediately possible, we isolate the data and prevent further use. We may anonymise data so that it can be used for statistics without identifying anyone.

5. Legal holds

If we receive a legal notice, regulatory request, court order or complaint, or if we reasonably anticipate a dispute, we may suspend deletion for relevant records until the matter is resolved. We will limit the hold to what is necessary.

6. Access control

• Access is granted on a need-to-know basis and reviewed periodically.
• Administrative accounts use strong passwords and multi-factor authentication where available.
• Access is removed promptly when a person leaves a role.
• Shared accounts are avoided for sensitive systems.
• Confidentiality obligations apply to trustees, staff, volunteers and vendors.

7. Technical security

• HTTPS and transport encryption for data in transit.
• Encryption at rest where supported by our service providers.
• Regular software updates and security patches.
• Backups with controlled access and restoration testing.
• Logging and monitoring for suspicious activity.
• Secure configuration of forms, email and payment systems.
• Vendor due diligence and written data-protection terms.

8. Physical and device security

Paper records and devices containing personal data are kept secure, accessed only by authorised people and disposed of securely. Volunteers and staff should use trusted devices, avoid storing personal data on personal devices without approval, and report lost or stolen devices immediately.

9. Incident response and breach notification

We maintain an incident response process to contain, assess, remediate and learn from security incidents. Where a personal data breach is likely to affect individuals, we will notify affected people and the Data Protection Board of India or other competent authority as required by law, without undue delay. We will explain what happened, what we are doing and what affected people can do.

10. Vendor management

We assess service providers that handle personal data, require appropriate confidentiality and security commitments and review their practices periodically. Vendors must not use our data for their own purposes or sell it.

11. Training and awareness

Trustees, staff and relevant volunteers receive guidance on data protection, secure handling, phishing and incident reporting. We review our practices when we introduce new systems or change our processes.

12. Review and contact

We review this policy periodically and after significant incidents. Questions may be sent to contact@sangathya.org. Our Grievance Officer is yet to be appointed. Postal address: Registered address will be published once registration is complete.