Mandhata Dham

1 Information We Collect

1.1 Information You Provide Directly

When you make a donation or interact with our website, we may collect:

Identity Information: Full name (or anonymous preference)
Contact Information: Email address, phone number
Financial Information: Donation amount (payment card details are processed exclusively by Razorpay and are never stored on our servers)
Communications: Optional messages or notes you include with your donation

1.2 Information Collected Automatically

When you visit our website, we may automatically collect:

IP address and approximate geographic location
Browser type, version, and operating system
Pages visited, time spent, and referring URLs
Device type and screen resolution

1.3 Information from Payment Processors

After a successful payment, Razorpay may share with us: payment status, transaction reference ID, and payment method type (UPI, card, net banking, etc.). We do not receive full card numbers, CVV, or banking credentials.

2 How We Use Your Information

We use your personal information solely for the following purposes:

Processing Donations: To complete, verify, and record your donation transaction
Communication: To send you donation receipts, 80G tax certificates (if applicable), and campaign updates
Donor Recognition: To display your name on our public donor leaderboard (only if you have not selected "anonymous")
Legal Compliance: To maintain financial records as required under applicable Indian law
Platform Security: To detect and prevent fraudulent transactions or abuse
Service Improvement: To analyse usage patterns and improve website functionality

We will never sell, rent, or trade your personal information to any third party for marketing purposes.

3 Payment Processing via Razorpay

All online payments on this website are processed by Razorpay Software Private Limited, a PCI-DSS Level 1 compliant payment gateway regulated by the Reserve Bank of India (RBI). When you click "Donate Now", you are redirected to Razorpay's secure checkout interface.

3.1 What Razorpay Collects

Razorpay independently collects and processes your payment credentials (card number, UPI ID, net banking credentials, OTP, etc.) under their own privacy policy. We encourage you to review:

Razorpay Privacy Policy: razorpay.com/privacy
Razorpay Terms of Use: razorpay.com/terms

3.2 What We Receive from Razorpay

Upon successful payment, Razorpay sends us a payment confirmation containing only:

Transaction / Payment ID (e.g., pay_XXXXXXXXXXXXX)
Order ID (e.g., order_XXXXXXXXXXXXX)
Payment status (success/failed)
Payment method category (card / UPI / netbanking / wallet)

We perform HMAC SHA-256 signature verification on every payment callback to confirm its authenticity before recording any donation.

4 Data Storage & Security

Your personal data is stored in a secured WordPress database (MySQL) hosted on our web server. We implement the following security measures:

SSL/TLS encryption for all data in transit (HTTPS)
Parameterised SQL queries to prevent injection attacks
WordPress nonce validation on all forms and API requests
Rate limiting on donation submissions
Regular database backups
Admin access protected by WordPress role management

We do not store payment card numbers, CVV codes, UPI PINs, banking passwords, or any other sensitive payment credentials on our servers.

5 Sharing of Your Information

We do not sell or share your personal information except in the following limited circumstances:

Razorpay: Your name, email, and phone number are shared with Razorpay solely to pre-fill the payment form and facilitate the transaction
Legal Requirements: We may disclose information when required by law, court order, or government authority under applicable Indian statutes (including Income Tax Act, FCRA, etc.)
Fraud Prevention: We may share information with law enforcement to investigate suspected fraud or illegal activity
Service Providers: We use WordPress and hosting infrastructure providers who are bound by confidentiality obligations

6 Cookies & Tracking Technologies

Our website uses the following types of cookies:

Essential Cookies: WordPress session cookies required for the website to function (e.g., wordpress_logged_in_*, wp_settings_*)
Functional Cookies: Cookies that remember your preferences during a session
Analytics: We may use privacy-respecting analytics to understand website traffic (no personally identifiable data is collected)

You can disable cookies through your browser settings. Disabling cookies may affect certain website functionality but will not prevent you from donating.

7 Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law, you have the following rights:

Right to Access: Request a copy of the personal data we hold about you
Right to Correction: Request correction of inaccurate or incomplete personal data
Right to Erasure: Request deletion of your personal data, subject to legal retention obligations
Right to Withdraw Consent: Withdraw consent to data processing at any time (note: this will not reverse a completed donation)
Right to Grievance Redressal: Lodge a complaint with our Grievance Officer (see Section 11)

To exercise any of these rights, contact us at mandhatadham@gmail.com. We will respond within 30 days.

8 Data Retention

We retain your personal data for the following periods:

Donation Records: 7 years from the date of donation, as required by Indian financial regulations and Income Tax Act provisions for charitable institutions
Email Communications: Until you unsubscribe or request deletion
Website Logs: Up to 90 days

After the applicable retention period, your data will be securely deleted or anonymised.

9 Children's Privacy

Our website and donation services are not directed to individuals under the age of 18 years. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information without parental consent, please contact us immediately at mandhatadham@gmail.com and we will delete such information promptly.

10 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page and may notify registered donors via email.

Your continued use of our website after any changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

11 Grievance Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer for addressing your data privacy concerns:

Grievance Officer