Privacy Policy

1. Who we are

Sevastack is a multi-tenant SaaS platform operated by NaviByte Innovations for Indian NGOs, Trusts, and Foundations. Under the DPDP Act 2023:

• Data Fiduciary: Each NGO organization using Sevastack determines the purpose of data processing for their donors, volunteers, and employees.
• Data Processor: Sevastack (NaviByte Innovations) processes data on behalf of NGO organizations as per their instructions.

2. Personal data we collect

3. Lawful basis for processing (DPDP Sections 6-7)

• Consent (S.6): Donor and volunteer data collected via public forms with explicit consent checkbox.
• Legal obligation (S.7(b)): Donor PAN for 80G receipts and Form 10BD (Income Tax Act requirement).
• Employment contract (S.7(a)): Employee data for payroll, PF/ESI/TDS filing.
• Performance of contract (S.7(c)): User account data for platform access per Terms of Service.
• Legitimate interest (S.7(d)): Audit logs with IP addresses for security monitoring.

4. Your rights (DPDP Sections 11-14)

As a data principal, you have the following rights:

• Right to access (S.11): Request a copy of all personal data held about you.
• Right to correction (S.11): Request correction of inaccurate or incomplete data.
• Right to erasure (S.12): Request deletion of your personal data (subject to legal retention requirements).
• Right to data portability: Export your data in machine-readable format.
• Right to grievance redressal (S.13): File a complaint about data handling practices.
• Right to withdraw consent (S.6(6)): Withdraw consent at any time for non-mandatory processing.

To exercise these rights: Submit a data request or file a grievance. Organizations must respond within 30 days.

5. Consent management

We collect explicit consent via checkbox on all public-facing forms (donation, volunteer registration). Consent is recorded with timestamp, method, and purpose. You can withdraw consent for non-mandatory processing at any time by contacting the NGO or our DPO at .

Note: Consent cannot be withdrawn for legally mandated processing (e.g., 80G receipt generation with PAN — required by Income Tax Act).

6. Data retention (DPDP S.8(7))

Automated cleanup runs daily. NGO organizations can configure retention periods within legal minimums.

7. Security safeguards (DPDP S.8)

• Encryption: AES-256 encryption for sensitive fields (PAN, Aadhaar, bank details). HTTPS/TLS for all data in transit.
• Access control: Role-based access (RBAC) with 5 permission levels. Sensitive data masked in UI.
• Authentication: Passwords bcrypt-hashed. Google OAuth supported.
• Audit trail: All data operations logged with user ID, IP address, and timestamp.
• Rate limiting: Protection against brute-force and spam on all public endpoints.
• Multi-tenancy: Data logically isolated per organization — no cross-tenant access.

8. Third-party processors (DPDP S.8(2))

Under DPDP S.16, personal data may be transferred outside India unless restricted by Central Government notification. We monitor government notifications and will update accordingly.

9. Children's data (DPDP S.9)

Sevastack does not target children as users. Volunteer registration requires users to be 18 years or older (verified via date of birth). We do not knowingly collect personal data from individuals under 18 without guardian consent.

10. Breach notification (DPDP S.8(6))

In the event of a personal data breach, we will notify the Data Protection Board of India and affected data principals without unreasonable delay. Notification will include the nature of the breach, data affected, and remedial measures taken.