Privacy Policy

1. About Us

Bandari Charitable Foundation ("we", "us", "our", or "the Foundation") is a registered charitable trust incorporated under the laws of India, operating at Mancherial, Telangana – 504208. The Foundation is:

• Registered under Section 12A of the Income Tax Act, 1961 (exemption from income tax)
• Holder of 80G certification (Form 10AC) — donations are tax-deductible for donors
• Registered on the NGO Darpan portal of NITI Aayog, Government of India
• Maintains audited accounts (FY 2022-23) and files annual ITR

We operate the website www.bandari.co.in and collect certain personal information to provide healthcare membership cards, accept donations, and deliver our charitable programmes. This Privacy Policy explains how we handle your data.

2. Information We Collect

2.1 Information You Provide Directly

• Identity Data: Full name, date of birth, gender
• Contact Data: Mobile number, email address, residential address, city, PIN code
• Professional Data: Company name, employee count (for Corporate Membership Cards)
• Family Data: Names and relationships of family members added to membership
• Financial Data: Amount of donation or membership fee chosen; we do not store card numbers or CVV — payment processing is handled by our payment gateway partner
• Communication Data: Messages submitted via our contact form

2.2 Information Collected Automatically

• IP address, browser type, operating system
• Pages visited, time spent, referring URL
• Cookies and similar tracking technologies (see Section 7)

2.3 OTP-Based Authentication

We use One-Time Passwords (OTPs) sent to your registered mobile number for login and registration. OTPs are stored only for 5 minutes and deleted immediately after verification.

3. How We Use Your Information

• To register and manage your membership account
• To issue and activate Health Membership Cards (Silver, Gold, Diamond, Corporate)
• To process donations and issue donation receipts / 80G certificates
• To send OTPs and transactional notifications via SMS
• To synchronise your membership card data with Thirupathi Hospitals (our partner hospital) to apply discounts at point of service
• To send updates about our programmes, events, and health camps (you may opt out at any time)
• To comply with legal and regulatory obligations
• To prevent fraud and ensure security of our platform

4. Sharing of Your Information

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Payment Gateway (Razorpay): To securely process membership fee and donation payments. Razorpay is PCI-DSS compliant. Their privacy policy is available at razorpay.com/privacy
• Thirupathi Hospitals: Membership card details (card type, discount entitlement, validity) are shared via a secure API to enable discount application at the hospital
• SMS Service Provider: Your mobile number is shared with our OTP provider solely to deliver authentication messages
• Government & Regulatory Bodies: When required by law, court order, or regulatory authority

5. Data Retention

• Membership and payment records: Retained for 7 years as required by Indian financial laws
• OTP sessions: Deleted within 5 minutes of issuance
• Contact messages: Retained for 2 years
• Inactive accounts: Reviewed and anonymised after 5 years of inactivity

6. Security of Your Information

We implement industry-standard security measures to protect your data:

• SSL/TLS encryption for all data in transit
• Passwords and sensitive data hashed using bcrypt
• Access restricted to authorised personnel only
• Regular security reviews and updates
• Payment data is handled exclusively by PCI-DSS certified payment gateways — we never store raw card data

7. Cookies Policy

Our website uses the following types of cookies:

• Essential Cookies: Required for login sessions and website functionality. Cannot be disabled.
• Analytics Cookies: Help us understand how visitors use our site (may be disabled in your browser settings).

You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate information via your Member Profile
• Request deletion of your account and data (subject to legal retention requirements)
• Withdraw consent for marketing communications at any time
• Port your data in a machine-readable format on request

To exercise these rights, email us at info@bandari.co.in.

9. Children's Privacy

Our services are not directed to children under 18 years of age. We do not knowingly collect personal information from minors. Family members under 18 may be added to a parent's/guardian's membership account, but the account holder must be 18 or older.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be notified via email to registered members and displayed prominently on this page. Continued use of our website after such changes constitutes acceptance of the updated policy.