Privacy Policy

1. Introduction

The terms “Mind and Matter”, “we”, “us” and “our” refer to Mind and Matter, a non-governmental organisation registered in India, having its office at Kohinoor Road, Madikeri – 571201, Karnataka. The terms “you” and “your” refer to the user of our website or of our volunteer application (together, the “Services”).

Through the Services we coordinate the work of our volunteers: we maintain volunteer accounts, roster volunteers for events and record their attendance, assign and track tasks, distribute activity material for programme sessions, and conduct wellbeing surveys among our volunteers. Our website additionally provides information about our work and accepts donations.

This Privacy Policy explains what information we collect through the Services, the purposes for which it is collected and used, the persons to whom it is disclosed, the periods for which it is retained, and the rights available to you. We are the data fiduciary in respect of the information described in this Policy.

In this Policy, “Personal Information” means information relating to you from which you are identifiable. “Sensitive Personal Information” means Personal Information requiring a higher standard of care, and in our case comprises information relating to your mental health and wellbeing, collected through the surveys described in Section 3.

This Policy applies only to information we collect through the Services and in correspondence sent through or in connection with them. It does not apply to information you provide to, or which is collected by, any third party, including the operators of the Android and iOS platforms and any website to which we link. You are encouraged to consult those parties directly regarding their privacy practices.

Please read this Policy carefully before using the Services. By using the Services you agree to this Policy and provide your informed consent to the collection, use, disclosure, retention and protection of your Personal Information as described in it. If you do not provide the information we require, we may be unable to provide the Services to you.

Permissible age. By using the Services you represent that you are at least 18 years of age. The Services are intended for volunteers, coordinators and staff and accounts are issued by our administrators; see Section 12.

2. Personal Information We Collect

The volunteer application is available by invitation only. Accounts are created by our administrators for volunteers, coordinators and staff; there is no public registration, and we do not collect information concerning persons who are not associated with the organisation.

Account information

• Your name and email address, and the role assigned to your account.
• Where you sign in using Google, we receive your name, email address and Google account identifier from Google. We receive no other information from your Google account and we do not post any content to it.

Profile information

• Optional particulars which you may provide: telephone number, date of birth, gender, city, state, languages known, and a profile photograph. These fields may be left blank and may be modified or removed by you at any time.
• A profile photograph is obtained from your device camera or photo library only upon your selection. The application requests the relevant permission at that time and does not access your camera or photo library at any other time.

Volunteering and activity information

• The events for which you are rostered, the events you have attended, and the date and time of attendance. Attendance is recorded when a coordinator scans a QR code displayed on your device; the camera is used solely to read that code and no image is retained.
• Tasks assigned to you, comments and files which you contribute, and recognitions awarded to you.
• In respect of activity material shared with you through the application: the fact that it was shared with you, the date on which you accepted the applicable usage policy, the occasions on which you opened it, and, on iOS devices, the fact that a screenshot was captured. These records are maintained in order to safeguard the persons described in that material, and you are informed of them before the material is opened.

Notification information

Where you permit notifications, your device provides a push notification token which we use to deliver alerts concerning surveys, events and shared material. Notifications may be disabled at any time from within the application or from your device settings, and the application remains usable if they are disabled.

Change history

We maintain a record of changes made to accounts and to programme records, comprising the change made, the date on which it was made, and the person by whom it was made. That record includes previous values and therefore reflects your earlier particulars as well as your current particulars. It is maintained so that an erroneous or unauthorised change may be identified and reversed, and it is deleted upon deletion of your account.

Technical and diagnostic information

• Where the application or the website encounters an error, we receive a diagnostic report comprising the nature of the error, the application version, and the device model and operating system. Such reports are used solely to identify and correct faults.
• Our servers record requests made to them, including IP addresses, for the purposes of operating the Services and of detecting misuse such as repeated failed sign-in attempts.
• During onboarding your IP address is used on a single occasion to estimate your city, so that the corresponding field may be pre-filled. The estimate may be changed or cleared by you, and the IP address is not retained as part of your profile.
• The website uses cookies necessary for sign-in and for its basic functioning. We do not use advertising cookies or cross-site tracking technologies, and the application does not track you across other applications or websites.

Donation information

Where you make a donation or subscribe through our website, we collect your name, email address, telephone number and the particulars required in order to issue a receipt and to comply with applicable tax law. Card and bank particulars are submitted directly to our payment processor and are not received by our servers. Donations are made through the website; the application does not process payments.

Information we do not collect

The application does not request location permission and does not use GPS or any other device location service. We do not access your contacts or your microphone, and we do not access your photo library otherwise than as stated above. We do not collect financial account information or biometric information.

3. Sensitive Personal Information

Coordinators may send surveys to you through the application. Certain surveys enquire how you are feeling, by way of a mood selection, a rating, or free text such as what you found difficult. We treat your responses to such surveys as Sensitive Personal Information relating to your mental health, and they are subject to the safeguards set out below.

• Responding to any survey is voluntary. No feature of the application is withheld if you decline to respond.
• Free-text responses to questions designated as sensitive are stored in encrypted form. Coordinators are shown only the number of persons who responded, and not the text of any response.
• Responses to questions designated as private are not displayed alongside your name in any results view or download. Coordinators are shown aggregate figures only.
• Where you request contact from a coordinator, or where a response indicates that you may wish for support, the coordinators of that survey are notified in order that they may reach out to you. This is the only circumstance in which an individual response is brought to the attention of a person.
• We do not use Sensitive Personal Information, including information relating to health, for advertising, for marketing, for profiling or for data mining of any kind. We do not carry advertising on the Services.
• Sensitive Personal Information is not disclosed to any third party. It is stored upon our own servers and is not transmitted to the service providers listed in Section 5.

Certain surveys may be made available by way of a public link and completed without signing in. Such surveys request an email address in order that a partially completed response may be resumed and that a copy of the response may be sent to you. No other information is collected, and a response cannot be retrieved by a person merely by supplying the email address to which it belongs.

4. Purposes for Which Information Is Used

• To create and administer your account and to authenticate you.
• To roster you for events, to record attendance, and to report upon our programmes.
• To assign and coordinate tasks and to share activity material relevant to your work.
• To collect and analyse survey responses in aggregate, and to alert coordinators where support appears to be sought.
• To send you notifications and correspondence concerning the Services.
• To identify and correct faults and to maintain the security of the Services.
• To process donations and to comply with applicable tax and charity law.
• To comply with legal obligations and to respond to lawful requests.

We do not sell, rent or trade Personal Information. We do not use Personal Information in order to train machine-learning models. We do not take automated decisions which produce legal consequences for you.

5. Disclosure of Information

We disclose Personal Information only to service providers engaged to perform functions on our behalf and upon our instructions. Each such provider is bound by contract to protect that information to a standard no lower than that set out in this Policy, and may not use it for its own purposes.

Sensitive Personal Information does not appear in the table above. Survey responses remain upon our own servers and are not disclosed to any service provider.

The identities of the providers we currently engage in each of the above categories will be furnished to you upon request, addressed as stated in Section 11.

We may additionally disclose Personal Information where required by law, or where we believe in good faith that a person is at risk of serious harm and that disclosure is necessary in order to prevent it. Where we make such a disclosure we will inform you, unless prohibited from doing so by law.

Certain of the service providers listed above operate outside India. Where Personal Information is transferred outside India, it is transferred only to a provider subject to the obligations described in this Section.

6. Storage of Information

We process and retain your Personal Information on our own servers, and on the servers of the providers described in Section 5 with whom we have contractual relationships. Certain of those providers operate outside India. Survey responses constituting Sensitive Personal Information are held only on our own servers.

7. Confidentiality and Security

• All communication between your device and our servers is encrypted in transit.
• Free-text responses to survey questions designated as sensitive are stored in encrypted form.
• Authentication tokens are stored within the secure keystore provided by your device, being the iOS Keychain or the Android Keystore.
• Access is restricted by role: coordinators may access the events and surveys which they administer, and not all records.
• Activity material shared through the application is watermarked for each viewer, delivered one page at a time, is not downloadable, and access is verified upon each page requested.
• Sign-in is rate-limited, and accounts are locked temporarily following repeated failed attempts.
• Withdrawal of your role, or deactivation of your account, terminates access immediately.

You have a part in keeping your Personal Information secure. You should not share your sign-in credentials with any person. Where a request reaches us through your credentials we will treat it as authorised by you.

No method of transmission over the internet, and no method of electronic storage, is entirely secure, however. In the event of a breach of Personal Information we will notify you and the Data Protection Board of India as required by law.

8. Retention of Information

9. Deletion of Your Account

You may delete your account at any time from within the application, at Profile → Account settings → Delete account. No request to us and no approval is required.

Upon such a request your access terminates immediately and your account is scheduled for permanent deletion upon the expiry of 30 days. That period exists in order that an inadvertent or unauthorised request may be reversed; signing in again within the period cancels the request. Upon expiry of the period:

• your name, email address, telephone number, date of birth, gender, city, state and languages known are erased;
• your profile photograph, uploaded documents and notification history are deleted;
• the change history relating to your account is deleted;
• survey responses, attendance records and comments are retained, as they form part of the organisation's record of its programmes, but are no longer associated with an identified person.

Should you wish for those records also to be erased, you may request the same and we will comply unless retention is required by law.

Deletion takes effect in our live systems. Where copies of your Personal Information exist in routine backups taken for recovery purposes, those copies are removed as the backups concerned age out of retention, and are not used for any other purpose in the meantime.

10. Your Rights

Subject to the Digital Personal Data Protection Act, 2023, you have the right to:

• obtain confirmation of the Personal Information which we hold concerning you, and a summary of the persons to whom it has been disclosed;
• have inaccurate, incomplete or outdated information corrected or completed, the greater part of which you may edit yourself within the application;
• have your Personal Information erased, as described in Section 9;
• withdraw consent previously given, by declining to respond to surveys, by disabling notifications, or by deleting your account. Consent may be withdrawn as readily as it was given;
• nominate another person to exercise these rights on your behalf in the event of your death or incapacity;
• make a grievance to us, and thereafter to the Data Protection Board of India.

No fee is payable in respect of the exercise of any of these rights, and their exercise will not affect your standing as a volunteer.

These rights may be limited where a request is manifestly unfounded or excessive, where compliance would encroach upon the rights or safety of another person, or where the information requested relates to existing or anticipated legal proceedings. Where we limit a request we will tell you why.

11. Grievance Redressal

Any question concerning this Policy, any request to exercise a right under Section 9, and any grievance may be addressed to our Grievance Officer at [email protected]. We will acknowledge your communication and respond within 30 days, and in any event will resolve grievances within the period of 90 days prescribed by law.

12. Children

The Services are intended for volunteers, coordinators and staff, and accounts are issued by our administrators. They are not intended for children below the age of 18 years, and we do not knowingly create accounts for them. Our programmes work with children; children are not users of the application and we do not collect their Personal Information through it. Should you believe that a child holds an account, please inform us and we will remove it.

13. Third-Party Websites

Our website may contain links to websites operated by others. We are not responsible for the privacy practices of such websites, and you are advised to review their policies.

14. Amendments to This Policy

We may amend this Policy from time to time. Where an amendment is made, this page will be updated and the date stated at the top will be revised. Where an amendment materially affects you, by introducing a new purpose, a new recipient, or a new category of information, we will inform you within the application or by email before it takes effect.

15. Applicable Law

This Policy is governed by the laws of India, and in particular by the Digital Personal Data Protection Act, 2023 and the rules made thereunder. Any dispute arising in relation to it is subject to the exclusive jurisdiction of the courts at Madikeri, Karnataka.

The Services are intended for users in India. The volunteer application is made available only to persons invited by Mind and Matter.

16. Contact Us

Mind and Matter
Kohinoor Road, Madikeri – 571201, Karnataka, India
[email protected]