DPDP Act 2023 & CBDT Statutory Compliant

Privacy Policy & Statutory Consent Disclosure

Document Ref: DOC-IF-PRIVACY-2026-V1 • Effective Date: October 5, 2026 • Classification: Public Regulatory Disclosure

1. Scope & Multi-Tenant Operating Architecture

ImpactFlow ("ImpactFlow", "Platform", "we", "us") operates an enterprise multi-tenant operating system designed for Non-Governmental Organizations (NGOs), Section 8 non-profit companies, public charitable trusts, Farmer Producer Organizations (FPOs), Corporate CSR entities, and accredited Chartered Accountant (CA) audit firms.

This Privacy Policy describes our mandatory data collection, cryptographic verification, processing, retention, and deletion practices across our central domains (impactflow.site, hub.impactflow.site) and tenant NGO portals ({tenant}.impactflow.site).

Multi-Tenant Data Isolation Guarantee: Each participating non-profit organization operates in a strictly isolated database container. Central platform administrators, neighboring NGOs, and external users cannot query or inspect donor PII, Permanent Account Numbers (PANs), or banking credentials of any other tenant.

2. Statutory Grounding & Governing Laws

All personal data processing, cryptographic hashing, and certificate generation executed by ImpactFlow is legally grounded in specific statutory mandates under Indian and international public compliance frameworks:

  • Digital Personal Data Protection Act (DPDP Act, 2023) — Sections 4, 6, 7 & 8: Transparent purpose specification, explicit verifiable consent, and robust technical measures.
  • Income Tax Act, 1961 — Sections 12A, 80G(5)(vi), 139A, and Rule 18AB: Mandatory collection of donor PAN/Govt ID for 80G deductions and annual filing of Form 10BD with the CBDT.
  • Foreign Contribution (Regulation) Act, 2010 (FCRA) & 2020 Amendments — Section 17: Regulatory mandate requiring foreign remittances to route exclusively through the State Bank of India (SBI) New Delhi Main Branch (NDMB) account.
  • Information Technology Act, 2000 & 2021 Intermediary Rules — Sections 43A and 72A: Implementation of reasonable security practices and procedures for sensitive personal data.
  • Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 — Regulations governing authorized OTP e-KYC without local plain-text UID storage.
  • International Standards: EU/UK General Data Protection Regulation (GDPR / UK DPA 2018) and US 501(c)(3) Internal Revenue Code rules for international multi-jurisdiction tenants.

3. Categories of Data Collected & Purpose of Processing

We do not collect unnecessary data. Every field collected is tied to an explicit statutory requirement:

Stakeholder Persona Data Points Collected Statutory Purpose
Individual & Institutional Donors Name, Email, Mobile, PAN (mandatory > ₹50,000), Address, Donation Amount, Payment Reference (UPI / UTR). Issuance of valid Section 80G tax receipts and generation of the statutory Form 10BD statement filed with the Income Tax Department.
NGO Trustees & Authorized Signatories Legal Name, Designation, Official Email, Phone, PAN, Trust Deed/Registration Number, 80G/12A URNs, FCRA Registration, Bank Details. Identity verification to prevent ghost NGOs, automated digital signature affixation on tax certificates, and verification of Section 12A exemption status.
Corporate CSR Donors Company Name, Corporate Identity Number (CIN), Corporate PAN, CSR Committee Signatories, Milestone Allocations. Bilateral CSR Grant Agreement execution under Companies Act 2013 Section 135 and Schedule VII statutory utilization reporting.
Chartered Accountants & Auditors CA Name, ICAI Firm Registration Number (FRN), Membership Number, Official Audit Review Sign-Off Logs. Statutory audit trail governance, independent sign-off verification, and export packaging for Tally and Zoho Books reconciliation.

4. DigiLocker & Ephemeral Aadhaar/PAN Verification

During organization onboarding, authorized signatories may authenticate via Government of India DigiLocker / API Setu services. ImpactFlow operates a Zero-Plaintext-UID Architecture:

  • No Plaintext Aadhaar Storage: The platform never stores full 12-digit Aadhaar numbers in databases, logs, or cache. Only masked representations (XXXX-XXXX-1234) are recorded.
  • Ephemeral OTP Verification: OTPs and biometric vectors are processed exclusively by UIDAI / DigiLocker endpoints and never touch or reside on ImpactFlow server disks.
  • Cryptographic Consent Artefact: Each verification creates an immutable, timestamped consent receipt containing the signatory's name, verification timestamp, scope, and SHA-256 digest.

5. Statutory 8-Year Retention Mandate

Under the Income Tax Act, 1961 (Section 149) and FCRA Rules, charitable trusts and non-profit institutions are legally obligated to maintain complete books of accounts, donation registers, donor identity records, and bank statements for a statutory period of not less than eight (8) assessment years.

Mandatory Legal Hold: If an organization terminates its ImpactFlow subscription, operational access to portals is frozen, but statutory financial records (80G receipts, Form 10BD filings, FCRA foreign remittance logs) remain retained in read-only encrypted vault storage until the statutory 8-year limitation period elapses, after which automated cryptographic scrubbing is executed.

6. Cryptographic Hash Anchoring & Public Trust Engine

ImpactFlow computes a deterministic SHA-256 cryptographic hash for every issued donation receipt, Form 10BD batch, and auditor sign-off. These hashes are aggregated into Merkle trees and anchored to immutable public ledgers.

Zero PII Exposure on Chain: Only the irreversible mathematical hash (digest) is anchored. Neither donor names, PANs, addresses, nor donation amounts are ever published to the public blockchain, ensuring total privacy alongside verifiable mathematical immutability.

7. Cookie Norms, Telemetry & Multi-Jurisdiction Controls

ImpactFlow deploys a multi-jurisdiction cookie consent engine:

  • Strictly Necessary Cookies: Required for multi-tenant domain resolution, session authentication, and CSRF protection. Always active.
  • Analytics & Performance: Optional aggregated usage telemetry used strictly to benchmark system latency and optimize server performance.
  • Marketing & Identity Providers: Third-party integrations (such as Google One-Tap) are dynamically suppressed in GDPR jurisdictions until affirmative opt-in is granted.
  • Right to Withdraw: Users can adjust or revoke cookie consent at any moment via the persistent privacy trigger located in the bottom-left corner of any page.

8. Data Principal Rights (DPDP Act, 2023)

All individuals whose data is processed within ImpactFlow possess the following statutory rights under the DPDP Act 2023:

Right to Access: Request a summary of personal data and processing activities.
Right to Correction: Update inaccurate PAN, contact, or address information.
Right to Erasure: Request deletion of data subject to statutory 8-year tax retention bounds.
Right of Grievance Redressal: Expedited dispute resolution through our designated Grievance Officer.

9. Grievance Redressal Officer & Statutory Contact

In compliance with Section 10 of the DPDP Act 2023 and the Information Technology (Intermediary Guidelines) Rules, the designated Data Protection & Grievance Officer for ImpactFlow is:

Meera Iyer, Lead Grievance & Compliance Officer

Entity: ImpactFlow Technologies Private Limited

Address: Compliance & Governance Wing, Cyber City, DLF Phase 2, Gurugram, Haryana 122002, India

Direct Email: dpo@impactflow.in / grievance@impactflow.in

Statutory Response SLA: Formal acknowledgment within 48 hours; complete resolution within thirty (30) calendar days.