Privacy Policy

1. Introduction & Applicability

Welcome to NGO ERP Platform ("Platform", "Application", "we", "our", or "us"), owned and operated by SCITW Pvt. Ltd. / Samrat ERP. We are committed to protecting the privacy, confidentiality, and statutory integrity of the Non-Governmental Organizations (NGOs), Charitable Trusts, Registered Societies, Section 8 non-profit companies, their authorized administrators, staff members, volunteers, donors, and beneficiaries.

This Privacy Policy governs your use of both our Android Mobile Application (available on the Indus Appstore and Google Play Store) and our Web Portal located at https://ngo.samraterp.com. This policy has been formulated in strict compliance with:

• The Information Technology Act, 2000 (India) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• The Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
• The Indus Appstore Developer Content Policy & User Data Guidelines regarding user privacy, device permissions, and account deletion.

2. Mobile Device Permissions Requested

To provide core ERP functionality on mobile devices, our Android application requests only the minimum necessary runtime permissions. Each permission is used solely for the explicit functionality described below and is only triggered by deliberate user action:

3. Information We Collect

We collect and process only the information required to deliver enterprise resource planning, automated statutory receipts, and organizational governance:

A. Organization & Account Information

• NGO Name, Registration Type (Trust, Society, Section 8, etc.), and official contact details.
• NITI Aayog NGO-DARPAN ID, Registration Number, and Official Registered Address.
• Statutory registrations: Section 80G and 12A registration numbers, NGO PAN, and Authorized Signatory details.
• Administrator credentials: Name, official email address, encrypted password, and mobile number.

B. Member, Donor & Financial Records (Input by Tenant)

• Donor Information: Donor Name, Email, Phone number, Address, and Permanent Account Number (PAN) required by the Income Tax Department of India for issuing Section 80G tax exemption certificates and Form 10BD annual compliance filings.
• Donation Transactions: Amount, donation mode (Cash, UPI, Cheque, Bank Transfer, or Online Gateway), transaction reference, and date.
• Staff & Beneficiary Data: Voluntary records entered by organization administrators (e.g. employee attendance, volunteer designations, relief distribution tracking).
• Vouchers & Accounting: Income, expense ledgers, and attached bills/receipt images.

C. Technical & Operational Logs

• IP address, device OS version, app version, and login timestamps recorded for security audit logs and fraud prevention.
• Session authentication tokens (stored securely in encrypted app storage).

4. How We Use Collected Information

All information is processed strictly for legitimate, authorized organizational purposes:

• Statutory Receipt Generation: Automatically generating and issuing tamper-evident 80G tax receipts and donation vouchers.
• Accounting & Reporting: Preparing automated Cash Books, Bank Passbooks, and Annual Reports.
• Automated Communication: Delivering transaction receipts to donors via Email and WhatsApp (when enabled by the NGO).
• Security & Audit Integrity: Detecting unauthorized access, preventing account hijacking, and maintaining unalterable audit trails.

5. Third-Party Service Providers

We do not sell, rent, or trade your data or donor lists to any third party for advertising or marketing. We work only with vetted, enterprise-grade service providers to execute required functions:

• Razorpay Software Private Limited: Utilized for processing subscription fees and online donation collections. Payment data (credit/debit cards, UPI MPIN, net banking) is processed directly by Razorpay under RBI guidelines and PCI-DSS Level 1 compliance; sensitive card numbers or PINs are never stored on our servers.
• Meta WhatsApp Cloud API / Transactional SMS: Used exclusively to deliver electronic donation receipts and verification OTPs requested by authorized users.
• Cloud Infrastructure: Hosted in highly secure data centers located within India, adhering to strict data sovereignty and local compliance standards.

6. Data Security & Storage Practices

We implement comprehensive administrative, physical, and technical safeguards:

• 256-Bit SSL/TLS Encryption: All data transmitted between the mobile app, web browser, and server APIs is encrypted using modern TLS protocols.
• Password Security: Passwords are cryptographically hashed using salted bcrypt algorithms and are unreadable by system administrators.
• Multi-Tenant Database Isolation: Built-in tenant scoping prevents any cross-tenant data leaks.
• Regular Backups: Automated daily backups with encryption at rest to prevent data loss.

7. User Rights & Data / Account Deletion Procedure

In compliance with the Indus Appstore Developer Policy and Indian data privacy regulations, users and organization administrators have the right to review, update, or permanently delete their personal and organizational data:

How to Request Account & Data Deletion

If you wish to delete your user account, staff profile, or entire organization tenant data, you can initiate a deletion request through either of the following methods:

1. Email Request: Send an email from your registered administrator email address to support@scitw.in with the subject line "Data Deletion Request - [Your Organization DARPAN ID]".
2. Online Support Portal: Submit a high-priority ticket via our dedicated support page at https://ngo.samraterp.com/support.

Processing Timeline: Deletion requests are acknowledged within 48 hours. Upon verification of the authorized signatory, all personal credentials, member profiles, and digital files will be permanently purged from active databases within 30 calendar days.

Note: Under the Indian Income Tax Act (1961) and Rules governing Section 80G / Form 10BD filings, NGOs are legally obligated to maintain historical donor receipt records for statutory audit periods. Transactional records mandated by law will be retained in accordance with applicable statutory periods.

8. Children's Privacy

Our services are enterprise management tools designed for adult representatives and authorized officers of non-governmental organizations. We do not knowingly solicit or collect personal information directly from children under the age of 18. Beneficiary records of minors may only be entered by authorized NGO officers with legitimate parental or institutional consent.

9. Grievance Redressal Officer (Indian IT Act Compliance)

In accordance with the Information Technology Act, 2000, the Intermediary Guidelines Rules, 2021, and the Digital Personal Data Protection Act, 2023, the contact details of our designated Grievance Officer are provided below: