UNIVERSAL DATA PROTECTION POLICY

1. Introduction

Welcome to Just Help Me Foundation (JHMF). Just Help Me Foundation is committed to protecting the privacy, confidentiality, integrity, and security of all personal information entrusted to the Foundation by members, donors, volunteers, beneficiaries, employees, applicants, partner organizations, service providers, visitors, and every other individual or entity interacting with the Foundation through its official digital platforms.

This Universal Data Protection Policy establishes the Foundation's principles, standards, governance framework, and responsibilities for the lawful collection, processing, storage, use, disclosure, retention, transfer, protection, and disposal of personal information. The Foundation recognizes that responsible data protection is fundamental to maintaining public trust, ensuring regulatory compliance, protecting individual rights, and supporting transparent charitable administration.

By accessing, browsing, registering, donating, volunteering, applying for employment, seeking membership, creating an account, or using any official digital platform of Just Help Me Foundation, every user acknowledges that they have read, understood, and accepted this Universal Data Protection Policy together with the Foundation's Privacy Policy, Terms and Conditions, Cookie Policy, and all other officially published organizational policies.

2. Scope of this Data Protection Policy

This Universal Data Protection Policy applies to all personal information, sensitive personal data, digital records, biometric data where collected, financial details, identification records, communication logs, technical data, and any other data processing activity carried out by Just Help Me Foundation across all physical offices, digital platforms, cloud services, software applications, databases, and communication channels.

Without limitation, this Policy currently applies to the following official domains:

This Data Protection Policy shall automatically extend to every present and future domain, website, mobile application, software platform, cloud infrastructure, payment portal, API, database system, artificial intelligence system, digital verification service, or any other digital property officially owned, operated, managed, licensed, or authorized by Just Help Me Foundation without requiring a separate Data Protection Policy for each platform.

3. Principles of Data Protection

Just Help Me Foundation adheres to internationally recognized data protection principles to ensure that personal information is handled responsibly, lawfully, and transparently:

• 1. Lawfulness, Fairness, and Transparency: Personal information shall be collected and processed lawfully, fairly, and in a transparent manner in relation to the data subject.
• 2. Purpose Limitation: Personal information shall be collected only for specified, explicit, legitimate, and lawful charitable, administrative, legal, or operational purposes and shall not be further processed in a manner incompatible with those purposes.
• 3. Data Minimization: The collection of personal information shall be adequate, relevant, and limited to what is strictly necessary in relation to the purposes for which it is processed.
• 4. Accuracy and Quality: The Foundation shall take reasonable steps to ensure that personal information is accurate, complete, up to date, and corrected or deleted when errors are identified.
• 5. Storage Limitation: Personal information shall be retained only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, or satisfy legitimate organizational requirements.
• 6. Integrity and Confidentiality: Personal information shall be processed using appropriate technical, organizational, physical, and administrative security measures to protect against unauthorized or unlawful processing, accidental loss, destruction, alteration, disclosure, or damage.
• 7. Accountability: The Foundation assumes responsibility for complying with these principles and demonstrating compliance through appropriate documentation, policies, controls, and oversight mechanisms.

4. Categories of Personal Data Collected

Depending upon the nature of interaction with Just Help Me Foundation, the Foundation may collect, store, and process various categories of personal information, including:

• 1. Identity and Contact Data: Full name, date of birth, gender, marital status, nationality, photograph, residential address, email address, telephone number, emergency contact details, parent/spouse names, and official identification numbers (such as Aadhaar, PAN, Passport, Voter ID, or Driving License where legally permissible and voluntarily provided).
• 2. Membership and Application Data: Membership identification number, application history, membership category, qualification details, professional background, organizational affiliation, references, volunteer history, award nominations, and committee assignments.
• 3. Financial and Transaction Data: Payment records, transaction reference numbers, donation amounts, bank account details for refunds or disbursements, transaction receipts, tax exemption details, and billing information.
• 4. Employment and Recruitment Data: Curriculum Vitae (CV), resume, educational certificates, work experience records, salary expectations, interview evaluation notes, background verification reports, reference checks, appointment letters, and attendance records.
• 5. Technical and Usage Data: IP address, browser type, operating system, device identifier, geolocation data (where enabled), access timestamps, referral URLs, page views, cookie identifiers, and digital platform usage patterns.
• 6. Communication and Support Data: Correspondence, emails, support tickets, feedback forms, survey responses, phone call logs, social media interactions, and grievance submissions.

5. Lawful Bases for Data Processing

Just Help Me Foundation processes personal information only when authorized by applicable law under one or more of the following lawful bases:

• 1. Consent: Where the data subject has given explicit, informed, and voluntary consent for specific processing activities.
• 2. Legal Obligation: Where processing is necessary to comply with applicable statutory laws, tax regulations, anti-money laundering requirements, judicial orders, or regulatory obligations governing nonprofit organizations.
• 3. Contractual Necessity: Where processing is necessary for the performance of a contract, membership agreement, employment agreement, volunteer commitment, or donation transaction to which the data subject is a party.
• 4. Legitimate Interests: Where processing is necessary for legitimate charitable, operational, administrative, security, governance, fraud prevention, or public service purposes pursued by the Foundation.
• 5. Public Interest and Charitable Mission: Where processing is necessary for the performance of humanitarian service, disaster relief, public welfare activities, environmental protection, or community development undertaken in the public interest.

6. Data Security and Encryption Controls

Just Help Me Foundation implements comprehensive technical, administrative, physical, and organizational security measures to protect personal information against unauthorized access, cyber threats, data breaches, accidental loss, alteration, disclosure, or destruction. Security measures include:

• 1. Encryption of sensitive personal data during transmission over public networks using industry-standard cryptographic protocols (TLS/SSL).
• 2. Secure storage of personal data on access-controlled servers, cloud databases, and firewalled storage infrastructure.
• 3. Access controls based on the principle of least privilege, ensuring that only authorized personnel with a legitimate operational need can access personal information.
• 4. Multi-factor authentication, strong password requirements, and credential protection for administrative logins, database systems, and member portals.
• 5. Regular vulnerability assessments, system updates, security patches, network monitoring, and malware protection.
• 6. Physical security controls for office premises, server rooms, document archives, and physical records.
• 7. Periodic security awareness training for employees, volunteers, office bearers, and system administrators.

7. Data Sharing and Third-Party Disclosures

Just Help Me Foundation respects individual privacy and does NOT sell, lease, rent, trade, or commercially exploit personal information under any circumstances.

Personal information may be shared or disclosed only under strict confidentiality obligations in the following circumstances:

• 1. Authorized Service Providers: With trusted cloud host providers, software vendors, payment gateway processors, SMS gateway providers, email service providers, and IT support teams under strict contractual confidentiality and security agreements.
• 2. Banking and Financial Institutions: With authorized banks, payment processors, financial auditors, and taxation authorities for processing donations, fee payments, refunds, tax receipts, or financial audits.
• 3. Government and Regulatory Authorities: With competent government departments, law enforcement agencies, tax authorities, judicial bodies, or regulatory institutions when mandated by law.
• 4. Partner Organizations: With partner NGOs, educational institutions, CSR partners, or government agencies collaborating on specific charitable projects under written confidentiality agreements.
• 5. Legal Defense and Protection: When necessary to protect the legal rights, safety, property, cybersecurity, financial integrity, or public reputation of Just Help Me Foundation.

8. International Data Transfers

Where personal information is transferred to, stored in, or processed in servers, cloud infrastructure, or locations outside the country of origin, Just Help Me Foundation shall make reasonable efforts to ensure that appropriate data protection safeguards, contractual controls, and legal mechanisms are maintained.

International transfers shall occur only to cloud service providers or technology platforms that maintain data security standards comparable to applicable law or where the transfer is authorized by explicit consent or legal necessity.

9. Data Retention and Disposal

Just Help Me Foundation retains personal information only for as long as necessary to fulfill the specific purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, enforce agreements, satisfy accounting standards, or support legitimate historical and archival needs.

• 1. Membership Records: Retained during the active period of membership and for a reasonable administrative period after resignation, expiry, or termination.
• 2. Financial & Donation Records: Retained for the statutory period required under applicable tax, accounting, and financial laws (typically 7 to 10 years).
• 3. Employment & Recruitment Data: Candidate applications retained for recruitment cycles; personnel records retained as required by labor laws.
• 4. Support Correspondence: Retained for as long as necessary to address inquiries, resolve tickets, or fulfill service requests.

Upon expiration of the applicable retention period, personal information shall be securely deleted, overwritten, shredded, or permanently anonymized.

10. Data Subject Rights

Subject to applicable law, every individual whose personal information is collected or processed by Just Help Me Foundation enjoys certain data protection rights:

• 1. Right to Information: Right to be informed about data collection, usage, and protection.
• 2. Right of Access: Right to request confirmation of data processing and copies of personal data held.
• 3. Right to Rectification: Right to request correction or updating of inaccurate personal data.
• 4. Right to Erasure / Deletion: Right to request deletion of personal data where processing is no longer necessary.
• 5. Right to Restrict Processing: Right to request restriction of processing under certain circumstances.
• 6. Right to Data Portability: Right to receive personal data in a structured, commonly used format.
• 7. Right to Withdraw Consent: Right to withdraw consent for voluntary processing activities at any time.
• 8. Right to File a Grievance: Right to lodge a complaint regarding data processing through the Data Protection Officer.

11. Data Protection Assessments & Breach Management

The Foundation conducts Data Protection Impact Assessments (DPIA) for elevated risk deployments. In the event of a confirmed data breach involving personal data, the Foundation shall take immediate containment measures, risk evaluation, and notify affected individuals and regulatory authorities as required by law.

13. Children's Data, Cookies, Amendments & Final Declaration

The Foundation does not knowingly collect personal data directly from children under 18 without verified guardian consent. Cookie usage is detailed in the Universal Cookie Policy.

Governed by applicable statutory laws. Continued access to JHMF platforms following updates constitutes acceptance of this Universal Data Protection Policy.