ARISE · Privacy & data
Your data, and a child’s.
This is the privacy notice of ARISE, a movement of the Rebuild India Foundation, under the Digital Personal Data Protection Act, 2023. It says what we collect, why, how long we hold it, what you can require of us, and the two places where data leaves our hands — both of which are disclosed here in terms.
What we hold, and what we hold it for.
We collect what you give us, for the purpose you gave it for, and we use it for that purpose. Nothing on this site asks you for a payment, and no form here asks for financial credentials.
Enquiries and applications
Your name, email, phone or WhatsApp number, your institution or organisation where relevant, and what you wrote. Used to reply to you, to take your application forward, and to keep the record of that correspondence.
The record of an associate
Identity and contact particulars · your club · course completions and certifications · validated service hours, points and Level · Supporters onboarded and donations mobilised · Honours · and any live entry on the Professional Conduct Register.
Donor and receipt records
What is needed to issue and account for a receipt, and to keep the audited books of the Foundation. Where a PAN is asked for, it is used for the receipt.
The screening file
Identity, references, the declarations required by the youth-protection regime, and the Police Clearance Certificate record. Held because no adult has contact with a child until it is complete. Why
The purposes, listed
To respond to an enquiry and to process an application · to admit, record and recognise an associate · to run a club and a Nurture Centre and keep their registers · to protect children, which includes screening every adult who comes near one · to receipt, account for and audit money · to enter into and administer partnerships · to meet an obligation the law places on us, including reporting obligations under POCSO and the Juvenile Justice Act.
That is the list. We do not sell personal data, we do not rent it, and we do not use it to build advertising audiences.
Consent, asked plainly, at the point of collection.
Our ordinary basis is your consent. It is asked for in clear language, next to the thing it applies to, and it is never assumed from silence or from your continuing to use this site.
Where consent is the basis
Enquiries, applications, association, recognition, giving, and the sharing described in section 05. Consent given for one purpose is not treated as consent for another, and it may be withdrawn.
Where the law is the basis
Certain legitimate uses and legal obligations do not rest on your consent and cannot be withdrawn — principally the safeguarding record, the reporting duties under POCSO and the Juvenile Justice Act, and the accounting and audit record of money received.
How long anything is kept
Enquiry and application records — for the period needed to deal with the enquiry and to keep an honest record of it, then deleted.
The record of an associate — for as long as association subsists. Association does not lapse, so this record is long-lived by design; what a person earned is not erased by the passage of time.
Money records — for the period the law requires of a receipted and audited body, and never less.
Safeguarding records — retained under the youth-protection regime, and expressly not destroyed when a centre closes.
A child’s record — see section 04. A child’s Ankur record is reviewed when that child attains eighteen.
The full retention schedule sits in the movement’s data, privacy and records policy. Where a period there reads “as the law requires”, that is what it means — as the law requires, and never less. Where a period is not yet settled, we would rather tell you so than print a number we cannot stand behind. It is set centrally and published before it applies.
A note on the records themselves: digital records are authoritative for course completion and platform registration. Paper remains the record for attendance, service hours, consents and money until the technology backbone is deployed.
Five things you can require of us.
These are yours under the Act. You do not need a reason, and asking costs nothing.
Access
A summary of the personal data we hold about you, what we are doing with it, and who else has received it.
Correction
To have what is wrong corrected, what is incomplete completed, and what is out of date updated.
Erasure
To have your data erased, except where we are required by law to keep it — and where that exception applies, we will tell you which record it is and why.
Withdrawal of consent
To withdraw a consent you gave, at any time, as easily as you gave it. Withdrawal stops the future use; it does not undo what was lawfully done before.
Nomination
To nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
And a grievance
If we handle your data badly, say so. The Data Protection Contact answers first; the Grievance Officer is the route if you are not satisfied. Neither route bars you from the Data Protection Board.
How to reach the Data Protection Contact. The Data Protection Contact is one of the six named role-holders of the movement, and the post is never left vacant while a centre operates. Use the data-protection route on the contact page, or write to the registered office — Rebuild India Foundation, Noble International School, Marenahalli Bande Road, Marenahalli, Jala Hobli, Bangalore – 562149, marked for the Data Protection Contact. The current holder’s name and number are published at every Nurture Centre and given to every parent.
A child’s data is held to a stricter rule than anyone’s.
Children of classes 6 to 10 attend our centres. Their data is taken under verifiable parental consent as section 9 of the Act requires, held by the fewest people who need it, and used for the child and for nothing else.
Never, for any child, at any time: tracking · behavioural monitoring · profiling · targeted advertising directed at a child. Not now, not later, not under any partnership, and not with any parent’s permission — because it is not ours to ask for.
| Consent | What it covers | When |
|---|---|---|
| A · Enrolment and participation | The child’s particulars, the emergency contact, and the persons to whom the child may be released | Once, at enrolment |
| B · Photography and media | What may be made, for what use, for how long, and where it may appear | Once, at enrolment |
| C · Off-site activity and transport | This occasion only — destination, timings, the adults named, the transport, the driver and the vehicle, the ratio, departure and return | Afresh for each occasion |
| D · Medical and emergency | Allergies, conditions, medication and its administration, consent to emergency treatment, and who is contacted first | Once, refreshed on change and at least annually |
Swipe the table sideways →
What a refusal means, and what a parent may do
A refusal is never held against a child or a family, and is never mentioned to the child. A child without consent A does not attend. A child without consent B attends and is not photographed. A child without consent D attends, and the absence is flagged on the emergency contact list. The Centre Mentor confirms the consents are on file before a child attends.
Consent is taken in a language the parent reads, and read aloud where the parent does not read — and the fact that it was read is recorded.
A parent may attend at any time, may withdraw any consent at any time, and has access to the records concerning their child. A child may leave at any time, without notice and without consequence, and may return.
At enrolment every parent is given the names and contact particulars of the safeguarding role-holders and the reporting routes that bypass ARISE entirely.
The means of verifying parental consent under section 9 will follow the Rules made under the Act.
Ankur — a child’s assessment record, and the three people who see it
Ankur is the child baseline instrument at a Nurture Centre. It is taken when a child joins and again each term, and it is reported as change and never as a grade — what has moved for this child against this child’s own baseline, and nothing else. No mark, no rank, no comparison between children.
A child’s Ankur record is seen only by the associate teaching that class group, the Centre Mentor, and the Centre.
It is never shared with an employer, a partner, a school, a donor, or any person outside the centre. It is never used in the recognition of a club, an associate or a centre — no point, no Level, no Booster and no award is computed from it. A parent may see their child’s record at any time, and it is explained to them in person. The record is reviewed when the child attains eighteen.
The one place adult data goes outside.
An associate’s formation can open a door to work. That is one of the four doors of this movement, and it only works if a company can see something real. So this must be said plainly rather than buried.
The four adult instruments of Vyakti Darpan — Prerak, Udaan, Setu and Acharya — may be shared with employers, with safeguarding riders. They are sensitive personal data under the law in force today, and they are treated as such. They go as complementary input to the attribute validation report for a named candidate — with the associate’s own consent, separately given and separately withdrawable, and never without disclosure to the associate.
What the attribute validation report is, and what it never contains
The attribute validation report is furnished to an Earn Partner on a referral, in respect of a named candidate only, on a prescribed pro-forma. It is a pure derivation layer: every statement in it derives from a certified course or a validated service record. The four adult instruments are complementary input to it.
What the report never contains: any child’s data · any data of another associate · any assertion not traceable to a certified or validated record · the Professional Conduct Register status, which is confirmed only separately, on request, for a named candidate, under separate consent, and with the associate’s own response alongside it.
The characterisation of these instruments against the sensitive-personal-data rules in force is one of the standing legal items under counsel, and it is worked before another candidate record reaches a company.
Where data does not go — the limits that hold
To a Privilege Partner: nothing. No associate data passes to a brand extending privileges — no list, no contact details, no record. It sees a Level credential presented by the associate and nothing more, and neither party may represent an endorsement of the other.
To a college or a host: nothing about an individual beyond what the club’s own working requires. Each Club Host Partner receives a termly report on its own club.
To a donor: nothing about a person. A donor receives a receipt and an account of the work. No child’s record and no associate’s record is ever shown to a donor.
Between service providers. Ordinary operational processors — the platform, hosting, email, form handling and payment gateways — process data on our instructions and for no purpose of their own.
What this site itself does.
Forms
Every form on this site is submitted with an explicit consent tick, and reaches the movement’s own inbox. ARISE requests no payment on this site.
Images of a centre
No image or particular of a child is published except under the photography consent and its conditions. See press and media.
Security
Access to records is limited to those whose role requires it. Safeguarding and children’s records are held apart from ordinary operational data.
This notice states, in the terms a reader needs, the data and privacy rules of the movement. The policy behind it carries the DPDP regime in full, and where this page and that policy differ, the policy governs. What governs ARISE
Ask us about your data.
Access, correction, erasure, withdrawal or nomination — use the data-protection route and it reaches the Data Protection Contact.