SAIESA — St. Andrew's Institute Ex-Student's Association, home

Privacy Policy

How SAIESA collects, uses, and protects member data.

St. Andrew's Institute Ex-Students' Association (SAIESA)
Registration No. 18/GOA/2025
Last Updated: September 1, 2026

This Privacy Policy describes how the St. Andrew's Institute Ex-Students' Association ("SAIESA", "we", "us", or "our"), operating as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (India) and the Information Technology Act, 2000, collects, processes, and safeguards the personal data of its members, donors, and visitors.

1. Scope & Applicable Persons

This policy applies to the website (saiesa.org) and the digital services managed by SAIESA, including membership registration, directories, community forums, event ticketing, and donation processing.

Members may only submit personal details belonging to third parties (such as classmates or batchmates) where they have obtained the prior informed consent of the individual concerned.

2. Personal Data We Collect

We collect data solely for specified, lawful purposes:

  • Identity & Account Information: Full name, registered email address, mobile number, cryptographic salted password hash (passwords are never stored in plain text), and membership validation status.
  • Alumni & Academic Profile: Years of attendance, batch/graduation year, professional designation, employer, public biography, profile image, and association committee roles.
  • User-Generated Content: Posts, public comments, chat messages within designated rooms, and survey/idea submissions.
  • Media Assets: Documents and images uploaded directly to secure cloud object storage (Cloudflare R2).
  • Technical Audit Data: Essential session identifiers, IP addresses, browser user-agent strings, and security event logs to prevent unauthorized access and abuse.
  • Statutory Donation & Financial Records: Donor full name, billing address, email, telephone number, payment transaction ID, and Permanent Account Number (PAN) or equivalent Government ID where mandatory for filing Form 10BD under the Income Tax Act, 1961. Payment instrument details (credit cards, debit cards, UPI credentials) are captured directly by certified PCI-DSS-compliant payment aggregators and are never stored or handled on SAIESA servers.

3. Purpose and Legal Basis for Processing

We process personal data on the grounds of affirmative consent and statutory obligation for the following purposes:

  • Authenticating member access, verifying alumni credentials, and managing accounts.
  • Facilitating the alumni directory, community forums, and event management.
  • Generating mandatory statutory receipts and meeting CBDT Form 10BD tax-filing obligations for financial donations.
  • Enforcing association bylaws, site terms, and cybersecurity integrity.
  • Communicating institutional notifications, reunions, and membership updates.

SAIESA does not sell, rent, monetize, or trade personal data to any commercial third parties or external advertising networks.

4. Data Sharing & Third-Party Processors

Personal data is disclosed only under strict role-based controls:

  • Alumni Directory: Visible exclusively to authenticated and approved SAIESA members, subject to the privacy and visibility toggles you configure within your profile.
  • Public Visibility: Limited solely to minimal biographical data that you explicitly designate as "Public".
  • Data Processors: Infrastructure and cloud hosting providers (e.g., Cloudflare for edge routing/storage, Neon for database storage) acting strictly on instructions from SAIESA under binding data protection commitments.
  • Legal Disclosures: Where required by an enforceable court order, regulatory direction, or statutory tax authority.

5. Cookies & Session Storage

We use strictly functional, essential session cookies required for authentication and platform security. We do not operate third-party tracking pixels, advertising cookies, or cross-site profiling technologies.

6. Data Retention & Deletion

  • General Member Data: Retained for the duration of an active membership, plus a reasonable archival period unless an explicit erasure request is received.
  • Statutory Records: Financial contribution data, transaction ledgers, donor identity records (including PAN), and immutable administrative audit logs are retained for a minimum mandatory statutory period of eight (8) financial years to satisfy Indian income tax, society audit, and FCRA regulations.

7. Rights of the Data Principal

Under the Digital Personal Data Protection Act, 2023, you retain the following statutory rights:

  • Right to Access & Review: View the personal data held about you via your profile dashboard.
  • Right to Correction & Updating: Correct or complete any inaccurate or obsolete personal information.
  • Right to Erasure: Request deletion of non-statutory personal data.
  • Right to Withdraw Consent: Withdraw previously granted consent for communications or directory listings.
  • Right of Grievance Redressal: Lodge inquiries or disputes with our designated Grievance Officer.

8. Age Restriction & Protection of Minors

This platform is restricted to individuals aged 18 years or older. SAIESA does not knowingly collect or profile data belonging to minors. Any account discovered to belong to an individual under 18 years of age without verified parental authorization will be removed immediately.

9. Technical & Organizational Security Measures

We implement standard industry safeguards, including TLS/HTTPS encryption in transit, strict role-based access control (RBAC), and server-side session revocation. In the event of a verified data breach impacting personal data, SAIESA will notify the Data Protection Board of India and affected users in compliance with prevailing legal guidelines.

10. Grievance Officer & Statutory Contact Details

For any privacy inquiries, requests to exercise statutory data rights, or notices regarding data processing, contact our designated Grievance Officer:

  • Designation: Data Grievance Officer, SAIESA
  • Email: saiesa2025@gmail.com
  • Registered Address:
    St. Andrew's Institute Ex-Students' Association (SAIESA),
    C/O St. Andrew's Institute, Near St. Andrew's Church,
    Vasco da Gama, Goa – 403802, India.

If a grievance is not addressed within thirty (30) business days, Data Principals maintain the right under the DPDP Act to submit a complaint to the Data Protection Board of India.