This policy explains the personal data handled through this website, why it is used, and the choices available to you. It is written to reflect the Digital Personal Data Protection Act, 2023, its notified framework, and other applicable Indian law as they come into force.
1. Who we are and scope
Reservation Hatao Movement (“RHA”, “we”, “us” or “our”) operates reservationshataomovement.com as an independent citizen initiative. This policy applies to the public website, supporter registration, contact form, donation-submission and status pages, downloadable certificates, and the related administration system.
For privacy questions or requests, email reservationhataomovement@protonmail.com.
2. Information we collect
We collect only information that you provide or that is reasonably required to operate and secure the website.
- Supporter and petition registration: name, mobile or WhatsApp number, city, State or Union Territory, optional email address, registration or signature time, supporter/signature number, petition version and a protected slip-access token.
- Contact messages: name, email address, optional mobile number, subject, message, submission time, status, and reference number.
- Donation verification: donor name, mobile number, optional email, amount, UPI transaction reference or UTR, submission and review times, status, and a secure status token. We do not ask for or store your UPI PIN, bank password, card number or bank-login credentials.
- Technical and usage data: IP address, browser or device user-agent, requested path, referring page, selected language, visit time, and limited interaction counters such as certificate or social-sharing actions.
- Session data: a necessary session cookie is used for security, form validation, language flow and protected administration. We do not use advertising cookies on this website.
3. Why we use information
We process information to perform the action you request, operate the movement website, protect it from abuse, maintain reliable records, and meet applicable legal obligations.
- Register supporters, record a voluntary petition signature, and issue or re-create supporter certificates and petition signing slips.
- Respond to enquiries, partnership or media messages.
- Review donation submissions, prevent duplicate or fraudulent claims, display secure status, and issue acknowledgements after approval.
- Measure aggregate reach and improve language, accessibility, content and performance.
- Secure forms and the admin area, investigate misuse, preserve system integrity, and comply with lawful requests.
4. Consent and your choices
You provide information voluntarily when you submit a form. You may choose not to submit personal data, but the requested registration, enquiry response, donation review or certificate may then be unavailable.
You may withdraw consent for future processing by contacting us. Withdrawal does not invalidate processing already carried out, and some records may need to be retained where required by law, security, fraud prevention or the establishment or defence of legal claims.
5. How information is shared
We do not sell or rent personal data. Access is limited to authorised movement administrators and service providers that support hosting, security, database operations or communications, only to the extent reasonably necessary.
We may disclose information when required by law, court order or a valid request from a competent authority; to protect users, the website or our legal rights; or as part of an organisational transition with appropriate safeguards and notice where required.
Links to Instagram, X, UPI applications, banks or other third-party services open services controlled by those providers. Their own privacy terms apply to information they receive.
6. Public visibility
Mobile numbers, email addresses, contact messages, UTRs and donation status tokens are not intended for public display. A supporter name, supporter number, city, State and certificate content may appear on a certificate created at the supporter’s request and may become public only if the supporter downloads or shares it.
The public certificate-recovery page uses the registered mobile number or email address as a lookup credential. A person who knows that information may be able to retrieve the associated certificate, which contains the supporter name, number, city and State. Do not use another person’s details or share your lookup information unnecessarily.
Do not post a secure donation-status link publicly. Anyone who receives that link may be able to view the limited status information associated with it.
7. Retention
We retain information only for as long as reasonably necessary for the purpose described in this policy and then delete, anonymise or securely archive it. In general, unresolved contact messages are kept while they are being handled and may be retained for up to 24 months after resolution; routine visitor logs may be retained for up to 12 months; supporter records remain while the supporter registry and certificate service are active; and donation records are retained for the period required for verification, accounting, audit, fraud prevention and applicable law.
Petition signatures remain while the petition record and verification service are active, unless a valid deletion request or applicable legal requirement requires a different result. Security backups may retain a protected copy for a limited additional period before automatic deletion.
8. Security
We use reasonable administrative and technical safeguards, including restricted administration, password protection, session controls, request validation, anti-spam measures and database access controls. No internet transmission or storage system can be guaranteed completely secure. Please do not send passwords, UPI PINs, banking credentials, identity documents or other unnecessary sensitive information through our forms.
9. Your rights and grievance requests
Subject to applicable law, you may request a summary of your personal data and processing, correction or updating of inaccurate information, erasure where retention is no longer necessary, withdrawal of consent, or grievance redressal.
Email reservationhataomovement@protonmail.com with the subject “Privacy Request” and include enough information to identify the relevant record. We may ask for reasonable verification before acting so that another person cannot access or alter your data. We will acknowledge and address valid requests within a reasonable period and within any mandatory statutory timeline that applies.
10. Children
This website is directed to a general audience and is not designed to knowingly collect personal data from children without appropriate parental or guardian involvement. If you are under 18, use forms only with the consent and supervision of a parent or lawful guardian. A guardian who believes a child submitted data without permission may contact us for review and deletion.
11. Changes and language
We may update this policy when the website, our practices or applicable law changes. The revised effective date will appear at the top of this page. Material changes will be communicated through the website where reasonably practicable.
Hindi is provided for accessibility. If an interpretation differs, the English version will be used to the extent permitted by law.