Privacy Policy

1. What we collect #

When you use the website

You can browse mangalaunited.com without giving us any personal data. Our web host records standard server logs (IP address, browser type, pages requested, timestamp) for security and troubleshooting.

When you create a portal account

When you apply for membership

If you ask to end your membership

2. Why we collect it #

We process this data on the basis of the consent you give when you submit your membership application, and — for financial and membership records — because we are legally obliged to keep them.

3. Payments #

All online payments are processed by Razorpay Software Private Limited. When you pay, Razorpay collects your name, email, phone number and payment instrument details directly.

Mangala United never sees or stores your full card number, CVV, UPI PIN, or net-banking credentials. What we receive back and store is limited to the payment identifier, amount, currency, payment method type (for example "UPI" or "Card"), status, and timestamp. We use these to issue your receipt and reconcile our accounts.

Razorpay processes your data under its own Privacy Policy, which applies to you when you make a payment.

4. Photographs and membership cards #

The photograph you upload is used to produce your digital membership card. It is stored on our web server and is visible to Association administrators and to anyone you show your card to.

You may replace your photograph at any time from your profile. When your membership record is erased, the photograph is deleted with it.

5. Public verification links #

Every membership card and every payment receipt carries a QR code. Scanning it opens a verification page that confirms the card or receipt is genuine.

If you believe a verification link has been shared without your consent, contact us and we will issue you a new one, invalidating the old link.

6. Member referrals #

Members can invite someone to join by entering that person's email address. We use it once, to send a single invitation naming the member who referred them, and to send at most one reminder.

Every invitation carries a one-click link to decline further contact. If you receive an invitation you did not ask for, that link stops all further email from us and removes your address from our system. We also delete invitations that are never taken up after 90 days.

7. Community leaderboards #

To encourage participation and recognise member contributions, we may display community leaderboards inside the Membership Portal. These may show a member’s name, profile photograph (where one has been provided), membership badge or achievement level, referral count, and community rank.

Leaderboards are visible only to signed-in members of Mangala United. They are not public, not indexed by search engines, and not shared outside the Association.

Where a setting is offered to control whether you appear on a leaderboard, it is described in the portal. If you would rather not appear and no setting is available yet, contact our Grievance Officer and we will remove you.

8. Activity and audit records #

The portal records significant events on your membership — application submitted, approved, held, payment received, details changed, card downloaded — together with who performed the action and when. You can see your own history in the portal.

We keep these records so that decisions about members can be explained and audited. They are necessary for the proper governance of the Association and are retained even after a membership ends.

9. Who we share data with #

We do not sell, rent or trade your personal data. We share it only with the service providers we need to run the Association:

We may also disclose data where we are required to by law, a court, or a regulator.

Within the Association, your record is visible to committee members and volunteers holding an administrative role in the portal. Access is controlled by role, and administrative access to member records is logged. Other members see only what a community leaderboard shows (see above) — never your contact details, address or payment history.

A request to end your membership, including the reason you give and anything further you write, is visible to the committee members who handle membership decisions. It is not shared outside the Association.

10. How long we keep it #

11. Cookies #

The public website sets no cookies of its own. The Membership Portal sets only cookies that are strictly necessary for it to work:

We use no advertising, tracking or analytics cookies. Because all of the above are strictly necessary, we do not ask for cookie consent. If we ever add analytics, we will ask first.

12. Security #

We protect your data with:

• HTTPS encryption on the website and portal;
• passwords stored only as bcrypt hashes, never in readable form;
• role-based access, so volunteers see only what their role requires;
• rate limiting and account lockout to resist password-guessing;
• an audit trail of actions taken on your membership record, including actions taken by administrators.

No system is completely secure. We commit to the measures above and to telling you promptly if something goes wrong.

13. Your rights #

Under the DPDP Act you have the right to:

• Access — obtain a copy of the personal data we hold about you;
• Correction — have inaccurate data corrected. Most fields you can edit yourself in the portal;
• Erasure — ask us to delete your data, subject to the retention rules above;
• Withdraw consent — for anything we do on the basis of consent, including announcement emails;
• Nominate — name someone to exercise these rights on your behalf if you die or become incapacitated;
• Complain — to our Grievance Officer, and then to the Data Protection Board of India.

To exercise any of these, email our Grievance Officer below. We will respond within 30 days. There is no charge.

14. Grievance Officer #

In accordance with section 13 of the DPDP Act and Rule 5(9) of the IT Rules, 2011:

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

15. Data breaches #

If a breach affects your personal data, we will notify the Data Protection Board of India and every affected person, without undue delay and within the timeframe the DPDP Act requires. Our notification will describe what happened, what data was involved, what we are doing about it, and what you should do.

16. Children #

Membership is open to adults aged 18 and over. We do not knowingly collect data from children. If we learn that we have, we will delete it.

17. Changes to this policy #

We will publish any change here with a new version number and effective date, and keep previous versions available. Where the law requires us to notify you directly or to ask for fresh consent, we will. Continued use of the portal after the effective date means you accept the updated policy.

18. Contact us #