Privacy information
Privacy Policy
Placeholders to fill before review:
Registered names and addresses of the US and Indian entities
Privacy contact email and Grievance Officer name
Website URL and effective date
Names of the service providers PHP uses (registration, email, payments, cloud storage)
Whether PHP uses analytics or advertising cookies on its website
1. Who we are
Param Hansa Philanthropies (“PHP”, “we”, “us”) supports research in computational biology, quantum-AI and translational medicine. PHP operates through two entities, and the one responsible for your information depends on how you engage with us.
| Entity | Responsible for | Contact |
|---|---|---|
| [Param Hansa Philanthropies, Inc.], a US 501(c)(3) nonprofit, [address] | US programmes and events (including QxBio in the US), US donations and grants, US-based applicants, and this website [Legal to confirm] | [privacy@ email] |
| [Param Hansa Philanthropies Foundation], an Indian Section 8 company, [address] | Programmes and events in India (including PHCCO and QxBio India), Indian donations and grants, India-based applicants | [privacy@ email]; Grievance Officer: [name] |
Where both entities use your information for a shared programme, they are jointly responsible for it and you can contact either one. Under data protection laws, the responsible entity is your “data controller” or “data fiduciary”.
2. Who this policy covers
This policy applies to everyone whose personal information PHP handles, wherever they are in the world, including:
conference and event participants, speakers, panellists and sponsors
students and mentors in hackathons, fellowships and similar programmes
job applicants, volunteers, interns and consultants
donors, grantees and research partners
website visitors and newsletter subscribers
It does not cover PHP employees’ employment records, which are covered by a separate internal notice, or third-party websites we link to.
3. Information we collect
We collect only what we need for each activity. Most of it comes directly from you; some comes from partners or public sources, as noted.
| If you are… | We collect |
|---|---|
| An event participant or speaker | Name, contact details, organisation, role, dietary needs, travel and accommodation details for speakers, session attendance, photos and recordings taken at events (see section 13) |
| A hackathon or programme participant | Name, contact details, institution, field of study, team details, project submissions, evaluation scores |
| A job applicant or volunteer | Name, contact details, location, CV, qualifications, work history, answers to application questions, work authorisation (yes/no only), interview notes, references you provide |
| A donor or sponsor | Name, contact details, donation amount and date, tax receipt details (such as PAN for Indian donors, as required by law), payment confirmation. We do not store full card or bank details; our payment processors handle these |
| A grantee or research partner | Name, contact details, institution, proposal details, bank details for grant disbursement, reporting data |
| A website visitor | IP address, browser type, pages visited and cookie data (see section 13) |
We do not ask for information about race, religion, caste, health, sexual orientation or political views. If an event requires accessibility or dietary information, we use it only to make arrangements and delete it after the event.
4. How and why we use it
We use your information only for the purposes below. Some laws, including the GDPR, require us to state a legal basis for each use.
| Purpose | Legal basis |
|---|---|
| Registering you for and running events, programmes and hackathons | Performing our agreement with you |
| Assessing job, volunteer and fellowship applications | Taking steps at your request before an agreement; consent for keeping your application on file for future roles |
| Processing donations, issuing tax receipts, disbursing grants | Legal obligation; performing our agreement |
| Sending event updates and newsletters | Consent (you can unsubscribe at any time) |
| Photographing and recording events for our communications | Legitimate interests, or consent where the law requires it |
| Keeping our website secure and understanding how it is used | Legitimate interests; consent for non-essential cookies |
| Meeting legal, tax, audit and regulatory requirements in India and the US | Legal obligation |
Under India’s DPDP Act, we rely on your consent or on a permitted “legitimate use” such as a legal obligation. We do not sell your personal information, use it for targeted advertising, or make decisions about you based solely on automated processing.
5. Who we share it with
We share information only where needed for the purposes in section 4, and never sell it.
Between PHP’s US and Indian entities, for shared programmes such as the QxBio series.
Service providers acting on our instructions, such as event registration, email, payment, cloud storage and travel booking providers: [list names]. They may not use your information for their own purposes.
Programme partners, such as host universities and research institutions, when you take part in a programme we run with them. We tell you who the partner is when you sign up.
Event co-hosts and sponsors, but only your name and organisation, and only if you agree at registration.
Authorities and advisers, where required by law, or to our auditors and legal advisers.
Speaker names, titles, photos and biographies are published in event materials, with the speaker’s agreement.
6. International transfers
PHP works across India and the US and welcomes participants from around the world, so your information may be stored or accessed in a country other than your own. Our main storage locations are [India / the US / provider regions].
When we transfer information internationally, we protect it as follows:
From the EU, EEA or UK: we use the European Commission’s Standard Contractual Clauses (and the UK Addendum), or rely on an adequacy decision where one applies. [Legal to confirm]
From India: we transfer data only to countries not restricted by the Government of India under the DPDP Act.
Elsewhere: we follow the transfer rules of your country and apply the same safeguards described in this policy.
7. How long we keep it
We keep information only as long as needed for its purpose or as the law requires, then delete or anonymise it.
| Information | Retention period |
|---|---|
| Job and volunteer applications (unsuccessful) | 12 months after the decision, with your consent; otherwise 6 months |
| Event and hackathon registration | [3] years after the event, for planning and reporting |
| Dietary and accessibility details | Deleted within [30] days after the event |
| Donation and tax records | As required by tax law: at least 7 years (US) and 8 years (India) [Legal to confirm] |
| Grant records | [7] years after the grant closes |
| Newsletter subscriptions | Until you unsubscribe |
| Event photos and recordings | Kept in our archive while in use for communications |
8. Security
We use reasonable technical and organisational safeguards to protect your information. These include access controls, encryption in transit, secure providers and limiting access to staff who need it. No system is completely secure. If a breach affects your information, we will notify you and the relevant authorities as the law requires, including the Data Protection Board of India and EU or UK supervisory authorities.
9. Your rights
Wherever you are, PHP offers everyone the following rights, whether or not your local law requires them:
Access: ask what information we hold about you and get a copy.
Correction: ask us to fix information that is inaccurate or incomplete.
Deletion: ask us to delete your information, unless we must keep it by law.
Withdraw consent: at any time, for anything based on consent. This does not affect what we did before.
Opt out of communications: use the unsubscribe link or email us.
To exercise a right, email [privacy@ email] with your name and the request. We may need to confirm your identity. We will respond within 30 days, or sooner where your local law requires it. Exercising your rights is free.
The sections below set out additional rights that apply in specific regions.
10. Additional information for India
This section applies under the Digital Personal Data Protection Act, 2023 and its Rules, which are being phased in. [Legal to confirm which obligations apply as of the effective date]
Data fiduciary: [Indian entity name], as set out in section 1.
Additional rights: you can ask for a summary of the personal data we process and the activities involved, and the identities of anyone we have shared it with. You can also nominate another person to exercise your rights if you die or become incapacitated.
Consent: where we rely on consent, we ask for it clearly and separately, and you can withdraw it as easily as you gave it.
Grievance Officer: [name], [email], [address]. We will respond to grievances within [the period set by the DPDP Rules].
Complaints: if you are not satisfied with our response, you can complain to the Data Protection Board of India. You must contact our Grievance Officer first.
Children: we do not knowingly process data of anyone under 18 without verifiable parental consent (see section 13).
11. Additional information for the EU, EEA and UK
This section applies under the EU General Data Protection Regulation (GDPR) and the UK GDPR when we offer events or programmes to people in these regions.
Controller: the PHP entity set out in section 1.
Additional rights: you can also ask us to restrict how we use your data, object to uses based on legitimate interests, and receive your data in a portable format.
Legal bases: listed in section 4.
Transfers: safeguards are listed in section 6.
Complaints: you can complain to the data protection authority in your country, or the Information Commissioner’s Office in the UK.
EU/UK representative: [name and contact, if required]. Legal to confirm whether PHP needs to appoint one. This depends on how regularly PHP offers events and programmes to people in the EU and UK.
12. Additional information for the United States
The US has no single national privacy law. Several state laws give residents privacy rights, and some of them, such as those in Colorado, Oregon, Delaware and New Jersey, apply to nonprofits above certain data thresholds. Legal to confirm which apply to PHP.
Whether or not a state law applies, PHP offers all US residents the rights in section 9.
No sale or sharing for advertising: we do not sell personal information or share it for cross-context behavioural advertising.
Appeals: if we decline your request, you can appeal by replying to our decision. If you remain unsatisfied, you can contact your state Attorney General.
Non-discrimination: we will not treat you differently for exercising your rights.
Do Not Track / Global Privacy Control: [state how the website responds to these browser signals].
13. Other important information
Other countries. If you live elsewhere, for example in Canada, Singapore, Australia or Brazil, you have the rights in section 9 and any further rights your local law gives you. Contact us to exercise them.
Children. Our programmes are intended for adults. Where a programme is open to students under 18, we collect information only with verifiable consent from a parent or guardian, and we do not track or profile children.
Event photos and recordings. We photograph and record many events and may use the material on our website, social media and reports. We tell you at registration and at the venue. If you prefer not to be photographed, tell our team on the day, or email us later to have an image removed from our channels.
Cookies. Our website uses essential cookies to work properly. [If used:] With your consent, we also use analytics cookies to understand how the site is used. You can change your choice at any time through [cookie settings link].
Changes to this policy. We will post any changes on this page with a new effective date. For significant changes, we will notify you directly where we can.
Contact us. Email [privacy@ email], or write to the relevant entity at the address in section 1.
Effective date: [date]