Privacy Policy
In short
- GKC membership is open only to people aged 18 years or older.
- We collect only what we need to run your membership, and we never sell your personal data or use it for anyone else's advertising.
- Your data is stored on servers in India. Payments are handled by Razorpay; GKC never sees or stores your card, UPI or bank details.
- You can see, correct and download your data, and you can delete your account at any time from your dashboard. We complete deletion within 30 days, after which GKC will not contact you or use your data for any campaign.
- Questions or complaints: write to our Grievance Officer, the General Secretary, at grievance@globalkayastha.com. You can also complain to the Data Protection Board of India. A short Notice for Consent summarises this policy.
1. Who we are
The Global Kayastha Conference Trust ("GKC", "we", "us") is a charitable trust of the Kayastha community, registered under the Indian Trusts Act, 1882 by Trust Deed No. 63 (Book No. 4, Volume No. 2, pages 163–184), executed on 25 January 2021 and registered at the District Registry Office, Patna. Its registered office is at B.G.-2 Royal Garden Apartment, Nageshwar Colony, Kidwaipuri, Patna, Bihar 800001, India. GKC works across India through state, district and local chapters, is not run for anyone's personal profit, and is represented for these policies by its trustee and authorised signatory, Smt Ragini Ranjan. GKC runs the websites globalkayastha.com and gkcindia.org (together, the "Site") and the GKC membership programme.
For the personal data described in this policy, GKC is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the DPDP Rules, 2025. You, the person the data is about, are the Data Principal.
2. Scope and consent
This policy covers personal data that GKC collects through the Site, the membership form, your member dashboard, GKC emails, and GKC events and chapters where your data is recorded in our systems.
When you apply for membership we show you our Notice for Consent and ask you to read this policy, the Terms & Conditions and the Cancellation & Refund Policy, and to give your consent by ticking an "I agree" box before payment. Your consent is free, specific and informed: it covers only the purposes listed in section 4, and you can withdraw it at any time (section 10). Withdrawing consent does not affect processing done before you withdrew it. If you withdraw consent that membership depends on, we will close your membership as described in section 11.
Simply browsing the public pages of the Site does not require an account. In that case we only process the technical data described in section 4.4.
3. Membership is for adults (18+)
GKC membership and member accounts are open only to individuals aged 18 years or older. By applying you confirm that you are at least 18. We do not knowingly collect personal data of children (persons below 18) or of persons with a disability who have a lawful guardian, and we do not track, profile or target advertising at children.
Membership of the Trust is open to Indian citizens. People who are not Indian citizens may register free of charge as Global Associates (supporters). This policy applies to their data in the same way; GKC does not accept any payment from them.
If we learn that we hold data of a person under 18, we will close that account and delete the data without delay, except any record we must keep by law. If you believe a child has given us data, please tell the Grievance Officer (section 17).
4. What we collect and why
We collect personal data only for clear, specific purposes, and only as much as those purposes need.
4.1 Membership application and profile
| Data | Why we need it | Required? |
|---|---|---|
| Full name, email address, mobile number | Create and identify your membership; sign-in (one-time codes are sent to your email); send membership, receipt and account messages; let office bearers reach you about GKC work | Required |
| Date of birth | Confirm you are 18 or older; membership records | Required |
| Gender | Membership records; women-cell and community programmes | Required on the form |
| Address, country, state, district, city, PIN code | Assign you to the right chapter and state office bearers; organise local events; membership records | Required |
| Profile photograph | Shown on your digital membership card and, if you are an office bearer, on chapter pages | Required |
| Referral code or name of the member who referred you | Credit the referring member under GKC's recognition programme | Optional |
| Office-bearer status, designation, chapter | Show GKC's organisational structure and contact points to members | Only for office bearers |
4.2 Payments
Membership fees, renewals, event fees and donations are paid through Razorpay. We receive and keep the amount, date, status, Razorpay order/payment IDs and the purpose of the payment, so that we can issue receipts, renew memberships, reconcile accounts and meet accounting and tax law. We do not receive or store card numbers, CVV, UPI PINs or bank login details.
4.3 Use of member features
When you use your dashboard we record what is needed to run the feature and keep it secure, for example membership-card verification, chapter posts you publish, referrals credited to you, and (for authorised members only) member searches performed and their criteria.
4.4 Technical data
Like most websites, our servers automatically record your IP address, browser type, the pages requested, date and time, and the result. We use this to deliver the Site, prevent abuse and attacks, investigate faults and keep an audit trail of sign-ins and changes to records. We do not use it to build advertising profiles.
4.5 What we do not do
- We do not sell, rent or trade personal data.
- We do not share your data with advertisers or use third-party advertising or tracking pixels.
- We do not collect caste certificates, religion beyond community membership, health data, government ID numbers or bank details.
5. Legal basis
We process your personal data on the basis of your consent, given when you apply for membership or use a feature. We may also process it without separate consent where the DPDP Act allows, for example to comply with a law, a court order or a request from a lawful authority, to respond to a medical emergency or threat to safety, or to keep records we are legally required to keep (such as payment records).
6. Who can see your data
- GKC administrators authorised by GKC can see member records to run the membership programme. Every sign-in and every change they make is logged.
- Office bearers' contact details (name, role and, where provided, phone number) are shown to logged-in members, so that members can reach their state and chapter office bearers. Phone numbers are never shown to people who are not logged in. Founders' personal numbers are not published.
- Membership-card verification. The QR code on your membership card opens a public page that shows only your name, photograph, membership number, chapter, the month you joined and whether your membership is active. It never shows your phone number, email or address.
- Member Search. A small number of members authorised by GKC's Super Admin can search the member directory for GKC work. Their access is time-limited, every search is logged, and results are shown only to them.
- Recognition and chapter pages. If you are an office bearer, a chapter team member or a recognised referrer, your name, designation and chapter may appear on public pages of the Site.
- Authorities. We disclose personal data to government, regulatory or law-enforcement bodies only when the law requires it or a valid legal process demands it.
We do not transfer member data to any other organisation as part of a sale, merger or reorganisation without first informing members and, where the law requires, asking for fresh consent.
7. Service providers (Data Processors)
We use the following services to run the Site. They process data only on GKC's instructions and are bound to keep it secure.
| Provider | Purpose | Location |
|---|---|---|
| Hostinger | Server hosting for the Site, database, backups and GKC's own email server | India (Mumbai) |
| Razorpay | Payment processing | India |
| tawk.to | The optional live-chat window on public pages (only what you type into the chat and basic browser data) | International |
| Google Fonts | Delivers the typefaces used on the Site (receives your IP address when a page loads) | International |
| Security services | Detect and block malicious traffic and malware on our server; they receive the IP addresses of suspicious requests and file signatures, not member records | International |
Member records are stored in India. Where a provider listed above processes limited data outside India, we rely on the DPDP Act's provisions for such transfers and on the provider's own safeguards; we do not transfer data to any country restricted by the Government of India.
9. How long we keep data
| Data | How long |
|---|---|
| Member profile | While your membership or account is active. If you ask us to delete it, deleted within 30 days (section 11). |
| Payment and receipt records | As long as Indian accounting and tax laws require (normally up to 8 years), even after account deletion |
| Sign-in, audit and security logs | Normally up to 90 days; longer only when needed for an investigation or a legal requirement |
| Server access logs | Normally up to 14 days on a rolling basis |
| Backups | Rolling backups are overwritten automatically; deleted data disappears from them as they expire, normally within 30 days |
| Deletion record (see section 11) | As long as needed to prove compliance and meet legal obligations, and only for that purpose |
If an account stays inactive and the purpose for which we hold the data is no longer being served, we will delete the data after giving you at least 48 hours' notice, as the DPDP Rules require.
10. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we hold about you, what we do with it, and who we have shared it with. Most of it is visible in your dashboard.
- Correct, complete or update your data. You can edit your profile from your dashboard, or ask us.
- Erasure. Delete your account and personal data (section 11).
- Withdraw consent for any purpose, as easily as you gave it.
- Nominate another person to exercise your rights if you die or become unable to do so.
- Grievance redressal. Complain to our Grievance Officer (section 17). We will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
To use these rights, sign in to your dashboard or write to the Grievance Officer from your registered email address. We may ask you to confirm your identity before acting on a request.
11. Deleting your account
You may delete your account at any time, either from your dashboard after signing in (My Profile → Delete my account) or by writing to the Grievance Officer from your registered email address.
- Your account is locked immediately and your membership card stops being valid.
- GKC deletes your personal data from its active systems within 30 days of your request.
- From the moment you ask, GKC will not send you any further communication other than a confirmation that your request was received and completed, and your data will not be used for any campaign, newsletter, recognition or any other purpose.
- We keep only a minimal, separately stored record of the deletion and the payment records that the law requires (section 9). That record is used solely to meet legal obligations and to answer lawful requests from regulators or authorities, and is protected by restricted access.
- Membership fees already paid are not refundable on deletion (see the Terms & Conditions).
12. Communications from GKC
We send service messages that are part of your membership, such as sign-in codes, payment receipts, renewal reminders and important changes to our policies. Newsletters, campaigns and event invitations are sent only if you have agreed to receive them, and every such message lets you opt out. GKC emails come from GKC's own addresses (for example no-reply@globalkayastha.com or no-reply@gkcindia.org) and never ask for your password, OTP or bank details.
13. Security and data breaches
We protect personal data with reasonable security safeguards, including encrypted connections (HTTPS/TLS) for the Site and email, key-only administrative access to servers, firewalls and intrusion blocking, malware scanning, role-based access for administrators, audit logs of sign-ins and changes, regular backups and prompt security updates. No system is completely secure, but we work continually to keep your data safe.
If a personal data breach occurs, we will inform the Data Protection Board of India and the affected members without delay, in the manner required by the DPDP Rules, explaining what happened, the likely impact, what we are doing about it and the steps you can take. If you suspect any misuse of your account, contact us immediately.
14. Other websites
The Site may link to other websites and social-media pages. Their owners decide how they handle your data; this policy does not cover them.
15. Changes to this policy
Each version of this policy has a version number and an effective date. If we make a material change, such as a new purpose or a new kind of data, we will tell members by email and on the Site before it takes effect and, where the law requires, ask for your consent again. Earlier versions are available on request.
16. Governing law
This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025 and the Information Technology Act, 2000. Subject to your right to approach the Data Protection Board of India, the courts at Patna, Bihar have exclusive jurisdiction.
17. Grievance Officer and contact
Grievance Officer: General Secretary, Global Kayastha Conference Trust
Email: grievance@globalkayastha.com (subject "Privacy / Grievance")
General member support: support@globalkayastha.com
Post: B.G.-2 Royal Garden Apartment, Nageshwar Colony, Kidwaipuri, Patna, Bihar 800001, India
We acknowledge requests promptly and respond within 30 days.