Privacy
Privacy Policy
GEMBA Access and Impact Foundation ("GEMBA", "we", "us" or "our") respects the privacy of people who visit gemba.org.in or contact us through the website. This Privacy Policy explains what personal data we collect, why we use it, how it may be handled and the choices available to you.
This policy applies to this website, its contact and institutional-enquiry pathways, and related correspondence initiated through them. It does not automatically apply to a separately governed research study, programme, employment process, partner platform or third-party website; the relevant notice or agreement will apply in those contexts.
Who is responsible for your personal data?
GEMBA Access and Impact Foundation is the organisation responsible for the personal data described in this policy.
| Field | Controlled value |
|---|---|
| Legal name | GEMBA Access and Impact Foundation |
| Corporate identity number | U88900BR2024NPL071111 |
| Registered office | Plot 77, Abhiyanta Nagar, Gola Road, Danapur, Patna 801503, Bihar, India |
| info@gemba.org.in |
Please use the subject line 'Privacy request' when contacting us by email.
What personal data do we collect?
We aim to collect only the information reasonably required to operate the website, protect it and respond to an enquiry.
| Category | Data covered |
|---|---|
| Information you submit | Full name, designation, organisation, official email, optional telephone number, enquiry category, message and your privacy-consent record. |
| Correspondence | Information contained in follow-up email or telephone correspondence, including corrections or privacy requests. |
| Technical and security data | Depending on the final hosting and security configuration: IP address, browser and device information, date and time, requested pages, referring page, error and security logs. |
| Cookie and preference data | Cookie identifiers and consent choices only where the final website uses those technologies. |
| Analytics data | Aggregate or pseudonymous usage information only if an approved analytics tool is enabled under the choice described in this policy. |
If you provide another person's contact details, please ensure you are authorised to do so and that the person understands how the information will be used.
Please keep sensitive and restricted information out of the form.
Do not submit patient or beneficiary information, personal health data, children's information, confidential proposals or bids, financial or banking information, identity documents, passwords, authentication credentials or other sensitive records through the public form.
If a legitimate institutional conversation later requires restricted material, GEMBA will first agree an appropriate purpose, access arrangement and transfer channel. A public website enquiry does not by itself authorise the transfer of programme or research data.
Why do we use your personal data?
| Purpose | What it means |
|---|---|
| Respond to enquiries | Receive, assess, route and respond to the institutional or professional enquiry you choose to submit. |
| Manage correspondence | Maintain an appropriate record of the conversation, clarify requirements and take requested follow-up steps. |
| Operate and protect the site | Deliver pages, prevent abuse, diagnose errors, maintain security and protect GEMBA and website visitors. |
| Improve the website | Understand aggregate use and improve content, navigation and accessibility where approved analytics are enabled. |
| Meet legal and governance needs | Comply with applicable law, respond to lawful requests and establish, exercise or defend legal rights. |
Submitting an enquiry does not subscribe you to a newsletter or marketing communication. GEMBA will obtain a separate, specific choice before introducing any optional subscription service.
How is the use of your data authorised?
When you voluntarily submit the contact form, you ask GEMBA to use the information for the stated purpose of assessing, routing and responding to your enquiry. The form also records your affirmative privacy choice. Certain limited processing may be necessary to operate and secure the website, comply with law, or manage a legal claim. Optional analytics or communication will be used only under the choice and settings presented to you, where required.
You may withdraw a consent-based choice by contacting GEMBA or changing the relevant cookie preference. Withdrawal does not affect processing already carried out before the withdrawal and may not require deletion where information must lawfully be retained.
Who may receive personal data?
GEMBA does not sell personal data. Access is limited to authorised people and service providers who need the information for the purposes described in this policy.
| Recipient category | Purpose and boundary |
|---|---|
| Within GEMBA | Authorised Directors, personnel or advisers responsible for enquiry routing, governance, security or legal compliance. |
| Service providers | Approved providers supporting hosting, form processing, organisational email, security, spam prevention, analytics or technical maintenance. |
| Professional advisers | Auditors, legal advisers, company-secretarial or other professional advisers where necessary and subject to appropriate duties. |
| Authorities and legal recipients | A court, regulator, law-enforcement body or other authorised recipient where disclosure is required or permitted by applicable law. |
| Organisational change | A successor or relevant party in a lawful restructuring, subject to appropriate confidentiality and data-protection controls. |
An enquiry will not be shared with a proposed partner, consortium member, funder or government institution merely because the message refers to that organisation. Where external sharing is genuinely required, GEMBA will establish an appropriate basis and inform you where applicable.
Where is personal data processed?
GEMBA is based in India. Some approved technology providers may process or store limited data in other locations, depending on the final website and organisational systems. Before publication, GEMBA will identify the relevant providers and locations, assess the arrangement and apply contractual and organisational safeguards appropriate to the data and applicable law.
GEMBA uses Formspree, a third-party form-processing service, to receive enquiries sent through this website. Information you enter in the form is transmitted to that service, which delivers it to GEMBA's official email address and retains a copy in GEMBA's account with the service. That service, and the organisational email service that receives the enquiry, are operated by providers whose systems may be located outside India.
How long do we keep personal data?
GEMBA keeps personal data only for as long as reasonably necessary for the purpose for which it was collected, including appropriate follow-up, security, record-keeping and applicable legal requirements. When the information is no longer required, it will be deleted, anonymised or securely disposed of under the approved process.
For an enquiry sent through the website, the copy held by the form-processing service is kept for the period available under the service plan GEMBA uses at the time. The copy delivered to GEMBA's official email address is kept for up to twelve months from the last substantive exchange about that enquiry, and is then deleted, unless the enquiry has become part of an active engagement, contract, proposal or other business or statutory record that legitimately requires a longer period.
You may ask GEMBA to delete an enquiry sooner, and GEMBA will do so unless one of the requirements described above means the information has to be kept. Access to submitted enquiries is limited to GEMBA's Directors and the personnel specifically authorised to respond to institutional enquiries.
How do we protect personal data?
GEMBA uses proportionate organisational and technical measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These may include secure transmission, controlled access, account security, service-provider review, logging, backups and incident-management practices appropriate to the website and information handled.
No internet transmission or storage system can be guaranteed to be completely secure. Please use the public form only for the limited, non-sensitive information requested and contact GEMBA promptly if you believe information has been mishandled.
Your choices and privacy requests
Depending on the circumstances and applicable law, you may ask GEMBA to provide information about personal data connected with your enquiry; correct, complete or update inaccurate information; delete information that is no longer required; withdraw a consent-based choice; or review a concern about how information has been handled.
- Write to info@gemba.org.in with the subject line 'Privacy request'.
- Describe the request and the website interaction or enquiry to which it relates.
- Provide only the information reasonably required to locate the record and verify that the request is genuine.
- Do not send identity documents unless GEMBA specifically determines that proportionate verification is necessary and provides a safe route.
GEMBA may need to retain limited information where required by law, necessary for a continuing purpose, or needed to establish, exercise or defend a legal claim. We will explain the outcome where appropriate.
Children's personal data
This institutional website and its public enquiry form are not designed to collect personal data directly from children. Do not submit a child's personal information, health information, case details, photograph or other identifying material through the form. If GEMBA learns that such information has been submitted unexpectedly, it will assess and handle the material under its safeguarding, privacy and legal obligations.
Any future activity involving children or programme beneficiaries must use a separate, approved notice, consent or authorisation process and appropriate safeguarding and data-governance arrangements. This website policy is not a substitute for those project-specific controls.
Links to other websites
The website may link to government, research, professional or other third-party resources. GEMBA does not control those websites or their privacy practices. A link does not by itself mean that GEMBA endorses, partners with or is responsible for the third party. Please review the privacy information provided by the site you visit.
Changes to this policy
GEMBA may update this policy when the website, organisational practices or applicable requirements change. The revised policy will show an updated date. Where a change materially affects how previously collected personal data is used, GEMBA will take additional steps appropriate to the circumstances and applicable law.
Questions about this policy? Contact info@gemba.org.in.