Privacy Policy

1. Scope of this policy

This Privacy Policy applies to people who visit our website, contact us, make a donation, apply to volunteer, participate in a programme, attend an event, apply for a delegate or international opportunity, work with us, receive support from us, partner with us, supply goods or services to us, or otherwise interact with Melandah Foundation.

It covers information processed online and offline, including information collected through forms, email, telephone, social media, event registration, paper records, photographs, videos and direct engagement with communities.

Some activities may have an additional privacy notice or consent form. Where an activity-specific notice conflicts with this policy, the more specific notice will apply to that activity.

2. Who we are

Melandah Foundation is a non-profit organisation based in Melandah, Jamalpur, Bangladesh. We work to support humanitarian assistance, education, youth development, community wellbeing, volunteering, environmental action and responsible global engagement.

Melandah Foundation is preparing for, or has completed, registration with the Registrar of Joint Stock Companies and Firms in Bangladesh. Our registration details will be published after formal completion:

• RJSC registration number: [Pending]
• NGO Affairs Bureau registration number: [NGOAB REGISTRATION NUMBER — will add after approval]
• Principal address: Melandah, Jamalpur, Bangladesh
• Email: admin@melandahfoundation.org
• Telephone: +880 9696763499

For privacy purposes, Melandah Foundation is responsible for deciding why and how personal information is used, except where another organisation independently determines the purpose and method of processing.

3. Information we may collect

Contact and identity information

This may include your name, postal address, email address, telephone number, date of birth, nationality, country of residence, photograph, signature and identification details where reasonably required.

Donation and financial information

This may include donation amount, transaction reference, payment status, billing details, donor preferences and information needed for accounting, audit, financial controls, regulatory reporting and prevention of fraud or misuse. We normally rely on authorised payment providers to process card or banking information and do not intentionally store complete payment card details on our own systems.

Volunteer, trustee, staff and applicant information

This may include employment and education history, CV, skills, availability, references, emergency contacts, training records, background screening information, conduct records and information needed to assess suitability for a role or activity.

Programme, event and delegate information

This may include application responses, motivation statements, experience, passport or travel information, visa-related documents, accommodation or accessibility needs, dietary information, travel arrangements and emergency contact details.

Beneficiary and safeguarding information

Where necessary to provide support safely, we may collect information about household circumstances, age, vulnerability, disability, health-related needs, safeguarding concerns, risk assessments and assistance received. We will seek to collect only what is necessary for the relevant purpose.

Website and technical information

This may include IP address, browser type, device information, approximate location, pages visited, referring website, time spent on pages, cookie identifiers and information generated through website security, analytics or similar technologies.

Photography, video and media

We may collect photographs, video recordings, audio recordings, testimonials and event-related content. Where appropriate, we will obtain consent or provide a clear notice explaining how such material may be used.

Correspondence and enquiries

We may retain messages, emails, letters, telephone notes, complaints, feedback, requests and other records of communication with you.

4. How we receive personal information

We may receive information:

• directly from you;
• from a parent, guardian, representative or emergency contact;
• from a school, community group, partner organisation or referee;
• from event organisers, programme providers or funding partners;
• from payment providers, banks or fundraising platforms;
• from public sources, where lawful and appropriate;
• through our website, forms, cookies and digital services;
• through social media platforms when you engage with our accounts.

Where another person provides information about you, we expect them to have authority to do so and, where required, to inform you.

5. How we use personal information

• respond to enquiries and provide requested information;
• receive, administer and acknowledge donations;
• plan, deliver, monitor and evaluate programmes and activities;
• assess applications for volunteering, employment, trusteeship, grants, events or delegate opportunities;
• manage volunteers, trustees, staff, contractors and partner relationships;
• protect children, vulnerable adults, volunteers, staff and the public;
• manage health, safety, security and emergency arrangements;
• communicate organisational news, appeals and opportunities where permitted;
• keep financial, governance, safeguarding and operational records;
• meet legal, regulatory, audit, tax, funding and reporting obligations;
• prevent, detect and investigate fraud, corruption, misuse, misconduct or security incidents;
• improve our website, services, programmes and communications;
• establish, exercise or defend legal claims.

We will not use personal information for a purpose that is incompatible with the reason it was collected unless permitted or required by law, or unless we provide further notice and obtain consent where necessary.

6. Legal grounds for processing

• Consent: you have agreed to a specific use.
• Contract or pre-contractual steps: processing is needed to provide a service or administer an application.
• Legal obligation: processing is required to comply with law, regulation, audit, taxation or reporting duties.
• Vital interests: processing is necessary to protect life, health or safety.
• Legitimate interests: processing is reasonably necessary for our charitable, operational, security, governance, fundraising or administrative interests, provided those interests are not overridden by your rights.
• Public or substantial public interest: where recognised by applicable law.

Where consent is the basis, you may withdraw it at any time. Withdrawal will not affect processing that took place lawfully before withdrawal.

7. Sensitive and special-category information

Some activities may require information that is particularly sensitive, such as health, disability, religion, ethnicity, biometric information, safeguarding information, criminal allegations or background screening records.

We will collect and use such information only where it is genuinely necessary, where an appropriate legal ground exists, and with additional safeguards.

8. Children and vulnerable people

Some of our programmes involve children and vulnerable people. Their privacy, dignity and safety require additional care.

Where appropriate, we will obtain consent from a parent or legal guardian, provide age-appropriate information, limit access to records, and apply safeguarding procedures. We may process information without consent where necessary to protect a child or vulnerable person, respond to a safeguarding concern, comply with law, or protect vital interests.

Images or stories identifying children will not be published solely because a general event photograph was taken. We will consider context, safeguarding risk, dignity and consent arrangements.

9. Donations and payments

Online donations may be processed by third-party payment, banking or fundraising providers. Those providers may independently collect and process payment information under their own privacy policies.

We may retain donor name, contact information, donation amount, transaction reference, date, purpose and related records for acknowledgement, accounting, audit, fraud prevention, donor communication and legal or regulatory reporting.

Where foreign donations are received, information may be processed or disclosed as necessary to comply with the laws and requirements governing foreign donations and voluntary activities in Bangladesh, including reporting to competent authorities where legally required.

10. Email, newsletters and fundraising communications

We may send service-related messages where necessary for an application, donation, event, programme, volunteer role, safeguarding matter or existing relationship.

We will send promotional, fundraising or newsletter communications where we have consent or another lawful basis recognised by applicable law. Every electronic marketing message should include a reasonable way to unsubscribe.

Unsubscribing from promotional messages will not prevent essential administrative, legal, safety or transaction-related communications.

11. Cookies and website technology

Our website is hosted through Squarespace and may use cookies or similar technologies for security, basic operation, preferences, analytics, embedded content and performance.

Some cookies are necessary for the website to function. Other cookies, such as analytics or advertising cookies, should be used only in accordance with applicable consent requirements.

Embedded services such as YouTube, Vimeo, Google Maps or social media content may place their own cookies or collect technical information.

Further information should be provided in our Cookie Policy.

12. When we share personal information

We do not sell personal information. We may share information only where reasonably necessary with:

• authorised trustees, staff, volunteers and contractors;
• website, email, cloud-storage, IT and security providers;
• payment processors, banks, auditors and professional advisers;
• programme organisers, schools, community partners, travel providers or event hosts;
• funders and donors, usually in aggregated or anonymised form unless identification is necessary and lawful;
• government departments, regulators, law-enforcement bodies, courts or competent authorities where required or permitted by law;
• safeguarding agencies or emergency services where necessary to protect a person;
• a successor organisation in a lawful merger, restructuring or transfer of activities.

13. International data transfers

Melandah Foundation operates primarily in Bangladesh but may work with people, technology providers, donors, partners and programme organisers in other countries. Personal information may therefore be stored, accessed or processed outside your country of residence.

Where information is transferred internationally, we will take reasonable steps appropriate to the sensitivity and risk of the information, including reputable providers, contractual safeguards, access controls, encryption, consent where appropriate, or another lawful transfer mechanism.

Laws and protections may differ between countries. We will not represent that every destination provides identical protection, but we will seek to protect information consistently with this policy and applicable legal requirements.

14. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, and for any additional period required for legal, regulatory, safeguarding, accounting, audit, insurance or dispute-resolution purposes.

• general enquiries may be retained for up to 24 months after closure;
• unsuccessful applications may normally be retained for up to 12 months, unless a longer period is justified or agreed;
• financial, donation, grant and accounting records may be retained for at least the period required by applicable law;
• safeguarding records may be retained longer where necessary to protect individuals or comply with legal guidance;
• consent and communication-preference records may be retained to demonstrate compliance;
• published materials may remain in historical archives where continued retention is lawful and proportionate.

15. How we protect information

• role-based access and confidentiality expectations;
• strong passwords and multi-factor authentication where available;
• secure website connections and reputable providers;
• restricted access to sensitive and safeguarding records;
• staff and volunteer awareness and training;
• secure disposal and deletion procedures;
• backups, monitoring and incident-response arrangements;
• due diligence before appointing important data processors.

No internet transmission or storage system is completely secure. We cannot guarantee absolute security, but we will investigate suspected breaches and notify affected people or authorities where required by applicable law.

16. Your privacy rights

Your rights depend on the laws that apply to you and to the relevant processing. Subject to legal conditions and exemptions, you may have the right to:

• ask whether we process your personal information;
• request access to your information;
• request correction of inaccurate or incomplete information;
• request deletion where there is no lawful reason to retain it;
• request restriction of certain processing;
• object to certain processing, including some direct marketing;
• withdraw consent where processing is based on consent;
• request transfer of eligible information in a usable format;
• request information about safeguards used for international transfers;
• complain to us or to a competent authority.

We may ask for information necessary to verify your identity. We may refuse or limit a request where permitted by law, including where disclosure would adversely affect another person, safeguarding, legal privilege, security, regulatory duties or the prevention and investigation of wrongdoing.

17. Questions and complaints

Please contact us first if you believe we have handled your information incorrectly. We will review the matter and seek to provide a clear response.

You may also have the right to complain to the data-protection, information, cyber-security or other competent authority in your country. For UK-related processing, the relevant supervisory authority may be the Information Commissioner’s Office. For Bangladesh-related processing, complaints may be made to the competent authority established or designated under applicable Bangladesh law once operational and where it has jurisdiction.

18. Third-party websites and services

Our website may link to third-party websites or embed third-party services. We are not responsible for their independent privacy practices. You should read their policies before giving them personal information.

Our principal technology or service providers may include Squarespace, domain and email providers, cloud-storage services, payment providers, analytics providers and social media platforms. The exact providers may change as our operations develop.

19. Changes to this policy

We may update this Privacy Policy when our activities, technology, service providers or legal obligations change. The latest version will be published on this page with an updated date.

Where a change materially affects how we use information, we will take reasonable steps to provide additional notice and seek consent where required.

20. Contact us