Your data, explained.

Social Kangaroo (socialkangaroo.org) is operated by Zeroforward Labs Private Limited, a company incorporated in India (CIN U62099TS2026PTC212537) with its registered office at Rangareddy, Telangana 500089 (“we”, “us”). Our corporate office is at Sarnath, Varanasi, Uttar Pradesh 221007. For the personal data described in this notice we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it.

Our Grievance Officer, Mayank Pathak, can answer any question about how we process your personal data. Reach them through our contact and grievance form or by post at the address above.

• We collect what we need to help you find or offer work in the social impact sector, and to keep the platform safe.
• Your candidate profile is shared only with organisations you choose to apply to.
• Organisation verification documents are seen only by our verification team.
• We do not sell personal data, show advertising, or use tracking or analytics cookies.
• You can see, correct, download and delete your data, and withdraw consent, at any time.

We process personal data only for the purposes listed against it. We collect it directly from you unless stated.

You do not have to give us optional details (marked “Optional” in forms). Some details are needed to use parts of the service: for example, we cannot verify an organisation without a registration certificate.

When you create an account you give consent for the purposes above by ticking the consent box. We record when you consented and to which version of this notice, as the DPDP Act requires us to be able to show.

You can withdraw consent at any time, as easily as you gave it, by deleting your account from Account settings or by sending a request through our contact form. After you withdraw, we stop processing your data and erase it as described under “How long we keep data”, unless a law requires us to keep it. Withdrawal does not affect processing that happened before it.

• Organisations you apply to receive your profile, contact details and application. Each organisation then decides how to use that data for its recruitment and is itself a Data Fiduciary responsible for it under the DPDP Act. Our Terms require organisations to use candidate data only to consider you for the role.
• Service providers (Data Processors) who host our website and database, deliver email and store files. They act only on our instructions under contracts that require them to protect your data.
• Authorities, when a law or a valid order requires it, or to protect someone from harm or fraud.
• A successor, if Social Kangaroo is merged, acquired or transferred, in which case this notice continues to apply and we will tell you before anything changes.

We do not sell personal data or share it for advertising.

Curated listings link to other websites. When you apply there, that website's privacy policy applies, not ours.

Our service providers may store or process data in India or in other countries. We transfer personal data outside India only to countries not restricted by the Government of India under section 16 of the DPDP Act, and only to providers bound to protect it.

When we delete data, we remove it from live systems promptly and from backups within 90 days. We may keep anonymised statistics that can no longer identify anyone.

• Connections are encrypted (HTTPS). Passwords are stored only as salted, one-way hashes.
• Sign-in sessions use secure, HTTP-only cookies, and the session tokens are themselves stored only as hashes.
• Access is restricted by role. Verification documents are available only to our verification team and the uploading organisation.
• Repeated attempts to guess passwords or codes are blocked, and every moderation decision is logged.

If a personal data breach happens, we will inform the Data Protection Board of India and every affected person, as the DPDP Act requires, explaining what happened, the likely impact, and what we and you can do.

Under sections 11 to 14 of the DPDP Act you can:

• Get a summary of the personal data we process about you and how, and who we have shared it with. Download it any time from Account settings.
• Correct, complete or update your data, mostly yourself from your profile, or by asking us.
• Erase your data by deleting your account, or by asking us.
• Have grievances addressed by our Grievance Officer.
• Nominate someone to exercise these rights for you if you die or become unable to.

Use the contact and grievance form for anything you cannot do yourself in the app. We may ask you to confirm your identity first. We acknowledge requests within 24 hours and aim to resolve them within 15 days, and in any case within the time allowed by law.

If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.

The DPDP Act also asks people using services like ours not to give false information, impersonate others or file frivolous complaints.

Social Kangaroo is for people aged 18 and over. We do not knowingly process the personal data of children (under 18). If we learn that an account belongs to a child, we will delete it. If you believe a child has signed up, please tell us.

We use one essential cookie, __Host-sk_session, to keep you signed in. It expires after 30 days (7 days for administrators) or when you sign out. Administrators also get a short-lived sign-in cookie for the 15 minutes between their password and the code we email them. We do not use analytics, advertising or tracking cookies, so there is nothing to opt out of.

You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India. Send a request through our contact form and we will provide it.

If we change this notice in a way that affects how we use your data, we will tell you before the change takes effect and, where the law requires, ask for your consent again. The version and effective date are shown at the top.