Privacy Policy & Data Protection Charter

1. Introduction, Scope & Independent Status

This Privacy Policy governs the collection, processing, storage, and protection of personal data by the National Schemes Portal ("we", "our", "us", or "the Platform"), accessible at tricolordesk.in.

The Platform operates as an independent civic-tech welfare information directory, eligibility calculator, and administrative facilitation service designed to support Indian citizens, families, students, farmers, youth, and grassroots digital service operators (Cyber Cafes, Common Service Centers / CSCs, and digital kiosks).

Legal Framework & Compliance: This Policy is formulated in strict accordance with:

1. The Digital Personal Data Protection Act, 2023 (DPDP Act);
2. The Information Technology Act, 2000 (IT Act), specifically Section 43A and Section 72A;
3. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules);
4. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

2. Categories of Information Collected

We adhere strictly to the principle of Data Minimization—collecting only the minimum necessary information required to authenticate user sessions, manage subscription access, and localize scheme eligibility.

2.1 Cyber Cafe / Kiosk Operator Account Data

When an operator registers a Cyber Cafe Kiosk Desk, we collect:

• Cyber Cafe / Center Name;
• Operator Full Name;
• 10-Digit Indian Mobile Number (used as primary unique account identifier);
• Email Address (used for account recovery and communications);
• Geographic Parameters: State and District (used to display district-specific welfare schemes and local guidelines).

2.2 Citizen Subscriber Account Data

When an individual citizen registers for a household pass, we collect:

• Citizen / Applicant Name;
• 10-Digit Mobile Number;
• Email Address;
• State and District.

2.3 Account Security & Credential Protection

• Password Protection: We do not store passwords in readable plain text. All accounts are secured using modern encryption standards and salted cryptographic hashes. Your login credentials are protected against unauthorized access and are never shared or visible to third parties.

2.4 Payment & Activation Verification Data

• 12-Digit UPI Transaction Reference (UTR) Numbers: When an operator or citizen subscribes to a 30-day or 90-day access pass via UPI (Google Pay, PhonePe, Paytm, BHIM), they submit their official 12-digit bank UTR reference number. This number is stored in an encrypted verification audit log solely to verify payment clearance and prevent duplicate code redemption.
• Strict Non-Collection of Banking Credentials: The Platform NEVER asks for, collects, records, or stores UPI PINs, Credit/Debit card numbers, CVVs, Net Banking passwords, OTPs, or bank account login credentials. All payments are initiated directly by the user inside their respective bank-authorized UPI apps.

3. Absolute "Zero-Collection" Guarantee for Sensitive Government Identifiers

When a citizen or kiosk operator is ready to submit an official application requiring Aadhaar or biometric e-KYC, our platform provides a direct, secure outbound hyperlink redirecting them to the official government portal (*.gov.in), where all identity verification is conducted under official sovereign protocols.

4. Lawful Purpose & Grounds for Processing

All personal data collected is processed strictly under the following lawful purposes with user consent:

1. Account Lifecycle & Security: Registering, authenticating, and securing kiosk and citizen accounts.
2. Access Management: Administering the 24-Hour Free Trial, verifying paid validity periods (Monthly and Quarterly passes), and enforcing single-session concurrent access (1 session for citizens, up to 3 terminal stations for cyber cafes) to prevent fraudulent account sharing.
3. Payment Verification & Audit Accountability: Cross-referencing submitted 12-digit UTR references against bank settlement ledgers and issuing digital activation receipts via WhatsApp, email, or portal confirmations.
4. Scheme Customization: Filtering welfare programs relevant to the user's state and district.
5. Customer Support: Responding to operator inquiries, password resets, and account reactivations.

5. Data Security & Storage Safeguards

• Credential Safeguards: All account passwords and login sessions are protected through secure, modern cryptographic techniques to prevent unauthorized disclosure.
• Restricted Administrative Access: Internal administrative tools are strictly restricted to authorized platform personnel through multi-tier authentication protocols.
• Zero Commercial Data Selling: We maintain a strict policy against commercializing user information. We do not sell, rent, trade, or distribute operator mobile numbers, citizen details, or usage inquiries to third-party marketing agencies or data brokers.

6. Outbound Links to Third-Party Government Portals

The Platform contains direct hyperlinks to Central and State government websites (*.gov.in, *.nic.in). Once you click an outbound link and navigate to an external portal, you are governed by the privacy policy, terms, and data collection practices of that specific government department. We are not responsible for the availability, server uptime, content changes, or privacy practices of external government websites.

7. Data Principal Rights (Under DPDP Act 2023)

In accordance with Chapter III of the Digital Personal Data Protection Act, 2023, all registered users enjoy the following statutory rights:

• Right to Access & Review: Users may review their registered details anytime through their account profile desk.
• Right to Correction & Updating: Operators and citizens can update center names, physical addresses, phone numbers, and passwords directly via self-service profile modules.
• Right to Erasure & Account Deletion: Users may request complete deletion of their account records and contact details by contacting the Grievance Officer.
• Right to Grievance Redressal: Users have the right to register complaints regarding data processing and receive time-bound remediation.

8. Grievance Redressal Officer (Mandatory Statutory Designation)

Pursuant to Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 13 of the Digital Personal Data Protection Act, 2023, the designated Grievance Redressal Officer for the National Schemes Portal is:

9. Updates & Amendments to this Policy

We reserve the right to amend or update this Privacy Policy to reflect platform enhancements, operational upgrades, or amendments to Indian digital laws. Any significant updates will be notified on the portal home banner and updated with a revised effective date.