Data Protection Policy

Lekhan Kala

Document Title: Data Protection Policy
Organization: LekhanKala.org
Effective Date: August 2026
Approved By: Board of Directors

1. Purpose

LekhanKala.org (“the Organization”) is committed to safeguarding the privacy, confidentiality, integrity, and security of all personal data entrusted to us.
This Data Protection Policy sets out the principles, responsibilities, and procedures for handling personal data in line with international best practices, including the European Union General Data Protection Regulation (GDPR) where applicable.
The Organization recognizes that responsible data management is essential to maintaining the trust of all stakeholders, including children, parents, educators, volunteers, donors, staff, partners, and the wider community.

2. Scope

This Policy applies to:
• Board Members
• Employees
• Volunteers
• Consultants
• Interns
• Contractors
• Partner organizations processing data on behalf of LekhanKala.org
• All information systems operated by or for the Organization
• All personal data processed in paper or electronic form.

This Policy covers data collected through:
• The LekhanKala.org website
• Online registration forms
• School programs
• Writing clubs
• Creative writing workshops
• Journalism programs
• Training events
• Volunteer programs
• Partnerships
• Research activities
• Grant applications
• Email communications
• Social media interactions
• Surveys
• Newsletters

3. Objectives

The objectives of this Policy are to:
• Protect personal information.
• Ensure lawful and transparent processing.
• Promote accountability.
• Reduce privacy risks.
• Strengthen organizational governance.
• Protect children’s information.
• Support international partnerships.
• Demonstrate compliance with recognized privacy standards.

4. Legal and Regulatory Framework

Where applicable, LekhanKala.org seeks to align its data protection practices with:
• Regulation (EU) 2016/679 (General Data Protection Regulation)
• UK GDPR (where applicable)
• Applicable laws of Nepal
• International child protection and privacy principles
• ISO/IEC 27701 Privacy Information Management principles
• ISO/IEC 27001 Information Security principles

5. Definitions

Personal Data
Any information relating to an identified or identifiable natural person.
Processing
Any operation performed on personal data, including collection, storage, use, disclosure, transfer, deletion, or destruction.
Data Subject
An individual whose personal data is processed.
Controller
The organization determining the purposes and means of processing personal data.
Processor
A third party processing personal data on behalf of the controller.
Special Category Data
Sensitive information requiring enhanced protection, where applicable under relevant law.

6. Data Protection Principles

LekhanKala.org shall process personal data according to the following principles:
Lawfulness, Fairness and Transparency
LekhanKala.org shall collect personal information lawfully and process it fairly, with clear information provided to individuals.
Purpose Limitation
Personal data shall only be collected for specified, explicit, and legitimate purposes.
Data Minimization
Only the minimum amount of personal information necessary shall be collected.
Accuracy
Reasonable steps shall be taken to ensure information remains accurate and up to date.
Storage Limitation
Personal information shall not be retained longer than necessary.
Integrity and Confidentiality
Appropriate technical and organizational measures shall protect personal information.
Accountability
The Organization shall maintain records demonstrating compliance with this Policy.

7. Lawful Basis for Processing

Where GDPR applies, personal data will be processed on one or more lawful bases, including:
• Consent
• Performance of a contract
• Compliance with legal obligations
• Protection of vital interests
• Public interest tasks
• Legitimate interests, balanced against individual rights

9. Children’s Data

Because LekhanKala.org works extensively with children and young people, it will apply additional safeguards.
The Organization shall:
• Act in the best interests of children.
• Seek parent or guardian consent where appropriate.
• Limit data collection to what is necessary.
• Avoid unnecessary publication of children’s personal information.
• Protect children’s photographs and media.
• Implement child safeguarding measures in all relevant programs.

10. Collection of Personal Data

Information shall be collected through lawful and transparent means, including:
• Website forms
• Event registrations
• Volunteer applications
• School program registrations
• Surveys
• Newsletters
• Partnership agreements
• Direct communication
• Publicly available sources where appropriate
Individuals will be informed of the purposes for which their data is collected and used.

11. Use of Personal Data

Personal data may be used to:
• Deliver educational programs
• Coordinate volunteers
• Organize events
• Communicate with participants
• Respond to inquiries
• Manage partnerships
• Process applications
• Improve services
• Produce anonymized reports and statistics.
• Meet legal and contractual obligations.
Personal data will not be used for incompatible purposes without an appropriate legal basis.

12. Data Security

LekhanKala.org shall implement appropriate safeguards, including:
• Strong password practices
• Multi-factor authentication where feasible
• Role-based access controls
• Secure storage
• Encryption where appropriate
• Regular software updates
• Secure backups
• Malware protection
• Secure disposal of records
• Staff and volunteer awareness training

13. Data Sharing

Personal information shall only be shared when:
• Authorized by the individual;
• Required by law;
• Necessary to deliver services;
• Required by a funding or contractual obligation;
• Shared with trusted service providers under appropriate contractual safeguards.
The Organization will not sell personal data.
14. International Data Transfers
Where personal data is transferred internationally, the Organization shall take reasonable steps to ensure an appropriate level of protection through contractual, organizational, or technical safeguards.

15. Data Retention

The Organization will retain personal information only as long as necessary to fulfill its intended purposes or comply with legal, contractual, or organizational requirements.
The Organization will document retention periods in its Data Retention Schedule.

16. Disposal of Data

When personal data is no longer required, it will be securely disposed of using methods appropriate to the medium, such as secure deletion of electronic data and secure destruction of paper records.

17. Data Subject Rights

Where applicable, individuals may request:
• Access to their personal data.
• Correction of inaccurate information.
• Erasure of personal data.
• Restriction of processing.
• Data portability.
• Objection to processing.
• Withdrawal of consent where processing is based on consent.
The Organization will address requests promptly and in accordance with applicable law.

18. Data Breaches

Report any suspected or confirmed personal data breach immediately through the Organization’s incident reporting process.
The Organization shall:
• Assess the incident.
• Contain the breach.
• Investigate the cause.
• Mitigate harm.
• Notify affected parties or regulators where legally required.
• Implement corrective actions.

19. Roles and Responsibilities

Board of Directors
The Board provides strategic oversight of data protection governance.
Executive Director
The Executive Director is responsible for implementing this Policy and allocating appropriate resources.
Staff and Volunteers
All personnel must:
• Protect personal information.
• Follow organizational policies.
• Report incidents promptly.
• Complete required training.
• Maintain confidentiality.
Third Parties
Service providers processing personal data on behalf of LekhanKala.org must comply with contractual privacy and security obligations.

20. Training and Awareness

Appropriate data protection training will be provided to staff, volunteers, interns, and others who handle personal data. Regular refresher training and awareness resources will also be available.

21. Monitoring and Compliance

Compliance with this Policy shall be monitored through periodic reviews, internal assessments, and corrective actions where necessary.
Non-compliance may result in disciplinary action, contractual remedies, or other appropriate measures.

22. Policy Review

This Policy shall be reviewed at least annually or sooner if:
• Applicable laws change;
• Organizational activities change significantly;
• New technologies are introduced;
• A significant data protection incident occurs.

23. Contact Information

Questions regarding this Policy or requests relating to personal data should be directed to:
Executive Director
LekhanKala.org
Kathmandu, Nepal
Email: info@lekhankala.org
Website: https://lekhankala.org

24. Approval

The Board of Directors of LekhanKala.org approves this Data Protection Policy, effective as of the date stated above.
Next Review: August 2027