Privacy Policy

The controller. KSIJ Connect and KSIJ Careers (the "Services") are owned and operated by Bibi Khadijah Al Kubra Foundation, a non-profit public charitable trust registered in India under the Maharashtra Public Trusts Act, 1950 (Registration No. E-34286 (M)), whose registered office is at 124, 42, Manju Tower CHS Ltd, J.P. Road, Nr. High Point Hotel, Andheri-W, Mumbai - 400 058, India ("we", "us", "our" or the "Trust"). We decide why and how your personal data is processed. We are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

What it covers. This Policy explains how we collect, use, share, protect and keep personal data when you use the Services, visit our websites, contact us, or are mentioned by a Member. It applies to Members, people who begin to sign up, and anyone who contacts us.

What it does not cover. This Policy does not cover what other organisations do with your data, including: Employers after they receive your application (their own privacy policies apply); Google, One ID or other services you choose to sign in with; or websites we link to.

Our approach. We collect only what we need to run a trusted community network, we use it only for the purposes described here, and we give you real control. Where the law in your country gives you more protection than this Policy describes, you have that protection.

Who builds the Services for us. The Services are developed and maintained for the Trust by Bibi Khadijah Al Kubra Foundation (in-house development team) (the "Developer") under a written development and data processing agreement. The Developer is our Data Processor: it may access personal data only as needed to build, fix and support the Services, only on our instructions, and never for its own purposes.

The World Federation. The World Federation supports the Services as a facilitator and endorser, and assists with listing the apps on app stores. It is not a controller or processor of your personal data in the Services and has no access to it. Section 18 explains this further.

Data you give us.

Data we collect automatically. When you use the Services, we collect: device and browser type; IP address and approximate location derived from it (country or city level only); dates and times of access; pages and features used; referring pages; error and performance logs; and security signals such as failed sign-in attempts. We do not collect your precise location, and we do not access your phone contacts, camera roll or microphone except where you actively choose to upload a file.

Data we receive from others.

• Google or One ID: if you sign in with them, your name, email address, profile picture and a unique identifier, in line with the permissions you grant them.
• Other Members: endorsements, appreciations, mentions, messages, and reports that concern you.
• Employers: the status of your application, where the Employer updates it in KSIJ Careers.
• Public authorities: lawful requests and orders that concern you.

Data we do not want. Please do not give us, or post on the Services, information about your health, sexual life, financial accounts, government identity numbers (such as Aadhaar, PAN or passport numbers), criminal records, or children. We do not need it and the Services are not designed to hold it. If we find it, we may delete it.

The table below lists each purpose, the data involved, and our legal basis. Under the DPDP Act, we rely on your consent unless a "legitimate use" under section 7 of the Act applies.

No other purposes without telling you. If we want to use your personal data for a new purpose that is not compatible with those above, we will tell you first and, where required, ask for your consent.

What we never do. We never use your personal data for advertising, never sell it, never rent it, never share it with data brokers, and never build profiles of you for anyone else's marketing.

Clear, separate choices. When we ask for consent, we will tell you exactly what data we will use and why, in a separate notice, and we will ask for each optional purpose separately. We will never pre-tick consent boxes.

Withdrawing consent. You can withdraw any consent at any time, as easily as you gave it, from your privacy settings or by writing to admin@ksijyouth.com. Withdrawal does not affect processing that took place before you withdrew.

Consent Managers. Once Consent Managers registered with the Data Protection Board of India are available, you may also give, review and withdraw your consent to us through a Consent Manager of your choice.

What withdrawal means in practice.

• Withdrawing optional consents, such as CV review or community updates, simply turns those features off.
• The Services exist only for members of our community, so we cannot provide them without processing your community affiliation and gender. If you withdraw consent to that processing, we will close your Account and delete your data as described in section 12.

Why we need it. The Services are a closed community network. To run them, we must process the fact that you belong to the Khoja Shia Ithna-Asheri community, which reveals your religious belief, and your gender, which drives the etiquette features.

Explicit consent. We process it only with your explicit consent, given separately when you sign up. You can withdraw that consent at any time, with the consequence explained in section 5.4.

Extra protection. Community affiliation and gender are used only for access control and the features described in this Policy. They are never used for advertising, never shared outside the purposes described here, and are protected by the security measures in section 11.

Recommendations. We suggest Members, mentors, opportunities and content based on information such as your profession, industry, city, Jamaat, skills and activity on the Services. We do not use your community affiliation to rank people against each other. You can limit suggestions in your settings.

The feed. The feed shows posts from Members in a largely chronological order. We may group posts, limit repetitive posts, and demote content that has been reported or that breaches the Community Guidelines. We do not optimise the feed to maximise time spent.

AI Features. Where you choose to use CV review, the relevant data is processed by our AI provider(s) listed in section 9. We require them: to process data only to provide the feature to you; not to use it to train their models; and to delete it within the periods set out in section 12.

No solely automated decisions. We do not make any decision about you based solely on automated processing, including profiling, that has legal effects on you or similarly significantly affects you. Decisions to decline or close an Account are made by a person. Hiring decisions are made by Employers. Moderation decisions on Account closures are reviewed by a person.

Your rights about automated processing. You may ask us to explain how a suggestion or ranking affecting you was produced, to have a person review it, and to object to profiling based on our legitimate interests.

Other Members. Other Members can see the parts of your profile and Content that your visibility settings allow. If you choose same-gender discovery, Members of another gender will not find you in search, the directory, suggestions or mentor lists. Accounts awaiting review cannot see other Members.

Message recipients. People you message can see your messages and the profile details shown with them.

Jamaats. We do not share your personal data with any Jamaat. If you name your Jamaat on your profile, other Members can see it according to your visibility settings.

Mentors and Mentees. When you request or accept mentorship, the other person sees your profile details and the booking information needed for the session.

Employers and opportunity posters. Employers, and Members who post opportunities, see your application and the copy of your CV sent with it only when you apply to their opportunity. They never see your CV review results. Once they receive your application, they are responsible for it as an independent controller or data fiduciary.

Our developer and service providers. The Developer, our in-house development team, and the processors listed in section 9 process data only on our instructions, under written contracts that require confidentiality, security and deletion.

Legal and safety disclosures. We may disclose personal data where we reasonably believe it is required by law, by a court order or by a lawful request from a government authority; to protect the life, safety or rights of any person; to detect or prevent fraud or security threats; or to establish, exercise or defend legal claims. Where lawful and safe, we will tell you about a request that concerns you before we disclose. We review each request and push back on requests that are unlawful or too broad.

Business continuity. See section 20.

Who does not receive your data. The World Federation does not receive or have access to Members' personal data from the Services, including when it assists with listing the apps on app stores. No Jamaat, advertiser, data broker or marketer receives your data from us. Members of other Jamaats and countries can see your profile only according to your visibility settings.

We use the following categories of processors. The current list, with each provider's name and location, is kept at ksijconnect.com/sub-processors, and we will update it before adding a new provider.

Each processor is bound by a data processing agreement requiring it to process data only on our instructions, keep it confidential and secure, notify us promptly of any breach, help us respond to your requests, use sub-processors only with safeguards, and delete or return data when the service ends.

Where your data is stored. Your data is stored and processed in India. Because the community is worldwide, Members and processors may be located in other countries, and viewing a profile from another country is a transfer of data to that country.

Transfers from India. We transfer personal data outside India only to countries not restricted by the Government of India under section 16 of the DPDP Act, and with appropriate contractual safeguards.

Consent to international processing of sensitive data. Some countries require consent before sensitive personal data leaves the country. Because the Services connect Members worldwide, we ask everyone, at sign-up, for consent to their community affiliation and gender being stored in India and seen by Members in other countries according to their visibility settings.

Our safeguards. We use technical and organisational measures appropriate to the sensitivity of the data, including:

• encryption of data in transit (TLS) and at rest;
• access to production data limited to named personnel who need it, protected by strong authentication, and logged;
• access controls enforced on the server, so that visibility and etiquette rules apply across every feature;
• role-based access, so that the Developer's staff and our moderators see only what they need for their task;
• regular backups, tested restoration and change control;
• security logging and monitoring, with logs kept for the periods in section 12;
• security testing and prompt remediation of vulnerabilities;
• written confidentiality obligations on everyone who handles personal data;
• data processing agreements with every processor.

No system is perfectly secure. We cannot guarantee that personal data will never be accessed without authorisation. You can help by keeping the account you sign in with (Google, Apple or One ID) secure, and by keeping your devices secure.

If there is a personal data breach. If a breach affects your personal data, we will:

• tell you without delay, in plain language, what happened, what data was involved, the likely consequences, what we are doing about it, what you can do to protect yourself, and whom to contact;
• inform the Data Protection Board of India without delay, and provide a detailed report within 72 hours of becoming aware of the breach, or any longer period the Board allows;
• report cyber security incidents to CERT-In within 6 hours where required by its directions;

We keep personal data only for as long as we need it for the purposes in this Policy, or as long as the law requires. The table below sets out our standard periods.

Legal holds. We may keep data for longer where we must preserve it because of a court order, a lawful request, an ongoing investigation or a legal claim. We delete it once the hold ends.

Aggregated data. We may keep aggregated statistics that cannot identify you, such as the number of Members per city, for as long as they are useful.

Rights under India's DPDP Act. If you are a Data Principal under the DPDP Act, you have the right to:

• access information: a summary of the personal data we process about you and the processing activities; and the identities of the Data Fiduciaries and Data Processors with whom it has been shared, with a description of what was shared;
• correction, completion and updating of inaccurate or incomplete personal data;
• erasure of personal data that is no longer needed, or where you withdraw consent, unless the law requires us to keep it;
• grievance redressal: to have your complaint about our handling of your data resolved by us;
• nominate another individual to exercise your rights if you die or become unable to exercise them; and
• withdraw consent at any time.

Everyone gets the same core rights. Wherever you live, we will honour requests for access, correction, deletion, portability and withdrawal of consent, as a matter of our own policy. Annex B sets out additional information for the United Arab Emirates, Pakistan, Australia, New Zealand and other countries.

How to exercise your rights. Use the tools in your privacy settings (download your data, edit your profile, delete your Account, manage consents), or write to admin@ksijyouth.com. We may need to verify your identity before acting, and we will ask only for what is necessary to do so.

Timelines. We aim to respond within 30 days, and in every case within the period required by the law that applies to you.

No charge. We do not charge for rights requests, unless a request is manifestly unfounded or excessive, in which case we may refuse it or charge a reasonable fee where the law allows, and we will explain why.

Your duties under the DPDP Act. The DPDP Act also asks Data Principals to: give accurate information; not impersonate anyone; not suppress material information when providing personal data for an official document; not register a false or frivolous grievance or complaint; and give only verifiably authentic information when asking us to correct or erase data. Breaching these duties may attract a penalty under the Act.

The Services are for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18, and we do not track, profile or target children. If we learn that we have collected personal data from someone under 18, we will delete it promptly. If you believe a child has used the Services, please contact admin@ksijyouth.com.

If you are the lawful guardian of an adult with a disability who is unable to make decisions for themselves, and you wish to create or manage an Account on their behalf, please contact admin@ksijyouth.com first. We will ask for evidence of your guardianship, as required by the DPDP Act and Rules, before accepting consent from you.

Strictly necessary. We use cookies and similar technologies that are strictly necessary to sign you in, keep your session secure, remember your settings and protect against fraud. These cannot be switched off without breaking the Services.

Analytics. We do not use analytics cookies.

No advertising trackers. We do not use advertising cookies, tracking pixels from advertising networks, or cross-site tracking.

Browser privacy signals. We honour Global Privacy Control and similar browser signals as an opt-out of any sale, sharing or targeted advertising, although we do none of these.

Service messages. We send messages that are necessary to run your Account, such as account updates, security alerts, notifications you have chosen, and notices of changes to our Terms or this Policy. You cannot opt out of essential service and security messages while your Account is open.

Community updates. We send newsletters and community updates only if you opt in, and every such message includes a way to unsubscribe.

WhatsApp and SMS. We contact you by WhatsApp or SMS only if you have agreed to it, and in line with applicable telecommunications rules.

The World Federation. The World Federation supports the Services as a facilitator and endorser, and assists with listing the apps on app stores. It does not own or operate the Services, does not receive or have access to Members' personal data from them, and no funds pass between it and the Trust. If this ever changes, we will update this Policy, tell you in advance, and ask for your consent where required.

Jamaats. We do not share Members' personal data with Jamaats, and Jamaats have no access to the Services' data.

One ID. When sign-in with One ID becomes available, the World Federation will act as the provider of your One ID identity and will be responsible for your One ID account as an independent data fiduciary or controller. Before you use it, we will show you a notice explaining what information is exchanged between One ID and the Services, and you will be able to choose whether to use it.

App stores. If you download our apps from the Apple App Store or Google Play, the store operator processes your data under its own policies. Where a store shows the World Federation as an app's publisher, this does not give the World Federation access to your data in the Services.

We will never sell your data. Personal data is not an asset we will sell, including in any sale, merger or restructuring.

If the Services move to another organisation. The Services may be transferred only to a successor that agrees to be bound by this Policy, or to another non-profit body with similar charitable objects, including Khoja Shia Ithna-Asheri Jamaat, Mumbai, or an entity it nominates. We will tell you at least 30 days in advance, and you may download and delete your data before the transfer.

If the Services close. If we decide to close the Services, we will give you at least 60 days' notice where possible, the chance to download your data, and we will then delete personal data, except for data we must keep by law, or transfer it under section 20.2 only if you have not asked us to delete it.

Privacy questions and requests: admin@ksijyouth.com

Grievance Officer (India).

• Name: Asad Sayed
• Email: asad.sayed@ksijyouth.com
• Address: 124, 42, Manju Tower CHS Ltd, J.P. Road, Nr. High Point Hotel, Andheri-W, Mumbai - 400 058

Data protection contact. Asad Sayed, admin@ksijyouth.com

Local representatives, officers and registrations. Where the law of a country requires us to appoint a local representative or officer, or to register with a regulator, the details are in Annex B.

Escalation in India. If you are not satisfied with how we have handled your grievance, you may complain to the Data Protection Board of India once you have used our grievance process. For decisions about Content or Accounts, you may appeal to the Grievance Appellate Committee within 30 days of our decision.

Escalation elsewhere. Wherever you live, you may complain to your national data protection authority; Annex B lists the main ones. We would appreciate the chance to resolve your concern first.