Eternal Foundation Terms and Policies | Transparency, Governance & Compliance

This Privacy Policy (Policy) outlines the data processing practices of the Eternal General Service Foundation (Foundation, we, us, or our), acting in its capacity as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act).

As a subsidiary of Eternal Limited, the Foundation houses and operates various charitable, medical, and social initiatives, including but not limited to the charitable initiatives (such as Blinkit ambulance service and Feeding India). Our services may be accessed directly, via our offline operations, or facilitated through third-party platforms operated by Eternal Limited and its affiliates (such as Zomato, Blinkit, District or Bistro).

This Policy governs the collection, use, sharing, and retention of your Personal Data once it is in the possession and control of the Foundation. Where services are accessed via third-party platforms, please review their privacy policies to understand how data is initially collected and transmitted to us.

This section applies to individuals who request, use, or are the subject of our medical, emergency, and ambulance services (Service User or Data Principal).

A.1. Personal Data We Process

In the course of providing emergency services, we process the following categories of Personal Data:

•

Identity and Contact Data: Name, mobile number, and specific pickup location or address.

•

Health and Medical Data: Reported emergency nature, patient condition, vitals monitored during transit, symptoms, age, gender, medical history, allergies, medications, emergency treatment details, pregnancy or breast feeding information, and ancillary information captured as part of the medical process.

•

Audio-Visual and Surveillance Data (CCTV): Video and audio recordings captured via CCTV cameras installed inside and outside ambulances and call recordings.

•

Logistical Data: Real-time GPS tracking of the ambulance and destination medical facility details.

•

Third-Party or Caller Data: Identity and contact data of caller or bystander initiating request on behalf of another individual, including relationship with the patient.

A.2. Basis and Purpose of Processing

•

Consent and Deemed Consent (Legitimate Uses): In emergencies where explicit consent is impossible or impracticable, we process Personal Data under certain legitimate uses defined under the DPDP Act to respond to immediate threat to life or health.

•

Proxy Consent: We may rely on consent provided by a relative, legal guardian, or caller acting in the best interest of the patient.

•

Service Provision and Coordination: Data is used to dispatch ambulances, provide paramedic interventions, and share critical vitals with destination hospital.

•

Safety and Quality Assurance: CCTV footage is processed for patient and paramedic safety, quality auditing, training, and dispute or legal claim resolution.

A.3. Data Disclosure

We disclose this data on a need-to-know basis to paramedic and transport personnel, receiving hospitals and medical centers, relevant technology platforms for live service updates, and law enforcement or regulatory authorities where legally mandated.

This section applies to donors, beneficiaries, event attendees, and volunteers participating in our philanthropic initiatives.

B.1. Personal Data We Process

•

Donor and Financial Data: Name, email, phone number, billing address, and PAN for issuing Section 133 (erstwhile Section 80G) tax exemption certificates.

•

Engagement and Volunteer Data: Volunteer history, event attendance, dietary preferences for event catering, and communication preferences.

•

Media and Event Data: Photographs, videos, and audio captured during volunteer drives, distribution events, fundraisers, and awareness campaigns.

B.2. Basis and Purpose of Processing

•

Legal Obligation: PAN and billing details are processed to comply with the Income Tax Act, 2025 and associated reporting obligations.

•

Consent and Contractual Necessity: Processing donation transactions, resource allocation, volunteer logistics, and issuance of receipts.

•

Media Waiver and Promotional Use: By registering and attending events, individuals consent to image, likeness, and voice capture for impact reporting and awareness, subject to on-site opt-out for close-up captures.

To facilitate services and fulfill operations, we may disclose Personal Data to affiliates and group entities, service providers and vendors, legal and regulatory authorities, professional advisors, and in connection with business transfers, each subject to applicable law and contractual safeguards.

This section applies to employees, independent contractors, consultants, and registered long-term volunteers (Personnel).

D.1. Personal Data We Process

We process identity and contact data, professional data, financial data (for payroll and reimbursements), and dependent data for health insurance and benefits administration.

D.2. Purpose of Processing

This data is processed for HR administration, recruitment, payroll, statutory labor law compliance, and access to Foundation IT systems and facilities.

E.1. Data Security

The Foundation implements robust physical, electronic, and managerial safeguards to prevent unauthorized access, accidental loss, alteration, or destruction of Personal Data. Payment processing is facilitated through PCI-DSS compliant third-party gateways.

E.2. Data Retention

Personal Data is retained as long as necessary for stated purposes or legal requirements. CCTV footage is generally retained for a limited period (typically up to 90 days), unless flagged for investigation. Tax and financial records are retained as per statutory mandates (typically up to 8 years).

E.3. Updates to this Policy

We may amend this Policy to reflect operational changes, new initiatives, or legal developments. Material changes will be communicated through website or affiliated platforms.

E.4. Grievance Officer

To exercise rights, report a breach, or raise concerns regarding this Policy, contact our designated DPO at dpo@zomato.com.

Privacy Policy