Statutory Privacy Policy & Data Governance Charter

Preamble & Statutory Scope

1.1 This Statutory Privacy Policy & Data Governance Charter ("Charter") governs the collection, processing, storage, and protection of data acquired through the Amrit Poshan Vatika mobile and web portal ecosystem, operated under the administrative mandate of the Department of Women & Child Development (DWCD) / Integrated Child Development Services (ICDS), Government of Rajasthan.

1.2 This document is promulgated pursuant to Section 43A of the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

Categories of Personal & Spatial Data Collected

2.1 To fulfill state welfare obligations, the system processes specific data categories:

2.1 Beneficiary & Officer Identity Data

• Full Name, Gender, Mobile Number, and Email Address.
• Official Role Designation (Beneficiary, Anganwadi Worker, Field Officer, State Administrator).
• Administrative Jurisdictional Mapping: District, Sub-Division, Block, Gram Panchayat, Village, and Anganwadi Center Code.

2.2 Spatial & Geolocation Data

• High-precision GPS Latitude and Longitude coordinates recorded during Poshan Vatika site inspection to plot garden boundaries on the Rajasthan Geographic Information System (GIS).

2.3 Photographic & Crop Documentation

• Geotagged photographs of garden plots, vegetable crop harvests, and nutrition distribution drives.

Lawful Basis & Specified Purposes of Processing

3.1 Data processing is executed under the lawful mandate of public interest and statutory governance:

• Authentication & Access Control: Verifying officer and beneficiary identity via HMAC-SHA512 cryptographic verification and JWT access tokens.
• State Monitoring & GIS Mapping: Tracking the establishment of Anganwadi Poshan Vatikas across 33+ districts of Rajasthan.
• Nutrition Yield Analytics: Quantifying organic vegetable yields (kg) to optimize supplemental nutrition programs for pregnant women and young children.
• Official Communication: Transmitting automated SMS/push alerts regarding seed distribution, seasonal planting schedules, and government subsidies.

Security Architecture & Technical Safeguards

4.1 DWCD implements enterprise-grade security controls conforming to National Cyber Security Policy directives:

• Encryption in Transit & Rest: All web API communications are encrypted using TLS 1.3. Database records are protected within State Data Center infrastructure.
• Cryptographic Password Protection: User passwords are never retained in raw format; they are transformed via HMAC-SHA512 with per-user salt strings.
• Statutory Access Authorization: Role-Based Access Control (RBAC) strictly prevents unauthorized departmental personnel from accessing beneficiary personal data.

Non-Commercial Guarantee & Data Disclosures

5.1 Zero Monetization: Under no circumstances shall user data be sold, rented, leased, or licensed to commercial entities, advertising networks, or third-party brokers.

5.2 Inter-Departmental Disclosure: Data may be shared strictly on a need-to-know basis with partner government bodies (e.g. Department of Agriculture, Panchayati Raj) solely for scheme execution.

Statutory User Rights & Retention Schedule

6.1 In accordance with the Digital Personal Data Protection Act, 2023, data principals possess the following rights:

• Right to Review & Correction: Users may inspect and update their profile information through the mobile app or District Nodal Officer.
• Right to Erasure: Upon deactivation of beneficiary status or Anganwadi assignment, users may request profile data erasure subject to statutory audit retention laws.

Grievance Redressal & Nodal Officer Contact

7.1 For statutory grievances, data access requests, or policy clarifications, please address formal communications to the designated State Data Officer: