Apply for funding.

The Majid Bhai Foundation decides how the personal data in this form is used. In law we are the data controller (Malaysia, UK), the data fiduciary (India) and the organisation accountable for your information (Canada).

For any privacy question or request, write to info@majidbhai.org with the subject "Privacy request". This address also reaches our privacy contact and, for India, our grievance officer.

Your name, role, email, phone, address, organisation details, the details of your event, the people it helps, your request, the documents you upload, and your declaration. Our security check also records your internet address and the time you sent the form.

We use it to:

• assess your request and contact you about it;
• pay suppliers or your organisation if we approve it, and follow up on how it was used;
• keep the records charities must keep for audit and tax;
• protect the form from spam and fraud.

Fields marked optional are optional. All other fields are needed to assess a request; if they are missing we cannot consider it. We do not ask for sensitive data such as health, religion or bank details on this form, so please do not include it.

In Malaysia, India and Canada we rely on your consent, which you give by ticking the privacy box. You may withdraw it at any time, though we can then no longer consider your request.

In the UK we rely on our legitimate interests in running a fair grant programme, on taking steps you ask for before an agreement, and on our legal duty to keep financial records. Marketing emails are sent only with your consent.

Our review team and board, and the companies that host this form, our storage and our email, under contracts that let them use it only for us. We may share it with auditors, banks handling a payment, and authorities where the law requires. We never sell or rent personal data.

The form runs on Cloudflare and our email is hosted by our email provider. Your data may be stored and processed outside your country, including in the United States, Malaysia and the European Union. Where the law requires it, we use contracts with recognised safeguards for these transfers. By ticking the privacy box you agree to this transfer.

Requests we do not fund: two years after our decision, so we can answer questions and spot duplicate requests. Requests we fund: seven years after the last payment, to meet audit and tax rules. Then we delete it securely.

Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or stop using it for updates. Depending on your country, you may also ask for a copy in a portable format, object to how we use it, or nominate someone to act for you.

We reply within 21 days for Malaysia, 30 days for Canada and India, and one month for the UK. If you are unhappy with our answer you can complain to your regulator:

• Malaysia: Personal Data Protection Commissioner (JPDP)
• India: Data Protection Board of India
• Canada: Office of the Privacy Commissioner of Canada, or your provincial commissioner
• United Kingdom: Information Commissioner's Office (ICO)
• United States: your state attorney general or privacy regulator

Your request travels encrypted and is stored with access limited to our review team. If a breach puts you at risk we will tell you and the regulator as the law requires.

Applicants must be 18 or over. If you share details of children or other people, keep them to what we need and make sure you have permission.

If this notice changes, the date at the top changes and the new version applies to requests sent after it.