Who we are
This policy explains how {{Your Company Private Limited}} ("Data Fiduciary") processes your personal data when you use Giftbaaz, in line with the Digital Personal Data Protection Act, 2023 (DPDP Act).
Data we collect and why
- Mobile number — to create your account and log you in with an OTP.
- Name and email (optional) — to personalise your account and email your vouchers.
- Order and payment details — to fulfil orders, process refunds, prevent fraud and meet tax/accounting obligations. We never see or store your card details.
- Linked loyalty account (with your explicit consent) — your masked phone, coin balance and the history of coins you redeem with us, so you can pay with coins.
- Device and log data (IP, device type) — for security, abuse prevention and troubleshooting.
Consent
We link a loyalty account only after you tick an explicit consent box. You can withdraw consent any time by unlinking from Wallet or Account; this does not affect past orders.
Retention
- Account data: while your account is active, and up to 30 days after a deletion request.
- Order, payment and invoice records: as required by tax and accounting law (typically 8 years).
- Security logs: up to 180 days.
Security
Voucher codes are encrypted at rest (AES-256-GCM) and masked until you reveal them. Phone numbers are masked in logs.
Your rights
You may access, correct and erase your personal data, withdraw consent, nominate another person, and raise a grievance. Use Account → Request account deletion, or email support@giftbaaz.in.
Grievance officer
{{Name}} <support@giftbaaz.in>. We respond within the time required by law. If unsatisfied, you may approach the Data Protection Board of India.