Privacy Policy

1. Definitions

For the purposes of this Policy, the following terms shall have the meanings assigned to them below:

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023.
• "Sensitive Personal Data" means personal data pertaining to financial information (such as bank account, credit/debit card details), health and medical data, biometric data, sexual orientation, and such other categories as may be prescribed under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) or subsequently notified by the Central Government under applicable law.
• "Data Principal" means the individual to whom the personal data relates.
• "Data Fiduciary" / "Company" / "We" / "Us" means Vouchagram India Pvt. Ltd. (operating as GyFTR), which alone or in conjunction with others determines the purpose and means of processing of personal data.
• "Data Processor" means any person who processes personal data on behalf of the Company, pursuant to a contract or otherwise.
• "Processing" means any operation or set of operations performed on personal data, and includes collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment, combination, sharing, disclosure, erasure, or destruction.
• "Consent" means a freely given, specific, informed, unconditional, and unambiguous indication of the Data Principal’s wishes by which they, through a clear affirmative action, signify agreement to the processing of their personal data.
• "DPDP Act" means the Digital Personal Data Protection Act, 2023, as amended from time to time.
• "DPDP Rules" means the Digital Personal Data Protection Rules, 2025, as amended from time to time.
• "Board" / "DPBI" means the Data Protection Board of India, established under the DPDP Act.

2. Identity of Data Fiduciary & Contact Details

3. Scope of this Policy

This Policy applies to all personal data collected, stored, processed, or shared by Vouchagram India Pvt. Ltd. in the course of its business operations. It governs personal data collected through:

• Our websites, including www.gyftr.com and all associated sub-domains;
• Our mobile applications (iOS and Android);
• Our APIs and integrations with partner platforms;
• Offline channels, including physical forms, in-store interactions, or telephone-based collection; and
• Third-party sources, including payment gateways, brand partners, logistics providers, and data brokers, where such sharing is lawful.

For data collected offline or through third parties, users will receive a Notice and consent will be obtained through the channel appropriate to that interaction.

4. Personal Data We Collect

Depending on how you use our services, we may collect the following categories of personal data:

We do not collect personal data beyond what is necessary for the stated purposes. You may choose not to provide certain data, but this may affect your ability to use some of our services.

4A. Cookies & Tracking Technologies

We use the following categories of cookies on our platforms:

• Strictly Necessary Cookies: Required for the operation of our website and cannot be switched off. These do not require your consent.
• Functional Cookies: Enable enhanced functionality and personalization. Your consent is sought before these are placed.
• Analytics / Performance Cookies: Allow us to measure and improve the performance of our website. Your consent is sought before these are placed.
• Marketing / Targeting Cookies: Used to deliver relevant advertisements. Your consent is sought before these are placed.

You may manage your cookie preferences at any time through your browser settings or our cookie preference centre. Withdrawing consent for non-essential cookies will not affect your access to core services.

5. Notice

In accordance with Section 5 of the DPDP Act, we will provide you with a clear, plain-language Notice at or before the time we seek your Consent to process your personal data. The Notice will:

• Be written in English. Upon request, we will endeavor to provide the Notice in any language included in the Eighth Schedule to the Constitution of India;
• Itemize the personal data proposed to be collected and the specific purposes for which it will be processed;
• Describe the rights available to you as a Data Principal; and
• Explain how you may access this Privacy Policy and withdraw consent.

Where we had previously collected your personal data before the commencement of the DPDP Act, we will provide you with such a Notice and seek fresh consent as required by applicable law and the transition provisions under the DPDP Rules.

6. Consent

We process your personal data on the basis of your Consent or on the basis of Certain Legitimate Uses as set out in Section 7 of the DPDP Act.

How We Obtain Consent

Consent is obtained through an explicit affirmative action, such as:

• Checking a consent checkbox on our website or mobile application;
• Clicking an ‘Accept’ or ‘I Agree’ button presented alongside the relevant Notice; or
• OTP-based verification, where applicable.

Consent so obtained shall be: (a) freely given; (b) specific to the stated purpose; (c) informed; (d) unconditional; and (e) unambiguous, in accordance with Section 6(1) of the DPDP Act.

Withdrawal of Consent

You have the right to withdraw your Consent at any time by adjusting your preferences in your account settings or by writing to our Grievance Officer. Withdrawal of Consent shall not affect the lawfulness of processing carried out prior to such withdrawal, nor shall it restrict our ability to process your data where such processing is otherwise permitted under applicable law.

7. Purposes of Processing & Lawful Basis

We process your personal data only for specified, clear, and lawful purposes under the DPDP Act. The table below sets out each purpose and the applicable legal ground:

8. Retention of Personal Data

We will retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy our contractual obligations, comply with applicable legal requirements, resolve disputes, and enforce our agreements.

Our retention periods are determined by the nature of the data and the purpose of processing. In general:

• Transactional and financial data is retained for a minimum of seven (7) years in accordance with applicable tax and financial regulations;
• Account data is retained for the duration of your account and for a reasonable period thereafter for audit and security purposes;
• Marketing preference records are retained until withdrawal of consent.

Once personal data is no longer required, it will be securely deleted, destroyed, or anonymised so that it can no longer be associated with you. If you request erasure of your personal data, we will comply within the period prescribed under the DPDP Rules (or within thirty (30) days where no such period has been prescribed), subject to any legal obligations requiring us to retain the data.

9. Sharing, Disclosure & Transfer of Personal Data

9.1 Sharing with Third Parties

We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• Service Providers and Data Processors: payment processors, logistics and fulfilment providers, customer support platforms, IT infrastructure providers, and analytics vendors;
• Affiliates and Subsidiaries: entities within the Vouchagram group of companies, for internal business and operational purposes;
• Brand and Merchant Partners: for fulfilment of vouchers and gift cards redeemed on their platforms, only to the extent necessary;
• Law Enforcement and Regulatory Authorities: where required or permitted by applicable law, court order, or regulatory directive; and
• Professional Advisers: lawyers, auditors, and consultants, under binding duties of confidentiality.

All Data Processors are required to process personal data only on our documented instructions, and are bound by contractual obligations consistent with the requirements of the DPDP Act.

9.2 Cross-Border Transfers

Personal data shall not be transferred outside the territory of India except to countries or territories notified by the Central Government of India under Section 16 of the DPDP Act. Any such transfer will be made subject to the conditions and safeguards prescribed under the DPDP Act and the DPDP Rules, as amended from time to time.

Until the Central Government publishes the list of notified countries, we will process your personal data primarily within India. In the event any cross-border transfer becomes necessary, we will ensure compliance with the prevailing requirements under the DPDP Act before effecting such transfer.

10. Security of Personal Data

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

Notwithstanding the foregoing, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will promptly notify the relevant authorities in the event of a breach as required by law.

11. Personal Data Breach Notification

In the event of a personal data breach, the Company shall, without undue delay, notify the Data Protection Board of India, in the manner and within the timelines prescribed under Section 25 of the DPDP Act and the DPDP Rules.

Notification to affected Data Principals shall be carried out as directed by the Data Protection Board of India following its assessment of the breach. We will cooperate fully with the Board in any investigation and take all reasonable steps to mitigate the impact of any breach on affected individuals.

12. Your Rights as a Data Principal

As a Data Principal under the DPDP Act, you have the following rights:

1. Right to Access Information (Section 11, DPDP Act): You may obtain from us: (a) a summary of the personal data we hold about you and the processing activities undertaken in relation to it; and (b) the identities of all Data Processors and other entities to whom your personal data has been shared.
2. Right to Correction and Erasure (Sections 12–14, DPDP Act): You have the right to request that we: (a) correct any inaccurate or misleading personal data; (b) complete incomplete personal data; (c) update your personal data; and (d) erase personal data that is no longer necessary for the purpose for which it was collected, or for which consent has been withdrawn, subject to applicable legal retention obligations.
3. Right to Grievance Redressal (Section 15, DPDP Act): You have the right to have your grievances addressed by us within the timelines prescribed under the DPDP Rules. If your grievance is not resolved to your satisfaction, you have the right to register a complaint directly with the Data Protection Board of India.
4. Right to Nominate (Section 16, DPDP Act): You have the right to nominate any individual of your choice to exercise your rights under this Policy and the DPDP Act in the event of your death or incapacity. To register a nominee, please write to our Grievance Officer. Instructions and the nomination form are available on request.
5. Right to Withdraw Consent: Where processing is based on your Consent, you may withdraw that Consent at any time through your account settings or by contacting our Grievance Officer. Withdrawal of Consent will not affect the lawfulness of prior processing.

How to Exercise Your Rights

To exercise any of the rights above, please contact our Grievance Officer at:

We will acknowledge your request promptly and respond within the timelines prescribed under the DPDP Rules. If you are not satisfied with our response, you may register a complaint with the Data Protection Board of India.

13. Processing of Children’s Personal Data

We do not knowingly collect or process personal data of children (individuals below the age of 18 years) without obtaining verifiable consent from their parent or lawful guardian, in compliance with Section 9 of the DPDP Act.

Age Verification and Parental Consent

When you access or use our services, we will ask you to confirm your age. If you are below 18 years of age, we will seek verifiable consent from your parent or lawful guardian before processing your personal data. Verifiable consent will be obtained through one or more of the following mechanisms:

• OTP-based verification sent to the parent’s or guardian’s registered mobile number or email address;
• Digital signature or such other electronically verifiable means as may be prescribed under the DPDP Rules; or
• Such other mechanisms are notified by the Central Government from time to time.

Restrictions on Processing Children’s Data

In accordance with Section 9(3) of the DPDP Act, we shall not:

• Track the behavior or monitor children across other websites or online services;
• Undertake targeted advertising directed at children; or
• Process children’s data in any manner that is likely to cause detrimental effect on their wellbeing.

If we become aware that we have inadvertently collected personal data from a child without the required verifiable parental consent, we will promptly delete such data and may restrict access to our services pending compliance.

14. Automated Decision-Making & Profiling

Where the Company uses automated processing, including profiling, in a manner that produces decisions with a legal or similarly significant effect on you (for example, fraud scoring or creditworthiness assessments), we will:

• Inform you that such automated decision-making is being applied to your personal data;
• Provide a plain-language explanation of the logic involved, upon your request;
• Provide a mechanism for you to request human review of any such decision; and
• Provide a mechanism for you to opt out of such processing, where required by law.

15. Duties of Data Principals

In accordance with Section 15 of the DPDP Act, as a Data Principal, you undertake the following duties when interacting with our platforms and services:

• You shall not impersonate another person while providing your personal data for any document, unique identifier, proof of identity, or proof of address;
• You shall not suppress any material information while providing personal data for any document, unique identifier, proof of identity, or proof of address;
• You shall not register a false or frivolous complaint or grievance with us or with the Data Protection Board of India;
• You shall provide only such information as is true, correct, and complete at the time of submission; and
• You shall comply with all applicable laws while exercising your rights under the DPDP Act.

Non-compliance with the above duties may constitute a contravention under the DPDP Act and may attract penalties as prescribed therein.

16. Significant Data Fiduciary Obligations

In the event the Company is designated as a Significant Data Fiduciary (“SDF”) by the Central Government under Section 10 of the DPDP Act, the Company shall comply with all additional obligations prescribed thereunder, which may include:

• Appointment of a Data Protection Officer (“DPO”) resident in India, who shall be responsible for ensuring compliance with the DPDP Act and shall serve as a point of contact for the Data Protection Board;
• Appointment of an independent Data Auditor to conduct periodic audits of the Company’s data processing practices;
• Conducting periodic Data Protection Impact Assessments (“DPIA”) in respect of processing activities that are likely to cause high risk to the rights of Data Principals; and
• Such other obligations may be prescribed by the Central Government or the Data Protection Board.

This Section will be updated promptly upon any such designation.

17. Governing Law & Construction

This Policy is governed by and shall be construed in accordance with the laws of India, including but not limited to the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the rules and regulations made thereunder.

The Company may, to the extent relevant to its international operations or contractual obligations, also align its data protection practices with applicable international standards such as the General Data Protection Regulation (GDPR) of the European Union. Nothing in this Policy shall be construed as an express representation of compliance with any foreign law unless otherwise stated in writing by the Company.

This Policy shall be updated to reflect any future amendments to the DPDP Act, rules made thereunder, or other applicable legislation.

18. Jurisdiction

Any dispute, controversy, or claim arising out of or relating to this Policy or any breach thereof shall be subject to the exclusive jurisdiction of the competent courts at New Delhi, India.

19. Changes to this Policy

We may update this Policy periodically to reflect changes in our data processing practices, applicable law, or regulatory guidance. We will notify you of any material changes through:

• A prominent notice on our website (www.gyftr.com);
• A push notification or in-app banner on our mobile applications; or
• Direct communication to your registered email address.

The “Last Updated” date at the top of this Policy will be revised accordingly. Continued use of our services after the effective date of any revised Policy will constitute your acceptance of the changes, to the extent permitted by law.

20. Grievance Redressal

If you have any questions, concerns, or complaints regarding this Policy or our data processing practices, please contact our Grievance Officer:

If your complaint is not resolved to your satisfaction by our Grievance Officer, you have the right to register a complaint with the Data Protection Board of India (DPBI) at the link / address notified by the Board from time to time.