Gyftport Privacy Policy

Digistashing Technologies is committed to protecting your privacy in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) of India. This Privacy Policy describes how we collect, use, share, and safeguard your personal data when you use our financial technology products and services (“Services”).

1. Scope and Applicability

This policy applies to all personal data we collect from individuals (“Data Principals”) residing in India in the context of offering fintech-related products and services, including mobile apps, web platforms, and associated services.

2. Lawful Basis and Consent

We process personal data only after obtaining clear and informed consent from you, except where processing is permitted without consent under the DPDP Act (e.g., compliance with legal obligations, public interest). You may withdraw your consent at any time by contacting us at support@digistashing.com from your registered email ID.

3. Information We Collect

a. Identity Data

• Name, Date of Birth
• Government‑issued IDs, KYC documentation

b. Contact Data

• Mobile number, Email address, Mailing address

c. Financial Data

• Bank account details, UPI IDs, credit/debit card numbers (tokenized where applicable)
• Credit score and transaction history

d. Usage and Technical Data

• Device information, browser type, IP address
• App usage, log data, location (only if explicitly permitted)

4. Purpose of Data Processing

We collect and process personal data only for the purposes mentioned below:

• To provide you access to our fintech services and platforms
• To perform identity verification and comply with RBI/KYC/AML norms
• To process transactions and maintain user accounts
• To respond to support queries and communicate with you
• For risk analysis, fraud prevention, and data security
• For legal or regulatory compliance as required by law

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your data only under the following circumstances:

• With regulated financial institutions and payment gateways for service delivery
• With data processors, under strict confidentiality and contractual safeguards
• With law enforcement or government authorities, when legally mandated
• During mergers, acquisitions, or business restructuring (with prior notice)

We ensure that all processors and third parties adhere to data protection obligations under the DPDP Act.

6. Data Storage and Retention

We retain your personal data only as long as necessary for the purposes stated in this policy or as required by applicable law (e.g., RBI‑mandated retention periods). After this period, data is securely deleted or anonymized.

7. Rights of the Data Principal

Under the DPDP Act, you have the following rights:

• Right to Access your personal data
• Right to Correction of inaccurate or incomplete data
• Right to Erasure of personal data (subject to legal retention)
• Right to Grievance Redressal in case of dissatisfaction
• Right to Nominate another individual to exercise rights in case of death or incapacity

To exercise any of your rights, please write to our Grievance Redressal Officer:

8. Security of Your Data

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. This includes data encryption, access control, and regular audits.

9. Cross‑Border Data Transfers

Where we transfer data outside India (e.g., to cloud service providers), we ensure such transfers are compliant with DPDP rules and are made to countries or organizations with adequate data protection frameworks, or with your explicit consent.

10. Updates to This Privacy Policy

We may revise this policy from time to time. When we do, we will notify you via email or through our platform and update the “Effective Date” at the top of this page.

11. Contact Information

For any queries, concerns, or requests regarding this Privacy Policy or your rights under the DPDP Act, please contact:

Grievance Redressal Officer

We will acknowledge your grievance within 24 hours and aim to resolve it within 7 business days, as per DPDP guidelines. If you are unsatisfied with our resolution, you may escalate the issue to the Data Protection Board of India, once operational.