DPDP Act Compliance Statement

The DPDP Act, 2023 is India's primary law governing digital personal data. It applies to processing within India and to processing outside India where it relates to offering goods or services to individuals located in India — which covers LoyltWorks' operations across India, the GCC, Southeast Asia, and Africa wherever Indian Data Principals' data is involved.

The Act establishes the Data Protection Board of India as the regulator responsible for adjudicating non-compliance, and prescribes penalties of up to ₹250 crore per breach for failure to implement adequate safeguards. Its core pillars are: lawful, purpose-limited processing; free, specific, informed, unconditional and unambiguous consent; defined rights for Data Principals; clear obligations for Data Fiduciaries; and heightened protection for children's data.

This statement applies to personal data we process in connection with: Business Clients who use our platform to run loyalty programs; Loyalty Members who enrol in and participate in those programs; Channel Partners and Trade Influencers enrolled in partner or influencer programs; Employees and Contractors, including job applicants; and Website Visitors who access loylt.works or our apps.

We process personal data only on one of the following lawful grounds recognised by the DPDP Act:

• Consent (Section 6): our primary basis for processing data of loyalty members, channel partners, and visitors — always free, specific, informed, unconditional, and given through a clear affirmative action, never a pre-ticked box.
• Legitimate Uses (Section 7): limited circumstances such as employment-related HR processing, compliance with a court order, or processing required by law.
• Contractual Necessity: processing required to perform our contract with you, such as operating your loyalty account, crediting points, and processing redemptions.

We apply the data minimisation principle, collecting only what is necessary, adequate, and relevant for a specified purpose. Our collection fields are reviewed annually and unnecessary fields are removed and deleted.

LoyltWorks operates a Consent Management Platform that handles the full lifecycle of consent in line with Section 6 of the DPDP Act:

• A clear, plain-language Notice is shown before or at the time data is collected, describing what is collected, why, and with whom it may be shared;
• Consent is captured through a deliberate affirmative action — never a pre-ticked box or implied consent;
• Where data is processed for multiple purposes, we seek granular, separate consent for each;
• Every consent interaction is logged with a timestamp, the exact notice shown, and the method of affirmation, and retained for 3 years from withdrawal or expiry;
• Data Principals can view, manage, and withdraw consent at any time through their account, or by emailing us — withdrawal is effective within 7 business days and does not affect the lawfulness of prior processing;
• Where a program is designed for younger members, we require verifiable parental consent before any data is collected, and apply age-gating on registration flows.

Chapter III of the DPDP Act grants you the following rights, which we are committed to facilitating promptly.

You may exercise these rights via your account's "My Privacy Settings," or by contacting us using the details in Section 17. We acknowledge requests within 48 hours and respond substantively within 30 calendar days (extendable by up to 30 further days for complex requests, with reasons given). We may request reasonable identity verification before fulfilling a request.

Section 8 of the DPDP Act sets out our general obligations. We implement each as follows:

Section 9 of the DPDP Act imposes heightened obligations regarding children's (under-18) data. We do not process a child's personal data without verifiable consent from a parent or legal guardian, and we apply age-gating across all registration flows.

In compliance with Section 9(3), we strictly prohibit: behavioural tracking or monitoring of children across our properties; targeted advertising directed at children; and any processing likely to cause detriment to a child's well-being. If we discover that a child's data has been inadvertently collected without valid consent, we suspend all processing of it immediately and delete it within 48 hours of discovery.

We retain personal data only for as long as necessary for its purpose, or as required by Indian law. Once a retention period expires, data is securely erased using cryptographic deletion or overwriting methods; aggregated, fully anonymised data may be retained indefinitely for analytics.

We primarily store and process personal data in India, at data centres located in Mumbai and Bengaluru. In limited circumstances, data may be processed by cloud or technology providers in Singapore and the United Arab Emirates to support our infrastructure and regional operations — both currently permissible under applicable Government notifications.

For any cross-border transfer, we ensure the receiving country is not on any Central Government restricted list, that contractual safeguards equivalent to the DPDP Act are in place (including Standard Contractual Clauses where applicable), and that Data Principals are informed of the jurisdictions involved at the time consent is sought. We review our transfer arrangements periodically and will halt any transfer immediately upon a relevant Government restriction being notified.

In line with Section 8(5) of the DPDP Act, we maintain a multi-layered security programme: AES-256 encryption at rest and TLS 1.3 in transit, with additional field-level encryption for sensitive data; role-based access control and mandatory multi-factor authentication; ISO 27001-certified cloud infrastructure with automated failover; annual independent penetration testing; real-time AI-powered fraud and anomaly detection; SOC 2 Type II certification audited annually; mandatory employee data-protection training; and security assessments of every third-party processor before engagement.

In the event of a personal data breach, we follow a structured response: real-time detection and immediate containment by our Incident Response Team; a preliminary assessment of the breach's scope and likely consequences; notification to the Data Protection Board of India within the timeline prescribed under applicable DPDP Rules; clear, plain-language notification to affected Data Principals describing what happened and what they should do; and a post-incident remediation and review process, with findings documented and shared with the Board as required.

Section 10 of the DPDP Act allows the Central Government to designate certain Data Fiduciaries as Significant Data Fiduciaries (SDFs) based on the volume and sensitivity of data processed and the associated risk. We monitor these criteria on an ongoing basis and have proactively implemented several SDF-grade practices ahead of any formal designation, including appointing an India-based Data Protection Officer. Should we be designated an SDF, we are prepared to appoint an independent Data Auditor, conduct periodic Data Protection Impact Assessments, and implement any further measures prescribed by the Board or Central Government.

We operate a two-tier grievance process in line with Section 13 of the DPDP Act:

• Tier 1 — LoyltWorks DPO: submit your grievance using the contact details in Section 17. We acknowledge within 48 hours and aim to resolve within 30 calendar days, extendable by up to 30 further days for complex matters with reasons provided.
• Tier 2 — Data Protection Board of India: if unresolved at Tier 1, you may appeal to the Board under Section 19 of the DPDP Act. We cooperate fully with any Board inquiry or proceeding.

We engage third-party processors — cloud infrastructure, payment and banking partners, communication gateways, KYC providers, analytics platforms, and support tools — only under written Data Processing Agreements requiring them to process data solely on our documented instructions, maintain equivalent security standards, notify us immediately of any breach, assist with Data Principal rights requests, and delete or return data on termination.

In the interest of transparency, the DPDP Act prescribes penalties of up to ₹250 crore for inadequate security safeguards, up to ₹200 crore for breach-notification failures or non-compliance with children's data obligations, and up to ₹10,000 crore for non-compliance with a voluntary undertaking accepted by the Board. We disclose this to underscore the seriousness of our compliance commitment, not because we anticipate non-compliance.

We review this statement at least annually, and whenever there is a material change to our data processing activities, our processors, or the DPDP Act and its Rules. Where a change is material, we will provide at least 15 days' advance notice to registered users before it takes effect; minor or clarificatory updates will simply be reflected with a revised date above.

If your grievance with LoyltWorks remains unresolved after 30 days, you may file a complaint with the Data Protection Board of India at www.meity.gov.in. The Board is the statutory authority under the DPDP Act, 2023, empowered to adjudicate complaints and impose remedies. LoyltWorks will cooperate fully with any Board proceedings.

This statement should be read alongside our DPDP Compliance and Terms & Conditions.
© 2026 Loyltworks IT Private Limited. All rights reserved.