Privacy Policy

1. Who We Are

Gigoe Private Limited ("Gigoe", "we", "us") is the Data Fiduciary in respect of personal data processed through the Gigoe mobile application and website (collectively, the "Platform"). Our registered office is at Plot No. 38, Kale Lay Out, GODHANI ROAD, ZINGABAI TAKLI, Mankapur (Nagpur), Nagpur - 440030, Maharashtra, India.

This Privacy Policy describes what personal data we collect, how we use it, whom we share it with, how long we retain it, and the rights available to you under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian law.

2. Data We Collect

3. Purposes and Legal Basis

We process your personal data on the legal basis of your consent, obtained at the time of registration and, where applicable, again at the time of DigiLocker verification. Processing is limited to the following purposes:

• Providing the Platform's core marketplace functions (matching, dispatch, notifications);
• Verifying User identity where required;
• Enforcing skill-specific minimum age at Job dispatch;
• Managing the Provider Wallet, processing top-ups, and deducting Platform Fees;
• Preventing fraud, abuse, and violation of these Terms;
• Responding to grievances and legal requests;
• Complying with applicable law.

We do not use your personal data for marketing, advertising, profiling, or sale to third parties.

4. Sharing with Third Parties (Data Processors)

We use a small number of processors to operate the Platform. Each receives only the data necessary for its function and is contractually restricted in its use:

• Amazon Web Services (AWS) — infrastructure hosting (compute, storage, database) in the ap-south-1 (Mumbai) region.
• MSG91 — SMS delivery for one-time passwords and notifications. Receives the recipient's phone number and message body only.
• Firebase Cloud Messaging (Google LLC) — push notification delivery. Receives device tokens and notification payloads only.
• Razorpay — payment aggregator for Provider Wallet top-ups. Receives payment order details (amount, order id, contact for receipt). Does not receive Worker verification data.
• DigiLocker (Meripehchaan, Government of India) — identity verification source. Data flows from DigiLocker to Gigoe (not the reverse).

We do not sell, rent, or commercially transfer your personal data to any third party.

5. Data Retention

• Account data (phone, name, email, city) — retained for as long as the account is active.
• Verification indicator, verified date of birth, verified gender (Workers) — retained for as long as the account is active. Deleted on account deletion.
• DigiLocker OAuth tokens — encrypted; erased on any terminal outcome of the verification lifecycle (verified, permanent failure, or attempts exhausted).
• Transient verification data (Aadhaar number, address, photograph, DigiLocker-returned full-name comparison) — discarded immediately after the verification outcome is recorded; not written to durable storage.
• Wallet transactions — retained for the period required under Indian tax and audit law, currently a minimum of 8 years.
• Audit logs — retained for a rolling operational window (typically 90 days), excluding secrets and identity content.

6. Security Safeguards

• Transit: All User-facing traffic uses HTTPS (TLS 1.2 or higher). Backend-to-DigiLocker and backend-to-Razorpay traffic uses HTTPS.
• Storage: Volume-level encryption at the storage layer; application-layer encryption (Jasypt) for sensitive fields including DigiLocker OAuth tokens.
• Passwords: Ops portal passwords stored as one-way BCrypt hashes (cost factor 12). Plain-text passwords are never stored, logged, or transmitted.
• Access control: Role-based authorisation with declarative annotations at the controller layer. Separate JWT signing keys for mobile and ops portal.
• Audit logging: Verification attempts and ops actions are logged. Aadhaar numbers, OAuth tokens, DigiLocker photographs, and passwords are excluded from all log surfaces by policy.
• Network isolation: Database ports not exposed to the public internet; SSH access is key-based only.

Full technical detail is available in Gigoe's Data Protection & Security Statement, available on request.

7. Your Rights (DPDP Act, 2023)

As a Data Principal under the DPDP Act, you have the following rights:

• Right to access — request a summary of the personal data we hold about you, including your verification status.
• Right to correction — request correction of factual inaccuracies in your account data.
• Right to erasure — request deletion of your account and associated personal data.
• Right to withdraw consent — withdraw consent for DigiLocker verification (which removes the verification indicator, verified date of birth, and verified gender) without deleting your overall account.
• Right to grievance redressal — raise concerns via the Grievance Officer contact in Section 10 of this Policy or Section 15 of our Terms & Conditions.

To exercise any of these rights, contact contact@gigoe.in. We will acknowledge your request within a reasonable time and act on it consistent with the DPDP Act.

8. Children's Data

The Platform is not intended for children under 14. Workers between the ages of 14 and 17 may register only in compliance with the Child Labour (Prohibition and Regulation) Amendment Act, 2016 and only for non-hazardous skills for which they meet the applicable minimum age. Gigoe enforces age eligibility at the point of Job dispatch based on the verified date of birth.

9. International Transfers

Personal data collected by Gigoe is stored and processed within India (AWS ap-south-1 region). We do not transfer personal data outside India except where legally required or where a specific processor (e.g. Firebase Cloud Messaging) operates from outside India — in such cases, only the minimum data strictly required for that processor's function is transmitted.

10. Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000:

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Platform. The "Last Updated" date at the top of this Policy will reflect the effective date of the most recent revision.

12. Contact

For any questions regarding this Privacy Policy, contact contact@gigoe.in.