Privacy Policy

1. Introduction & Identity of Data Controller

This Privacy Policy ('Policy') governs the collection, use, processing, storage, and disclosure of personal data by GigVyne, a Private Limited Company incorporated under the Companies Act, 2013, with its principal place of business in Pune, Maharashtra, India.

GigVyne operates a three-sided digital marketplace connecting college students ('Students'), small and medium enterprises ('SMEs'), and educational institutions ('Colleges') for the purpose of project-based gig work. By accessing or using the Platform, you consent to the practices described in this Policy.

2. Applicable Laws & Regulatory Framework

• Information Technology Act, 2000 and its amendments
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
• Digital Personal Data Protection Act, 2023 — compliance in effect upon operationalisation of Rules
• Indian Contract Act, 1872 — governing consent and contractual obligations
• Payment and Settlement Systems Act, 2007 — applicable to escrow and payment processing
• Reserve Bank of India (RBI) guidelines on payment aggregators and escrow accounts
• Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020
• Central Goods and Services Tax Act, 2017 — applicable to platform fee transactions

3. Data We Collect

3.1 Students

• Full name, date of birth, gender, college name, course, year of study
• Email address and mobile number
• Government-issued identity proof (Aadhaar, PAN, or Passport) for KYC
• Bank account details and UPI ID for payment disbursement
• Skills, portfolio links (GitHub, Behance, CodeChef, HackerRank, Substack)
• Gig history, ratings, reviews, tier level, earnings data, and platform service fee records
• Device identifiers, IP address, and usage logs

3.2 SMEs / Businesses

• Company name, CIN, GSTIN
• Authorised representative name, designation, email, and mobile
• Bank account details for escrow payments
• Gig postings, hiring history, tier level, and review data

3.3 Financial Transaction Data

GigVyne processes and stores financial data related to both SME platform fees and Student platform service fees. This includes escrow deposit amounts, fee deduction records, payout amounts, GST invoice data, and refund records. This data is retained for 8 years as required under the Income Tax Act, 1961 and GST laws.

4. Purpose of Data Processing

• Account creation, verification, and authentication
• Matching students to relevant gig opportunities based on skill tier and rating
• Processing escrow payments, SME platform fee collection, and Student service fee deductions through RBI-compliant payment infrastructure
• Administering the tiered fee system for both SMEs and Students
• Communicating gig updates, fee statements, payout notifications, and tier upgrade alerts
• Fraud detection, dispute resolution, and platform safety
• KYC and AML compliance
• Analytics and platform improvement
• College dashboard reporting on student earnings, tier distribution, and skill demand
• Legal compliance and responding to lawful government requests

5. Sensitive Personal Data or Information (SPDI)

In accordance with the IT (SPDI) Rules, 2011, financial information including bank account numbers, escrow transaction records, platform fee records, and government-issued identity documents are treated as Sensitive Personal Data. GigVyne will obtain prior written consent before collecting SPDI and will not retain such data beyond the period necessary for the stated purpose.

6. Data Sharing & Disclosure

• With SMEs — student profile data (skills, ratings, tier level, portfolio) shared when shortlisted for a gig
• With Students — SME gig posting data and review history shared on platform
• With Colleges — aggregate and anonymised earnings, tier distribution, and skill data shared under signed MOU
• With Payment Partners — financial data shared with Razorpay or equivalent for escrow and fee processing
• With Tax Authorities — GST-related transaction data as required under CGST Act, 2017
• With Legal Authorities — in response to lawful court orders or government directions under the IT Act or CrPC

7. Data Retention Policy

• Active user accounts — duration of account plus 3 years post-closure
• Financial transaction records including fee deductions — 8 years as required under Income Tax Act, 1961 and GST laws
• KYC documents — 5 years from onboarding as per PMLA guidelines
• Dispute records — 3 years from resolution
• Server logs — 90 days rolling

8. Data Security

• SSL/TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls limiting internal data access
• Regular security audits and vulnerability assessments
• Incident response protocols for data breach notification within 72 hours

9. User Rights

• Right to Access — request a copy of personal data including fee and transaction records
• Right to Correction — request correction of inaccurate data
• Right to Erasure — request deletion subject to legal retention requirements
• Right to Withdraw Consent — withdraw consent at any time subject to consequences for platform functionality
• Right to Grievance Redressal — raise complaints with our Grievance Officer at grievance@gigvyne.com

10. Cookies Policy

GigVyne uses essential, analytical, and functional cookies. You may control cookie preferences through your browser settings. We do not use third-party advertising cookies.

11. Children's Privacy

The GigVyne Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal data from minors under 18. If you believe a minor has provided personal data, contact grievance@gigvyne.com immediately.

12. Grievance Officer

• Email: grievance@gigvyne.com
• Address: GigVyne, Pune, Maharashtra, India
• Response time: Within 48 hours of receipt

13. Amendments

GigVyne reserves the right to update this Privacy Policy at any time. Material changes will be notified via email or platform notification at least 15 days before taking effect. Continued use constitutes acceptance of the revised Policy.