Merchant Data Rights

1. Your Rights Under DPDP Act 2023

Under India's Digital Personal Data Protection Act 2023, merchants whose personal data is processed by LetLoyal have the following rights:

• Access — request a summary of personal data we hold about you or your business.
• Correction — ask us to correct inaccurate or incomplete business or personal information.
• Erasure — request deletion of your merchant account and all associated personal data.
• Portability — request an export of your business data (customer visit counts, redemption records) in a machine-readable format.
• Grievance redressal — raise a complaint and receive a substantive response within 30 days.

2. What Data We Hold About Merchants

We hold the following personal and business data for merchants:

• Business name, category, and description.
• Merchant email address and hashed password.
• QR code identifiers and loyalty programme configuration.
• Aggregated visit and redemption counts.

We do not hold merchant bank account details or financial information on the LetLoyal platform.

3. How to Exercise Your Rights

To make any data rights request, email hello@letloyal.com with the subject line "Data Rights Request — [Your Business Name]". We will acknowledge your request within 48 hours and respond substantively within 30 days.

4. Grievance Officer

LetLoyal is operating as an invite-only pilot and is in the process of formal incorporation. All grievances are handled by the founding team.
Email: hello@letloyal.com
Response time: Acknowledged within 48 hours; resolved within 30 days.
Note: Legal entity name, CIN, and registered address will be updated upon incorporation.

5. Data Breach Notification

In the event of a personal data breach affecting your merchant account, LetLoyal will notify you at your registered email address within the timeframe required by the DPDP Act 2023.