Privacy Policy
Last Updated: November 07, 2026 • Effective Date: January 01, 2026 • Version 2.2
Repz processes personal data strictly in compliance with India's Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
1. Information We Collect and Process
Depending on your relationship with the Platform, we process the following categories of data:
Full name, corporate email address, verified Indian mobile phone number, facility physical address, GSTIN registration number, and banking details for payout settlement.
Member name, mobile number, date of birth, emergency contact, membership duration, attendance check-in timestamps, optical QR tokens, and trainer workout progress notes.
Razorpay payment order IDs, payment transaction IDs, GST invoices, membership renewal dates, and payment channel modes (UPI, card, cash). We never store raw card CVV or PIN numbers.
IP addresses, turnstile device identifiers, browser user agent, session timestamps, and referral attribution cookies (repz_tso_ref).
2. Purpose of Data Processing
Personal data is processed exclusively for the following lawful operational purposes:
- Provisioning multi-tenant SaaS accounts and role-based permissions (Owner, Staff, Trainer, Member).
- Validating optical QR and turnstile access for gym club admission.
- Dispatching transactional automated WhatsApp payment reminders and renewal receipts.
- Processing partner referral attribution and commission calculation via Referral TSO.
- Fulfilling Indian statutory tax compliance under GST SAC 999723.
3. Technical Security Safeguards
All data transmitted to and from Repz is encrypted in transit using TLS 1.3 / HTTPS. Databases are encrypted at rest using AES-256 encryption standards. Webhook events and authentication tokens utilize HMAC-SHA256 signatures with constant-time equality checks.
4. Your Rights under the DPDP Act 2023
Data principals are entitled to the following statutory rights:
- Right of Access & Summary: Request an export of personal data currently processed by Repz.
- Right to Correction & Updating: Correct inaccurate or incomplete profile data.
- Right to Erasure ("Right to be Forgotten"): Request permanent deletion of personal records where continuous processing is no longer required by law.
- Right to Grievance Redressal: Submit complaints directly to our designated Data Grievance Officer.
5. Designated Grievance Redressal Officer
In accordance with the DPDP Act 2023 and Rule 5(9) of the IT Rules 2011, the details of the designated Data Grievance Officer are as follows: