DPDP Act 2023 compliance

Version 2.0. This version takes effect on 27 October 2026. It replaces the previous version from this date.

How Margifi meets its obligations under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules"), and how you can exercise your rights as a Data Principal.

1. Who we are and our role

Margifi Private Limited, with its office at 230, Ayodhyapuram Residency, Nr Valak Patiya, Valak, Surat City, PO: Sarthana, Dist: Surat, Gujarat 395006, India, runs the Margifi platform. Our role depends on whose data it is:

• Margifi is the Data Fiduciary for its own account, billing, website (margifi.com visitors), support and lead data. We decide why and how this data is processed, as described in our Privacy Policy.
• The brand (our Client) is the Data Fiduciary for its end customers' data, such as orders, phone numbers, WhatsApp messages and consent records. Margifi is a Data Processor for this data and acts only on the brand's documented instructions, as set out in our Data Processing Agreement.

2. Scope

This page summarises, in plain language, how Margifi applies the DPDP Act and DPDP Rules to two categories of personal data: (a) data of our account holders, website visitors and leads, and (b) the end-customer data our Clients process through Margifi Insights, Engage, Inbox, Intelligence and Margifi ID. It supplements, and does not replace, our Privacy Policy, DPA and Grievance Policy.

3. Lawful basis and consent

For data where Margifi is the Data Fiduciary, we process personal data on the lawful bases recognised by the DPDP Act: your free, specific, informed and unambiguous consent, and the "legitimate uses" permitted under Section 7 (such as providing a service you asked for). Every consent request comes with a clear notice that states what data we collect, the purpose, and how to withdraw consent. Withdrawing consent is as easy as giving it.

For end-customer data, the brand is responsible for having a lawful basis and for collecting and keeping consent, including WhatsApp opt-in records. Margifi helps by storing consent and opt-out records and by suppressing an opted-out number in Engage within 1 minute of the opt-out.

4. Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access a summary of the personal data processed about you and how it is processed.
• Correction, completion, updating, and erasure of your personal data.
• Withdraw consent at any time, without affecting processing done before withdrawal.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal through our Grievance Officer, and escalation to the Data Protection Board of India.

To exercise any of these rights, email admin@margifi.com or use the controls in your account settings (see our Data deletion page). We acknowledge privacy requests within 7 business days and complete them within 30 days.

If you are a customer of a brand that uses Margifi, the brand handles your request. If you send it to us, we forward it to the brand within 3 business days and help the brand respond.

5. How we safeguard your data

We apply reasonable security safeguards as required by Section 8(5) of the DPDP Act and the DPDP Rules:

• Customer email addresses are stored only as hashes. Customer phone numbers are stored encrypted (AES-256) for the brand's own follow-up list, with every reveal logged, and are otherwise used as keyed hashes. Where an advertising platform requires it (e.g. Meta's Conversions API), conversion-match keys are hashed with the platform-mandated SHA-256 instead: still one-way, still never raw.
• Data in transit is encrypted with TLS; data at rest is encrypted by our infrastructure providers.
• Each client's data is isolated at the row level; one account can never read another's data.
• Access to production data is restricted, logged, and granted on a least-privilege basis.

More detail is on our Security page.

6. Margifi ID network

Margifi ID is a cross-brand COD risk network. It works on these rules:

• A brand's courier and order outcome signals join the network only if the brand gives explicit consent, using the toggle shown when it connects a courier.
• Shopify order data from brands that installed Margifi through the Shopify App Store never joins the network.
• Every phone number is keyed on a salted HMAC-SHA-256 hash. No plaintext phone number is shared.
• Other brands see only a risk tier for a phone number. They never see raw data or which brand the signal came from.

More detail is on our COD Intelligence page.

7. Data residency and cross-border transfers

Our main database, which holds personal data at rest, is hosted in India (Mumbai region). Some sub-processors, such as hosting, email, error monitoring, analytics and AI providers, process limited data outside India under contractual data-protection safeguards. WhatsApp data passes through Meta's servers, which may be outside India, under Meta's terms as provider of the WhatsApp Business Platform. Margifi transfers personal data only to countries that are not restricted by the Central Government under Section 16 of the DPDP Act. Our current sub-processors and their regions are listed on our Sub-processors page, which forms part of our Data Processing Agreement.

8. Data retention

We keep personal data only as long as it is needed for its purpose, or as required by law. In summary:

When the purpose is served and no legal retention obligation applies, we erase the data or keep it only in keyed-hash or aggregate form that cannot identify you.

9. Children and persons with a guardian

Margifi is a business tool not directed at children. We do not knowingly process the personal data of a child (under 18) or of a person with a lawful guardian without verifiable consent of the parent or guardian as required by Section 9 of the DPDP Act, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

10. Grievance redressal and the Data Protection Board

Margifi has appointed a Grievance Officer to handle questions and complaints about personal data: Dwarkesh Savaliya, Grievance Officer (Data Protection), Margifi Private Limited, at admin@margifi.com or the address above, Monday to Friday, 10:00 to 18:00 IST (excluding Indian public holidays). We acknowledge grievances within 24 hours (working days), resolve privacy and data grievances within 15 days and other grievances within 30 days. If you are not satisfied, you may escalate to the Data Protection Board of India under the DPDP Rules. Full details are in our Grievance Policy.

11. Personal data breach notification

• Brand data we process: if a breach affects data we process for a brand, we notify the affected brand with an initial notice within 48 hours and full details within 72 hours of becoming aware of it, and help the brand meet its own duties to notify.
• Data where Margifi is the Data Fiduciary: we notify each affected Data Principal and the Data Protection Board of India in the manner and within the timelines the DPDP Rules require.
• Brands must tell us within 24 hours of a breach on their side that affects Margifi systems or credentials.

12. Changes to this page

We may update this page as the law and our practices change. Material changes are sent to registered users by email and shown in the dashboard at least 14 days before they take effect, and the version and date above will change.

Version history

• Version 2.0, 27 October 2026 (effective 27 October 2026): roles clarified (Margifi as Data Fiduciary for its own data and Data Processor for brand data); DPDP Rules 2025 referenced; privacy request timelines (7 business days to acknowledge, 30 days to complete); end-customer requests forwarded to brands within 3 business days; Margifi ID consent rules; data now hosted in India (Mumbai); retention summary; Grievance Officer details and timelines; breach notice timings.
• Previous version, 5 October 2026.