SahYogi Privacy Policy & Consent Notice

This Privacy Policy and Consent Notice (“Privacy Policy”) is issued by SahYogi InfraCare Pvt. Ltd. (“SahYogi”, “we”, “us”, or “our”) pursuant to Section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) notified by the Ministry of Electronics and Information Technology on 13 November 2025.

This Privacy Policy governs the collection, use, storage, sharing and erasure of digital personal data across two platforms operated by SahYogi:

• the SahYogi website at sahyogi.net.in; and
• the SahYogi mobile application, available on Google Play (“SahYogi App”),

(together, the “Platforms”), through which SahYogi connects gig workers with businesses seeking staffing, facility-management and hospitality support (“Gig-Work Services”).

This notice is presented as a standalone document, independent of any other terms of service or agreement, in accordance with Rule 3(a) of the DPDP Rules, so that it can be read and understood on its own.

This Policy applies to:

• Gig workers who register on the SahYogi App to find work assignments;
• Visitors to the SahYogi website who submit enquiries for services or staffing;
• Prospective and existing business clients who engage SahYogi for staffing, hospitality or facility-management mandates, to the extent their personnel or authorised representatives share personal data with us.

Each of the above is a “Data Principal” under the DPDP Act. The SahYogi App and website are intended for use by individuals aged 18 years and above. See Clause 9 (Children and Persons with Disabilities) for further detail.

In compliance with Rule 3(b) of the DPDP Rules — which requires an itemised description of personal data, the specified purpose(s) of processing, and a description of the goods, services or uses enabled — the table below sets out what we collect, where, why, and under what legal basis.

4.1 Aadhaar Masking Protocol

In strict compliance with UIDAI directives and Section 8(1) of the DPDP Act:

• We accept only Masked Aadhaar copies (the first 8 digits obscured) or Virtual IDs (VIDs) within the SahYogi App.
• We do not extract, store or process raw 12-digit Aadhaar numbers or biometric data linked to Aadhaar.
• Any unmasked Aadhaar document inadvertently uploaded is automatically redacted or erased.

4.2 Financial & Educational Records

PAN details, bank/UPI details, and educational certificates uploaded through the App are stored using bank-grade encryption (AES-256 at rest, TLS 1.3 in transit) and access is restricted through Role-Based Access Control (RBAC) on a strict need-to-know basis, as part of the “reasonable security safeguards” required under Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules.

Because SahYogi operates a job-matching platform, certain personal data is necessarily shared with the businesses to which a gig worker is assigned, and with our verification and payment partners. We share only what is necessary for the specified purpose:

• Name, photograph, verified credentials and relevant work history are shared with a client business at the time of a work assignment, so that the business can confirm the worker's identity and suitability.
• Bank/UPI details are shared only with our payment-processing partner for the purpose of wage disbursement, and are not shared with client businesses.
• Attendance and performance data recorded during an assignment may be shared with the relevant client business and used internally to compute payouts and ratings.

SahYogi does not sell or trade personal data for marketing purposes, and does not share Aadhaar, PAN or bank details with client businesses.

SahYogi's data may be stored or processed using cloud infrastructure providers that operate data centres in India. Where any processing occurs outside India, it is undertaken only in accordance with Section 16 of the DPDP Act. As of the date of this Policy, the Central Government has not yet notified a list of restricted countries or territories under Section 16; this Policy will be updated to reflect any such notification once issued.

We retain personal data only for as long as necessary to fulfil the specified purpose or to satisfy a statutory retention requirement (e.g., 8 years for PAN/financial records under tax law). Once the purpose is fulfilled and no legal retention obligation applies, data is erased or anonymised.

Where SahYogi is required to erase personal data on the expiry of a defined retention period, and the Data Principal has not accessed the Platform or otherwise exercised their rights within that period, we will send a reminder at least 48 hours before erasure, in accordance with Rule 8 of the DPDP Rules, giving the Data Principal an opportunity to log in and retain the data if they wish.

In accordance with Rule 6 of the DPDP Rules, we implement reasonable technical and organisational safeguards, including encryption, access controls, monitoring for unauthorised access, and retention of relevant logs to enable detection and investigation of a personal data breach.

If a personal data breach occurs, SahYogi will, without delay, notify affected Data Principals with a description of the breach and its likely consequences, and will report the breach to the Data Protection Board of India within the timelines prescribed under the DPDP Rules.

The SahYogi App and Gig-Work Services are intended for individuals aged 18 years and above and are not directed at children. We do not knowingly collect personal data of a child (a person below 18 years of age) or undertake tracking, behavioural monitoring, or targeted advertising directed at children, in accordance with Section 9 of the DPDP Act.

Where the processing of personal data of a person with a disability who has a lawful guardian is undertaken, such processing will be carried out with the consent of the lawful guardian, in accordance with Section 9(5) of the DPDP Act and the DPDP Rules.

Before collecting personal data for a new purpose, we present a notice that (a) is understandable independently of any other document, (b) itemises the personal data sought and the specified purpose(s), in plain language, and (c) provides a direct link within the App to withdraw consent, exercise your rights, or raise a grievance — as required by Rule 3 of the DPDP Rules.

Consent given by you is free, specific, informed, unconditional and unambiguous, indicated by a clear affirmative action, and limited to the personal data necessary for the specified purpose. You may withdraw consent at any time through the SahYogi App settings, with the withdrawal process being as simple as the process by which consent was given.

As and when the Consent Manager framework under the DPDP Rules becomes operational (the DPDP Rules provide for this from November 2026), SahYogi will update its consent-collection mechanisms accordingly and this Policy will be revised to reflect integration with a registered Consent Manager, where applicable.

We do not sell or trade personal data collected via the Platforms. Data is shared only with:

• Authorised Data Processors: cloud infrastructure providers, KYC verification partners, and payment-processing services, each bound by contract to implement security controls under Section 8(2) of the DPDP Act;
• Client businesses: strictly to the extent described in Clause 5, for the purpose of a specific gig-work assignment;
• Statutory and regulatory authorities: where legally mandated.

Under Chapter III of the DPDP Act, you have the following rights in respect of your personal data processed via the Platforms:

In accordance with Section 5(3) of the DPDP Act, this Privacy Policy and Consent Notice is made available on sahyogi.net.in and within the SahYogi App in English and, on request, in any of the 22 languages specified in the Eighth Schedule to the Constitution of India.

The Platforms may contain links to social media profiles or external partner sites. SahYogi does not control, and is not responsible for, the privacy practices of such external sites.

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law, including further rules, schedules or guidance issued under the DPDP Act. The “Last updated” date at the top of this Policy will be revised accordingly, and material changes will be notified to you through the SahYogi App or by email prior to taking effect.

In accordance with Section 8(10) of the DPDP Act, you may direct any query, consent-withdrawal request, or grievance to our Grievance Officer:

Grievance Officer: Mr. Amit Tiwari
Entity: SahYogi InfraCare Pvt. Ltd.
Address: 3rd Floor, Rolex Square, City Centre, Gwalior – 474011, Madhya Pradesh, India
Email: amit.tiwari@sahyogi.net.in
Response Time: Grievances will be acknowledged and addressed within 30 days of receipt.

If you are not satisfied with the resolution provided, you may escalate your complaint to the Data Protection Board of India through its official online portal.