In order to optimize our website for you and to be able to continuously improve it, we use cookies and services from third parties. Some of these are essential to ensure the operation of the site (e.g. for the shopping cart), while others help us to improve our online offer and operate it economically. You can easily set which type of cookies and which services are allowed via the settings. Further details can be found in our privacy policy.

Settings
Download the App Now

Privacy Policy

Status: 27 September 2026

Preamble

The protection of your personal data is important to us, repalogic GmbH (hereinafter “Get Your Offers”, “we” or “us”). This privacy policy informs you about what personal data we collect, how we process and use it when you visit and use our platform (websites and mobile applications). We strictly adhere to the provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Get Your Offers is provided through two separate mobile applications: “Get Your Offers”, the consumer application, in which users discover, view, upvote and save offers and businesses; and “Get Your Offers - For Business”, the business application, in which merchants publish and manage offers for their business.

1. Name and address of the controller responsible for processing

The controller within the meaning of the GDPR is:

repalogic GmbH
Otto-Meckler-Straße 12-2
88605 Meßkirch, Germany
E-mail: datenschutz@repalogic.com
Website: https://www.repalogic.com

2. General information on data processing

a) Legal bases of processing. Insofar as we obtain the consent of the data subject for processing operations, Art. 6 para. 1 lit. a GDPR serves as the legal basis. Art. 6 para. 1 lit. b GDPR serves as the legal basis for the fulfilment of a contract or for the implementation of pre-contractual measures. To fulfil a legal obligation to which we are subject (e.g. statutory retention obligations), Art. 6 para. 1 lit. c GDPR serves as the legal basis. In order to safeguard a legitimate interest of our company or a third party, Art. 6 para. 1 lit. f GDPR serves as the legal basis, unless the interests or fundamental rights of the data subject prevail.

b) Principles of data processing. We only process data within the scope of the specified purposes. Personal and anonymised data are processed strictly separately; they are not merged.

c) Data erasure and storage duration. We only store your personal data for as long as is necessary for the respective processing purposes. Once the purpose no longer applies, the data will be deleted, provided there are no statutory retention obligations to the contrary.

d) Necessity of the provision. The provision of certain data is necessary for the use of individual functions (e.g. registration data for a user account, location data for local offers). Without this data, the respective functions cannot be used or can only be used to a limited extent. Voluntary information is labelled accordingly.

e) Processors and other recipients. We use carefully selected processors for individual processing operations (e.g. hosting, e-mail dispatch, analytics, crash reporting). These are contractually bound in accordance with Art. 28 GDPR. Where Google or Meta receive personal data, their role (processor, joint controller or independent controller) is set out in Section 10. Categories of recipients are documented in the consent tool and on request.

3. Provision of the platform and creation of log files

Each time our platform is accessed, our system automatically collects data (including IP address, date/time of access, browser type) to ensure the functionality and security of the platform. The legal basis for this processing is our legitimate interest (Art. 6 para. 1 lit. f GDPR). The data will be deleted after 14 days at the latest.

4. Registration and use of the platform

You can register on our platform in order to use its full functionality. The data you enter (user name, email address, password) will be processed to fulfil the user relationship. To protect your access data, passwords are only stored in encrypted form (as a hash value). The legal basis is the fulfilment of the user contract (Art. 6 para. 1 lit. b GDPR).

Alternatively, you can register and log in with an existing Google account (Google Sign-In) or Facebook account (Facebook Login). In this case, we receive from the respective provider the data you release to us (in particular name, email address and account or profile identifier); no password is stored by us. Details on the providers, roles and legal bases are set out in Sections 10.2 and 10.3.

5. Data processing for fee-based contracts (merchants)

a) Contract fulfilment. If you book paid premium functions as a “merchant”, we collect additional data that is necessary to fulfil the contract. This includes your name, address, company data and payment data. This data is used exclusively for contract fulfilment, invoicing and payment processing and is processed in our internal administration and accounting system (TYRIOS). The legal basis is Art. 6 para. 1 lit. b GDPR.

b) Payment service providers. We use external payment service providers (e.g. Stripe, PayPal) to process payments. Your payment data is processed directly by these service providers. As these are US companies, data may be transferred to the USA during payment processing. We ensure an adequate level of data protection by concluding EU standard contractual clauses (as a suitable guarantee in accordance with Art. 46 GDPR). We would like to point out that despite these measures, there may be a residual risk that US security authorities may gain access to the data. The transfer of your data to the service provider is based on Art. 6 para. 1 lit. b GDPR.

c) Statutory retention obligations for invoices and business documents. Once the contract has been fully processed, your data will be blocked for further use. We must store invoices and associated business documents for a period of up to 10 years due to legal requirements from the German Commercial Code (HGB) and the German Fiscal Code (AO). The legal basis for this longer storage period is the fulfilment of our legal obligations (Art. 6 para. 1 lit. c GDPR).

6. Use of data for advertising purposes

a) Newsletter. If you register for our email newsletter, we will process your email address in order to send you regular information. We use our internal system (TYRIOS), which handles the technical dispatch via the service provider SendGrid (Twilio Inc., USA). As SendGrid is a US provider, data is transmitted to the USA. We ensure an adequate level of data protection by concluding EU standard contractual clauses (as a suitable guarantee in accordance with Art. 46 GDPR). If the respective service provider is certified in accordance with the EU-US Data Privacy Framework (DPF), the transfer is also based on this. We would like to point out that despite these measures, there may be a residual risk that US security authorities may gain access to the data. If you give your consent, we will analyse for statistical purposes whether the newsletter has been opened and which links have been clicked (opening and click tracking). The legal basis for sending and measuring success is your consent (Art. 6 para. 1 lit. a GDPR), which you can revoke at any time.

b) Direct advertising for existing customers (merchants). If you have purchased a paid service from us as a merchant, we reserve the right to use your email address for direct advertising for our own similar goods or services. The legal basis for this is our legitimate interest in marketing our products (Section 7 (3) UWG, Art. 6 (1) (f) GDPR). You can object to this use at any time.

c) Advertising measurement and interest-based advertising. With your consent, we use services of Google and Meta to measure and deliver advertising. Details are set out in Section 10.

7. Location data for displaying local offers (geolocation)

Purpose: The processing serves the sole purpose of presenting you with relevant, regional offers in your area.

Procedure and legal basis: If you actively use the “Determine location” function, you give us your consent to determine your location. The legal basis is Art. 6 para. 1 lit. a GDPR and, for access to device information, § 25 para. 1 TDDDG. The location is determined via the geolocation API of your browser or the location services of your device directly on your end device.

Data transmission and storage: Only a unique, non-personal position signal (e.g. coordinates with low accuracy or a postcode region) is sent to our servers in order to load suitable offers. This data does not allow any conclusions to be drawn about your identity and is processed separately from all personal information. We do not store any permanent or personal location histories.

Revocation and transparency: You can revoke your consent at any time by deactivating location sharing in the settings of your browser or operating system. We attach great importance to data protection: we do not use the location data determined via the “Determine location” function for marketing, profiling or tracking purposes or pass it on to third parties.

Note on third-party services: Separately from this function, the Google and Meta services described in Section 10 may derive an approximate location from your IP address. This only happens if you have consented to those services.

8. Processing of merchant-generated content and AI-based moderation

To ensure the security of our community, we use automated systems to analyse content (texts, images) uploaded by merchants when they publish offers. Consumers using the consumer application do not upload offers or other content; they discover, view, upvote and save offers and businesses.

Purpose. The processing of the content uploaded by merchants serves two purposes:

  • Immediate moderation: immediate identification and filtering of potentially harmful content to protect our community.
  • Internal development: using this content as training data to develop and improve our own future content moderation systems.

Functionality and transparency. Content is checked automatically. In individual cases, content may be blocked or not published. The merchant will be informed of this and can lodge a complaint at any time. Complaints are reviewed by our moderation team. In this way, we ensure that no exclusively automated decision within the meaning of Art. 22 GDPR is made without the possibility of review. Content is generally stored for the duration of the merchant’s user account.

For internal development purposes, content is depersonalised before being used as training data (e.g. removal of direct identifiers) and stored separately from personal registration data. We keep logs of moderation decisions for a maximum of 12 months, insofar as this is necessary for quality assurance and defence against legal claims.

Services used:

  • Google Vision API (Google Ireland Limited / Google LLC, USA): to analyse images. This use is separate from the Google services described in Section 10.
  • Perplexity AI (Perplexity AI, Inc., USA): for analysing texts.

Legal basis. Processing for direct moderation is primarily carried out to fulfil our legal obligations (Art. 6 para. 1 lit. c GDPR) arising from laws such as the Digital Services Act (DSA). Both the direct moderation and the processing of content for the internal further development of our own moderation systems are based on our legitimate interest (Art. 6 para. 1 lit. f GDPR). Our interest is to provide a secure platform, to improve the security and quality of our platform in the long term and to become less dependent on external service providers.

Data transfer to third countries: When using external services, data may be transferred to the USA. We ensure an adequate level of data protection by concluding EU standard contractual clauses (as a suitable guarantee in accordance with Art. 46 GDPR). We would like to point out that despite these measures, there may be a residual risk that US security authorities may gain access to the data. Processing by the external providers takes place for a specific purpose as part of the direct content check. Any further use by these providers for their own purposes does not take place.

9. Cookies, SDKs, tracking and consent management

We use cookies and similar technologies on our platform. On our websites, these are mainly cookies; in our mobile applications, these are software development kits (SDKs), local storage and device identifiers (e.g. the advertising ID). Cookies are small text files that are stored on your end device. We distinguish between session cookies, which are automatically deleted when you close your browser, and persistent cookies, which remain on your device for a specified period of time. You can find detailed information on the type and storage duration of the individual cookies and SDKs in our consent management tool.

Technically necessary cookies and SDKs: These are essential for the basic operation of the platform. The legal basis is our legitimate interest (Art. 6 para. 1 lit. f GDPR) and § 25 para. 2 TDDDG.

Analysis and marketing cookies and SDKs: We only use these with your express consent. They are not loaded or activated before you have given that consent.

Consent management: We use our own consent management tool (TYRIOS) to obtain and manage your consent. The tool names each provider (including Google and Meta) and links to its privacy policy before you decide.

Google and Meta services: Details on the Google services (e.g. Google Analytics, Firebase, Google Ads) and Meta services (e.g. Meta Pixel, Meta SDK, Conversions API) we use, including roles, legal bases and third-country transfers, are set out in Section 10.

The legal basis for all non-necessary cookies, SDKs and the associated tracking is exclusively your consent (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG). You can withdraw your consent at any time with effect for the future (see Section 10.4).

10. Disclosure of personal data to Google and Meta

10.1 General

In the course of operating our platform (websites, the consumer application “Get Your Offers” and the business application “Get Your Offers - For Business”), we transmit personal data to the third-party providers named below. Transmission takes place exclusively on the legal bases set out for each provider. Where processing is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG, no data is transmitted before that consent has been given, and you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out prior to withdrawal.

10.2 Google Ireland Limited

Provider. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (registered in Ireland under company number 368047), a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA (“Google”).

Services used and purposes. Google Analytics 4 and Google Analytics for Firebase for the statistical analysis of platform usage; Firebase Crashlytics for stability and error diagnostics; Google Ads for the measurement and delivery of advertising; and Google Sign-In for the authentication of users who elect to log in with a Google account.

Categories of data. Device and online identifiers (including advertising ID, IP address, device model and operating system version), usage and event data, approximate location derived from IP address, and — in the case of Google Sign-In — the account identifiers, name and email address released to us by Google.

Roles and legal bases. In respect of analytics and crash reporting, Google acts as our processor pursuant to Art. 28 GDPR on the basis of the Google Ads Data Processing Terms; processing is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. In respect of advertising measurement and Google Signals and in respect of Google Sign-In, Google acts as an independent controller for its own purposes; processing on our side is based on your consent pursuant to Art. 6(1)(a) GDPR, and for the login function additionally on Art. 6(1)(b) GDPR insofar as it is necessary to provide the account you requested. We have no influence over, and assume no responsibility for, Google’s independent processing of that data.

Third-country transfers. Data may be transferred to and processed in the United States and other third countries. Google LLC is certified under the EU–U.S. Data Privacy Framework, so such transfers are made on the basis of the European Commission’s adequacy decision of 10 July 2023 pursuant to Art. 45 GDPR; in addition, the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR form part of our agreement with Google. We would like to point out that despite these measures, there may be a residual risk that US security authorities may gain access to the data.

Further information and rights against Google directly. Google’s privacy policy is available at https://policies.google.com/privacy. Requests to exercise your rights under Arts. 15 to 22 GDPR against Google, and complaints concerning Google’s processing, may be submitted using the form at https://support.google.com/policies/contact/general_privacy_form or addressed in writing to:

Google Ireland Limited
Attn: Legal Department / Data Protection Office
Gordon House, Barrow Street
Dublin 4, D04 E5W5
Ireland

Google’s Data Protection Officer for the European Union may be contacted via the same form, selecting the option for contacting the Data Protection Office.

10.3 Meta Platforms Ireland Limited

Provider. Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (registered in Ireland under company number 462932), a subsidiary of Meta Platforms, Inc., 1 Meta Way, Menlo Park, California 94025, USA (“Meta”).

Services used and purposes. The Meta SDK (in our mobile applications), the Meta Pixel (on our websites) and the Conversions API for the measurement of platform events, the analysis of campaign performance and the delivery of interest-based advertising, including the formation of Custom Audiences and Lookalike Audiences; and Facebook Login for the authentication of users who elect to log in with a Facebook account.

Categories of data. Device and online identifiers (including advertising ID, IP address, device and operating system data), platform events and interactions (e.g. installation, registration, purchase), and — in the case of Facebook Login — the profile data released to us by Meta (name, email address, profile identifier).

Roles and legal bases. In respect of the collection and transmission of event data for advertising measurement and targeting, we and Meta act as joint controllers within the meaning of Art. 26 GDPR. The allocation of responsibilities is governed by the Meta Controller Addendum (https://www.facebook.com/legal/controller_addendum). In respect of the subsequent processing of that data for Meta’s own purposes, Meta acts as an independent controller. All transmission described in this section is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG; in respect of Facebook Login, additionally on Art. 6(1)(b) GDPR insofar as it is necessary to provide the account you requested.

Essence of the joint controller arrangement (Art. 26(2) GDPR). Meta assumes responsibility for compliance with Arts. 12 to 22 GDPR in respect of the jointly processed data, for the security of processing pursuant to Art. 32 GDPR, and for notification obligations pursuant to Arts. 33 and 34 GDPR in respect of its own systems. Data subjects may exercise their rights under Arts. 15 to 21 GDPR in respect of the jointly processed data directly against Meta Platforms Ireland Limited. Where such a request is addressed to us, we will forward it to Meta without undue delay. All remaining obligations under the GDPR remain with each party individually.

Third-country transfers. Data may be transferred to and processed in the United States and other third countries. Meta Platforms, Inc. is certified under the EU–U.S. Data Privacy Framework, so such transfers are made on the basis of the European Commission’s adequacy decision of 10 July 2023 pursuant to Art. 45 GDPR; in addition, the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR form part of our agreement with Meta (https://www.facebook.com/legal/EU_data_transfer_addendum). We would like to point out that despite these measures, there may be a residual risk that US security authorities may gain access to the data.

Further information and rights against Meta directly. Meta’s privacy policy is available at https://www.facebook.com/privacy/policy. Requests to exercise your rights under Arts. 15 to 22 GDPR against Meta, and complaints concerning Meta’s processing, may be submitted using the forms in the Meta Privacy Centre (https://www.facebook.com/privacy/center) or addressed in writing to:

Meta Platforms Ireland Limited
ATTN: Privacy Operations
Merrion Road
Dublin 4, D04 X2K5
Ireland

The Data Protection Officer of Meta Platforms Ireland Limited may be contacted using the dedicated form in the Meta Privacy Centre, or in writing at the above address marked “ATTN: Data Protection Officer”.

10.4 Withdrawal of consent

You may withdraw consent given for the transmissions described in this Section 10 at any time, with effect for the future, via our consent management tool, which you can open at any time in our apps under Profile → Settings → Privacy. Following withdrawal, no further data will be transmitted to the provider concerned. Data already transmitted remains subject to the provider’s own retention practices, and any erasure request in respect of that data must be asserted against the provider directly using the channels set out in Sections 10.2 and 10.3.

11. Non-personal statistics and pseudonymised reach measurement

We have a fundamental interest in understanding the use of our platform in order to constantly improve it. We make a strict distinction here between non-personal statistics and pseudonymised analysis, which requires your consent. This section concerns our own analysis; analysis via Google and Meta services is described in Section 10.

a) Non-personalised usage statistics (without consent). We constantly collect aggregated and completely non-personalised data about the use of our platform. This includes, for example, how often a certain function is used or how user numbers are distributed across different regions. This data does not allow any conclusions to be drawn about individual persons at any time and is collected without the use of cookies. Location data can be included in these statistics in aggregated form. There is no personal reference or profiling. This data is processed on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) in the fundamental analysis and improvement of our platform.

b) Pseudonymised reach measurement (with consent). If you give us your consent via our consent management tool, we also use a pseudonymised analysis to better understand user behaviour.

Process and type of data: For this purpose, a random, pseudonymised identifier is stored on your end device using a cookie. This identifier enables us to recognise your browser or app across multiple visits and sessions without knowing your identity. This allows us to understand how users move around our platform over time. We take technical and organisational measures to ensure that this pseudonymous identifier and the associated usage data are not merged with your personal registration data (such as your name or email address) at any time.

Legal basis: The storage / reading of the pseudonymous identifier on your end device is based on your consent in accordance with § 25 para. 1 TDDDG. The subsequent processing of the data collected in this way is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.

Storage period: The data will be deleted as soon as it is no longer required for our recording purposes or you withdraw your consent.

12. Your rights as a data subject

You have comprehensive rights regarding the processing of your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your data based on a legitimate interest.
  • Right to withdraw consent (Art. 7 para. 3 GDPR)
  • Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Note on direct marketing: You can object to the processing of your data for direct marketing purposes at any time; this also applies to profiling insofar as it is associated with such direct marketing (Art. 21 para. 2 GDPR).

How to exercise your rights. For processing for which we are responsible, please use the contact details in Section 1 (datenschutz@repalogic.com).

Requests concerning Google and Meta. Requests concerning processing carried out by Google or Meta as independent controllers should be directed to those entities using the channels set out in Sections 10.2 and 10.3. Requests concerning the jointly processed data described in Section 10.3 may be directed either to us or to Meta Platforms Ireland Limited.

Supervisory authorities. Irrespective of any other remedy, you have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us is:

The State Commissioner for Data Protection and Freedom of Information Baden- Württemberg (LfDI BW)
Lautenschlagerstraße 20
70173 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de

Because Google Ireland Limited and Meta Platforms Ireland Limited are established in Ireland, the lead supervisory authority for their processing pursuant to Art. 56 GDPR is:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28, Ireland
https://www.dataprotection.ie

13. Special features when deleting the user account

If you request the deletion of your user account, your primary personal data (in particular e-mail address, user name, password hash) will be permanently deleted in accordance with Art. 17 GDPR.

Please note that content is differentiated and treated as follows:

  • Personal content: Content with a direct personal reference (e.g. comments) is deleted or permanently anonymised (e.g. “post by a former user”).
  • Factual and offer data: Factual information published by merchants (offer details, company data, etc.) is an essential part of our community database. After deletion of the associated account, this data loses its reference to the person and is no longer personal. We reserve the right to continue to use this anonymous factual data in order to maintain the platform for all other users.

Data held by Google and Meta: Deleting your account with us does not automatically delete data that Google or Meta have already received as independent controllers (see Section 10). Please assert erasure of that data against the provider directly, using the channels set out in Sections 10.2 and 10.3. If you logged in via Google Sign-In or Facebook Login, you can also remove our access in your Google or Facebook account settings.

14. Up-to-dateness and amendment of this privacy policy

This privacy policy is currently valid. It may need to be amended due to the further development of our platform or changes in legal requirements. We will inform you of any significant changes in good time, for example by email or by means of a clear notice on our platform. The current version is available on our website at all times. Changes are documented in the version history on our website.

Prevailing language: This privacy policy is provided in several languages. In the event of contradictions, the German version shall prevail, unless mandatory local law prescribes a different language.

15. Data protection information for the “Get Your Offers” giveaway

The controller responsible for data processing in connection with this giveaway is: repalogic GmbH, Otto-Meckler-Straße 12-2, 88605 Meßkirch. E-mail: info@repalogic.com

15.1 What data we process and why. When you participate in our giveaway, we process the following data about you: profile data (your username and the XP / experience points you have collected within the app); contact data (the email address you provided during registration); and winner data (in the event that you win, we may request additional data required to deliver the voucher, e.g. name or postal address). The purpose of processing is to carry out the giveaway, in particular to determine the monthly winners based on XP status and to notify them by email.

15.2 Legal basis for processing. Data processing is carried out on the basis of Article 6(1) (b) GDPR. The processing is necessary to fulfil the contract for participation in the giveaway (in accordance with our terms and conditions). Providing your data is required in order to participate in the giveaway. Without this data, we cannot consider you as a participant or notify you of a win.

15.3 Transfer of data. Your data will generally not be passed on to third parties. An exception only applies if this is absolutely necessary for prize delivery (e.g. transferring the email address to a voucher partner for digital delivery or to a postal service provider for shipping).

15.4 Storage period. The data collected as part of the giveaway will be deleted as soon as it is no longer required for the implementation of the giveaway. The XP history remains part of your app profile as long as your account exists. The specific data for prize processing will be deleted after the statutory retention periods have expired.

15.5 Your rights. You have the right at any time to access, rectify, delete, or restrict the processing of your data, as well as the right to data portability. You can also object to further participation in the giveaway at any time. To do so, simply contact: info@repalogic.com. Furthermore, in accordance with Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is not lawful.

Appendix: Special provisions for India

(pursuant to the Digital Personal Data Protection Act, 2023 – “DPDP Act”)

This Annex supplements our Privacy Policy for users habitually resident in India. In the event of any inconsistency between this Annex and the main body of the Privacy Policy, the provisions of this Annex shall prevail.

1. Terms under Indian law

  • Data Fiduciary: We, Get Your Offers.
  • Data Principal: You as the data subject.
  • Significant Data Fiduciary (SDF): If we are categorised as an SDF by the Indian government, we will fulfil the additional obligations such as appointing a Data Protection Officer in India, conducting regular audits and Data Protection Impact Assessments.

2. Legal bases for processing. All processing of personal data is based on your consent or – where permitted by law – on legitimate uses under the DPDP Act (e.g. fulfilment of a contract, legal obligation). The transmission of data to Google and Meta described in Section 10 takes place only with your consent.

3. Information and consent. You will receive clear and comprehensible information in English before any processing. On request, we can also provide information in another language of the 8th Schedule. Your consent can be revoked at any time. The revocation is only effective for the future.

4. Children. Persons under the age of 18 are considered children. Children are not permitted to use the platform. Behavioural monitoring and targeted advertising to children is prohibited.

5. Rights of data principals. In addition to the GDPR rights mentioned in the main section, you have the following rights in particular under the DPDP Act:

  • Right to be informed about the processing.
  • Right to rectification and updating of your data.
  • Right to erasure after the purpose has ceased to exist or consent has been withdrawn.
  • Right to withdraw consent at any time.
  • Right to lodge a complaint with the Grievance Officer (see below).
  • Right to appoint a representative in the event of death or incapacity.

6. Transfer of data abroad. Under Indian law, international data transfers are permitted except to countries that the government specifically restricts. No such restriction list currently exists. We are constantly monitoring developments and adapting our processes accordingly.

7. Grievance Redressal. We have appointed a Grievance Officer who you can contact if you have any questions or complaints:

Grievance Officer India
E-mail: grievance.india@repalogic.com
Address: Repalogic India West Private Limited, 339 B, Square One Commercial Althan, 395017 Surat

We undertake to process complaints within the legally stipulated period. In addition, you can contact the Data Protection Board of India (DPBI) at any time.

8. Deletion and retention. Your personal data will be deleted as soon as the purpose no longer applies or you revoke your consent, provided there are no statutory retention obligations. We check at regular intervals whether data is still required.

9. Security incidents. In the event of a data leak or other personal data breach, we will notify both the Data Protection Board of India (DPBI) and the affected individuals in accordance with applicable regulations.

10. Changes to this Annex. The Government of India has notified the Digital Personal Data Protection Rules, 2025, which are being brought into force in phases. We will amend this Annex as further provisions take effect.