Personal Data Policy for Sarvatra 

This privacy notice tells you what to expect when Enigmatic Smile Rewards Private Limited (“us”/“we”) collect information about you or your actions whilst on our website Sarvatra.com and when using our application Sarvatra. 

  1. IN GENERAL 
    1. This Personal Data Policy (hereinafter referred to as the “Policy”) applies to your use of the loyalty program. The loyalty program gives you as a user the opportunity to obtain Rewards (hereinafter referred to as "vINR") from the participating companies. The loyalty program is hereinafter referred to as "Sarvatra App "(Sarvatra).  Sarvatra is operated by Enigmatic Smile Rewards Private Limited (hereinafter referred to as “SID”).
    2. The personal data policy applies to all Sarvatra channels, regardless of whether you access Sarvatra via the website or the app (hereinafter referred to as the “Platforms”).
    3. Your personal data is processed in accordance with the Policy and applicable legislation. 
  1. DATA CONTROLLER 
    1. SID is responsible for the processing of your personal data.

SID’s address is:

Enigmatic Smile Private Rewards Limited: 12,13,14 F, Wework, 247 Park, LBS Marg, Vikhroli-West, Mumbai -400079 

  1. TYPE OF PERSONAL DATA PROCESSED AND PURPOSE OF THE PROCESSING 
    1. Identification data and contact information

When you create a user profile, you must enter your name, your e-mail address, your mobile phone number, a password and one or more payment cards (see more about our processing of card information in the below sections). 

1.          Purpose and basis

Personal information about you is processed to be able to identify you as a user, including to be able to contact you. The processing of this information is necessary for Sarvatra to be delivered to you, including to be able to invoice companies for your earned vINR. This processing is necessary for the agreement with you as a user to be fulfilled. 

Provided your consent has been received on the application, your name, e-mail address and mobile phone number may be used for sending marketing material, materials regarding promotional campaigns, offers, and giveaways to you from SID and/or Sarvatra. 

If you are eligible for any promotional campaign or giveaway, you will be automatically enrolled as a participant unless you choose to opt out via the application or through other methods communicated to you periodically. 

 

    1. Other general personal data

SID may collect other general personal data if you enter this in your user profile on the Platforms. This could be for example, information about your date of birth, your age, number of people in your household, your gender, and your postcode. Entering such information is always optional for you.

However, we can make an estimate of your gender and your postcode based on your entered name and your geographical location, if you have given consent to the collection thereof. 

      1. Purpose and basis

This personal data is processed in order to carry out targeted marketing and offer you relevant opportunities to use Sarvatra. 

    1. Payment card information

SID processes information about your payment card number, expiry date and name of the cardholder. SID only collects this information when you add your card details. In the event that you wish to make a payment for an additional service, you must also enter the card's CVV/CVC. You may be asked to provide your CVV/CVC when registering your card. SID does not store your CVV/CVC, but uses this to authorize a specific payment or to authorize your card.

Your payment card information is only processed in an IT environment that is certified according to the PCI (Payment Card Industry) rules. 

      1. Purpose and basis

SID needs your card details in order to register which purchases you make where you are entitled to receive a vINR reward. The processing is necessary to be able to fulfil the agreement with you.  

    1. Payment information

SID processes information about the purchases you make with a payment card registered to Sarvatra. SID processes information about the time of purchase and the amount you purchased for. With your express consent, SID also processes information about where you made the payment. If you do not wish to notify SID of your consent, SID cannot provide the service to you. SID does not process information about what you have purchased, unless it is necessary for the purpose of calculating a Reward. 

      1. Purpose
        Your payment information is processed so that SID can calculate how much vINR you are entitled to. This is necessary in order to fulfil the agreement with you. 
      2. With your consent, SID also uses information about your purchases for targeted marketing and to be able to offer you relevant opportunities to use Sarvatra. 

 

    1. Customer number

SID processes your customer number in connection with payment of your vINR Rewards. Some payment methods require you to provide your customer number with the company to which the payment is to be made, e.g. if you want to offset a payment with your vINR. SID only collects this information when if you provide it in order to collect rewards. 

      1. Purpose and basis

The purpose of the processing is that SID can allow you to use your vINR in the manner that you have requested. For example, you may have asked that your vINR be used for offsetting a bill or similar.  

    1. Contact List 

Where you opt to provide access in app, SID will processes your Contact list to check if anyone in your contact list already has an account with SID. 

      1. Purpose and basis

The purpose of the processing this information is to make it easy for you to receive and send rewards to/from other users within the app. In addition, it allows you to send an invite link to a person who is not already onboard. 

    1. Geographical location

With your consent, we process information about your geographical location. 

      1. Purpose and basis

The purpose of the processing is that Sarvatra can target its marketing and show you companies (shops, restaurants, webshops, etc.) that offer vINR near you. We may also use your geographic location to make an estimate of your current residence post code. 

    1. Targeted marketing / profiling 
      1. SID can carry out profiling in order to provide you with relevant offers and adapt our marketing to ensure that you receive the offers that are most likely to correspond to your personal interests and needs. The profiling does not mean that you are cut off from certain offers, products or services, but only aims to target the marketing as best as possible based on your personal interests. SID only sends direct marketing to e-mail if you have given consent to this.  
  1. DISCLOSURE OF DATA 
    1. The personal data about you that SID processes will not be passed on to third parties without your consent, unless SID has another legal basis for the disclosure.

      SID passes on information about the amount spent, the vINR added to your balance and the time of the transaction to the companies connected to Sarvatra in order to invoice for your vINR. This processing is necessary for SID to fulfil its agreement with you. 

 
When you shop with a store, SID passes on information about your age, gender, postal code as well as the amount spent, the vINR paid to you and the time of the transaction.


If you choose to "follow" a store on the Platforms, SID can pass on your first name, age, gender and postal code, the amount spent, the vINR paid to you and the time of the transaction to the store and will update your news feed with targeted marketing. 

SID may also pass on your personal data to comply with the law, in connection with a legal process and to comply with requests from public authorities.  

    1. SID receives transaction information based on your purchases from registered companies with registered payment cards, so that SID can calculate the vINR due to you on your registered payment cards from payment providers. SID can exchange this information with SID's sub-suppliers with the aim of being able to identify and calculate vINR for your purchases at registered companies (shops, restaurants, webshops, etc.).  
    1. As a user, you consent to your payment card being registered for rewards and to your card number being passed on to payment providers connected to SID. You also consent to these companies processing information about where, when and for what amount you have spent using your card in order to calculate your vINR. Information about what you have purchased will not be processed.  
    1. We use the information we receive about your vINR and collect from you to be able to create targeted marketing for you. In this connection, we pass on pseudonymised information to third parties for the purpose of optimizing our marketing efforts. 

 

    1. Enigmatic Smile Rewards Private Limited also collaborates with a number of sub-suppliers/data processors and group companies where personal data is shared securely and only where necessary for operational purposes and to be able to perform under the terms and conditions agreed with all end users. This includes: 
      1. Enigmatic Smile Limited (UK Parent company, company number: 08869163): Swift House Ground Floor, 18 Hoffmanns Way, Chelmsford, Essex, England, CM1 1GU, which calculates the vINR, stores card data and other collected personal data and sends service messages to users. 
    1. SID has concluded data processing agreements with its data processors. The agreements determine the obligations that the data processor must comply with when it processes your personal data on our behalf. The data processor can thus only legally process information about you to fulfil the stated purposes.   
  1. STORAGE 
    1. Personal data is not stored longer than is necessary to fulfil the purpose for which it was collected, unless the storage is necessary to meet national legal requirements, including statutory storage periods in connection with bookkeeping etc. 
    1. SID stores your personal data until you unsubscribe from the Sarvatra, after which your personal data is either deleted or pseudonymised. If you revoke a consent, the personal data previously processed under the consent will be deleted or anonymised, unless we have another legal basis for continued processing.   
  1. RIGHTS

When SID processes your personal data, you as a registered user have a number of rights. These personal data rights are listed below. If you wish to assert one or more of your rights, you are welcome to contact SID at any time. 

    1. Right to access: You have the right to access which personal data SID has registered about you.
    2. Right to rectification: You have the right to have personal data that SID processes about you corrected if the personal data is incorrect or misleading.
    3. Right to deletion: In certain cases, you have the right to delete personal data that SID processes about you.
    4. Right to restriction: You have the right for SID to temporarily limit its processing of your personal data to storage only in certain cases. 
    5. Right to data portability: In certain cases, you have the right to have personal data that you have provided to SID handed over in a structured, generally usable and machine-readable format.
    6. Right to object: You have the right at any time, based on your particular situation or special reasons, to object to SID's processing of your personal data. You can also object to the processing of your information for direct marketing, including profiling. If your objection concerns the use of your personal data for direct marketing purposes, SID will stop such processing.
    7. Right to complain: You have the right to complain about SID's processing of your personal data. Such a complaint can be submitted to us at any time. 
  1. REVOCATION OF CONSENT

You can revoke one or more of your consents at any time by contacting SID, by deleting your profile or by changing your settings on the Platforms.

If you revoke your consent, please note that in some cases you may not be able to use Sarvatra. 

  1. DATA PROCESSORS AND TRANSFER OF PERSONAL INFORMATION OUTSIDE THE UNITED KINGDOM 
    1. SID may transfer certain personal data to data processors in countries outside the United Kingdom. Transfer of personal data only takes place when a necessary basis for transfer has been secured in accordance with local Personal Data Regulations and where you have provided explicit consent. 
  1. SECURITY AND CONFIDENTIALITY 
    1. SID protects your personal data by implementing adequate technical and organizational security measures.
    2. SID treats your personal data confidentially. Selected employees at SID and business partners are authorized to access data where necessary to solve usability or technical problems. All of SID's employees and business partners are subject to strict confidentiality requirements when processing personal data. 
  1. ACCESS TO COMPLAINTS 
    1. You can contact us with any queries or complaints in relation to data protection or this Personal Data Policy by emailing us at [email protected]. 
  1. CHANGES TO THE POLICY 
    1. SID reserves the right to change the Policy at any time and without prior notice. Changes to the Policy come into force ten days after SID has informed you about changes to the Policy by contacting you at the email address you provided when creating your profile.

 

 

 

 

 

 

 

 

 

 

Personal data policy, April 2023 (lats updated in January 2025).