Compliance
DPDP Compliance at AftrBase
How AftrBase implements India's Digital Personal Data Protection Act, 2023 (and GDPR-aligned practices), on and off the receipt.
Last updated: 22 October 2026
Consent-first by design
- Consent is collected at the counter with plain, specific language shown on the POS screen and on the receipt, stating what data is collected, by whom and for what purpose.
- Receipt-only mode (no marketing) is a supported posture, so consent collection can stay minimal.
Purpose limitation
- Data captured at the counter serves the receipt and, separately and optionally, loyalty and engagement. Purposes are disclosed at collection, and expanded use requires fresh consent.
Data minimisation
- Only the phone number (and, optionally, a name) is required to deliver a receipt. Everything else in the CRM is derived from transactions, not extra profiling.
Rights of Data Principals
- Customers can request access, correction, erasure and grievance_redressal from the brand; AftrBase provides the tools to action requests within statutory timelines.
Security safeguards
- Encryption in transit and at rest, role-based access control, audit logging of data actions and tokenized receipt URLs — see the Security page for the full detail.
Breach notification
- AftrBase commits to notify affected brands without undue delay in case of a personal-data breach, per DPDP obligations.
Compliance questions? Write to [email protected].