This Privacy Policy ("Policy") explains how TGCX Fintech Private Limited ("Company", "we", "us" or "our"), a company incorporated under the laws of India with CIN: U66190GJ2024PTC152724 and having its registered office at 304, Venus Benecia Pakvan, S.G. Highway, Bodakdev, Ahmedabad, Gujarat - 380054, India, collects, uses, stores, shares and protects personal data when you access or use Lifrica ("Platform", "Services").
By creating an account, purchasing a membership, using a Lifrica card, booking travel or otherwise accessing the Platform, you ("Member", "you" or "your") confirm that you have read and understood this Policy. Where the law requires it, we will ask for your consent through a clear affirmative action before we process certain categories of personal data. If you do not agree with any part of this Policy, please stop using the Services and close your account.
In this Policy, "personal data" means any data about an individual who is identifiable by or in relation to that data. This Policy should be read together with our Terms and Conditions, of which it forms part.
We collect personal data so we can run the Platform, verify who you are, issue and service memberships and cards, complete travel bookings, credit and redeem points, keep accounts safe and meet our legal obligations.
Some of it is essential — without it we cannot provide the Services. You must give us a mobile number and email to create an account, and identity documents before a card or a payout can be activated. The rest is optional and collected only if you choose to use the feature it powers, such as location-based offers.
We also collect date of birth and age-confirmation declarations to check that you meet the eligibility requirements set out in our Terms and Conditions.
Data you give us
- Account information: your name, mobile number with country code, email address, password or authentication credentials, profile photo and communication preferences.
- Identity and verification data: date of birth, government-issued identification, PAN, address proof and any other KYC documentation that we or our banking and card-issuing Partners are required to collect.
- Membership and payment data: the plan you hold, its term and renewal status, billing address, tokenised card or bank details held by our payment Partners, invoices, refunds and chargebacks.
- Travel and booking data: traveller names, passport or ID details where a supplier requires them, itineraries, dates, seat and room preferences, and any accessibility or dietary requests you choose to share.
- Support and other communications: the content of your emails, chats, call recordings and the forms you submit to us, including anything you attach to a request.
Data we collect automatically
- Usage and log data: how you use the Platform — the features you open, points earned and redeemed, searches and bookings, session times, crash reports and diagnostic logs.
- Device and connection data: hardware model, operating system and version, app version, browser, language and time zone, mobile network or ISP, and IP address.
- Approximate location: a general location such as city and country derived from your IP address, used for fraud checks, currency and regional pricing. Precise device location is collected only with your permission and can be withdrawn from your device settings at any time.
- Cookies and similar technologies: small files and identifiers that keep you signed in, remember your preferences, measure how the Platform performs and protect against abuse. You can refuse cookies in your browser, though parts of the Platform may then not work.
Data we receive from others
- Banking, card-issuing and payment Partners share transaction, authorisation and settlement data so we can credit points and service your card.
- Travel suppliers and aggregators share availability, booking confirmations, changes and cancellations relating to your itinerary.
- Verification and anti-fraud providers share the outcome of the checks we or our Partners are required to run.
- Another Member may provide your details when they refer you, add you to a shared benefit, or book travel on your behalf.
We use personal data, alone or in combination, only for the purposes set out below and on the legal basis stated against each.
- Creating and managing your account — verifying your mobile number and email, running security checks at sign-up, recording your preferences and privacy settings, updating your details and closing your account when you ask. Basis: performance of our contract with you.
- Delivering memberships, cards and rewards — activating and renewing your plan, issuing and servicing your card through our Partners, calculating and crediting points, and processing redemptions and payouts. Basis: performance of our contract with you.
- Completing travel bookings — sharing the details a supplier needs to confirm and service your booking, and handling changes, cancellations and refunds. Basis: performance of our contract with you.
- Payments, billing and tax — charging membership fees, processing refunds and chargebacks, issuing invoices and maintaining accounting records. Basis: contract and legal obligation.
- Safety, security and fraud prevention — verifying accounts on an ongoing basis, detecting suspicious or abusive activity, investigating breaches of our Terms, and restricting or closing accounts where necessary. Basis: legitimate interests and legal obligation.
- Support and service communications — answering your requests, and sending transaction alerts, renewal reminders, policy updates and other notices about the Services. Basis: contract and legitimate interests.
- Improving the Services — analysing how features are used, measuring performance, running surveys and testing changes, using aggregated or de-identified data wherever it will do. Basis: legitimate interests.
- Marketing — telling you about plans, partner offers and features that may interest you. Basis: your consent, which you can withdraw at any time.
- Legal and regulatory — responding to lawful requests from regulators, law enforcement and courts, meeting record-keeping obligations, and establishing or defending legal claims. Basis: legal obligation and legitimate interests.
- Protecting vital interests — sharing information where it is needed to protect the life, health or safety of you or another person. Basis: vital interests.
We do not sell your personal data. We share it only in the circumstances described below, and only to the extent needed for that purpose.
- Partners: banks, card issuers, payment processors, travel suppliers and merchants who deliver the part of the Service you have asked for.
- Service providers: cloud hosting, communications, analytics, customer support, security and identity-verification providers acting on our instructions under written contracts.
- Group companies: our affiliates, where they support the operation, security or administration of the Platform.
- Authorities: regulators, law enforcement, courts and tax authorities where we are required to disclose data, or where we believe in good faith that disclosure is necessary to prevent harm or unlawful activity.
- Corporate transactions: a buyer or successor entity in a merger, acquisition, financing or restructuring, subject to this Policy continuing to apply to your data.
- At your direction: anyone else you ask us to share with, including co-travellers you add to a booking.
The Platform and some of our Partners operate outside India. Where we transfer personal data across borders, we do so only to countries permitted under applicable law and under contractual safeguards that require the recipient to protect the data to the standard set out in this Policy.
Travel bookings by their nature involve sharing your details with suppliers in the destination country. Those suppliers process your data under their own privacy policies for the booking you have made.
We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires — whichever is longer.
- Account and profile data is retained while your account is open, and for a reasonable period afterwards to handle disputes and reinstatement requests.
- KYC, transaction and accounting records are retained for the period prescribed by financial, tax and anti-money-laundering laws, typically eight years from the date of the transaction.
- Support communications and security logs are retained for a limited period for quality, audit and fraud-prevention purposes.
- Data that no longer serves any of these purposes is deleted or irreversibly anonymised.
We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access on a need-to-know basis, network monitoring, logging and periodic security testing. Our Partners are contractually required to maintain comparable standards.
No system can be guaranteed to be completely secure, and you play a part too. Keep your password and OTPs private, never share them with anyone claiming to be from Lifrica, and tell us immediately at support@lifrica.com if you suspect unauthorised access, a lost device or a compromised card.
Subject to applicable law and to verification of your identity, you have the following rights over your personal data.
- Access: obtain a summary of the personal data we process about you and the categories of recipients we have shared it with.
- Correction: have inaccurate or incomplete data corrected or updated — most of which you can do yourself from your account settings.
- Erasure: ask us to delete data we no longer need, except where we are required to retain it by law.
- Withdraw consent: withdraw a consent you previously gave, including for marketing or precise location, without affecting processing already carried out.
- Grievance redressal: raise a complaint with our Grievance Officer and, if it remains unresolved, escalate it to the relevant data protection authority.
- Nomination: appoint another individual to exercise these rights on your behalf in the event of your death or incapacity.
Write to support@lifrica.com to exercise any of these rights, and we will respond within the timelines set by applicable law. Deleting your account ends your membership and forfeits any unredeemed points, as set out in our Terms and Conditions.
The Services are not directed at children. You must be at least 18 years of age to open a Lifrica account, and we do not knowingly collect personal data from anyone below that age.
If we learn that we have collected data from a child without valid parental consent, we will delete it and close the account. If you believe a child has provided us with personal data, write to support@lifrica.com.
The Platform links to and integrates with services run by our Partners, app stores and other third parties. Once you leave the Platform or transact with a Partner, their privacy policy governs how they handle your data. We are not responsible for the practices of services we do not control, and we encourage you to read their policies before sharing information with them.
We may update this Policy as the Services, our Partners or the law change. The date shown at the top of this page always reflects the current version.
Where a change materially affects how we use your personal data or your rights over it, we will give you notice through the Platform or by email before it takes effect, and where required we will ask for your consent again. Continuing to use the Services after a change takes effect means you accept the revised Policy.
For questions about this Policy, or to exercise your rights or raise a complaint, contact our Grievance Officer at support@lifrica.com or write to TGCX Fintech Private Limited, 304, Venus Benecia Pakvan, S.G. Highway, Bodakdev, Ahmedabad, Gujarat - 380054, India. You can also reach the team through the contact page. We usually reply within one business day and will resolve grievances within the period prescribed by law.
