How FunWala collects, uses and protects the personal data of parents, their children and provider staff, written to meet India's Digital Personal Data Protection Act 2023 (DPDP Act) and the DPDP Rules 2025.
The data fiduciary (the business responsible for your data) is OSS INFOTECH PTY LTD (ABN 67 086 389 013) trading as FunWala, whose registered address in India will be added here before launch, which runs funwala.in and the FunWala apps. "We" and "FunWala" mean that company. Activity providers are separate businesses; section 5 explains what they receive.
1. Who we are and how to contact us
FunWala is a marketplace where parents find, book and pay for children's activities from independent providers in India.
For any question, request or complaint about your personal data, contact our Grievance Officer, who also answers questions on our behalf under the DPDP Act:
| Name | To be appointed before launch |
| [email protected] | |
| Phone | To be added before launch |
| Address | To be added before launch |
| In the app | Account → Privacy → Contact us |
We acknowledge every complaint within 48 hours and resolve it within one month, as the Consumer Protection (E-Commerce) Rules 2020 require. That is well inside the 90 days the DPDP Rules allow.
2. What we collect
We collect only what we need to run bookings and payments. We never collect a child's surname, date of birth, photo, school or address.
| Data | Whose | Where it comes from | Why we need it |
|---|---|---|---|
| Mobile number | Parent | You, verified by one-time password | Your login, booking tickets and messages |
| Name and email (optional) | Parent | You | Invoices and receipts |
| City, and area if you choose | Parent | You, or your phone's location if you allow it | Showing activities near you |
| Child's first name and age band (for example 6–8) | Child | You | Matching activities to age, and naming the ticket at the door |
| Bookings, tickets, QR scan times | Parent, child | Our system | Delivering and proving the booking, refunds, disputes |
| Payment reference and status | Parent | Razorpay | Confirming payment and refunds. We never see or store card numbers, UPI PINs or bank details |
| UPI Autopay mandate reference | Parent | Razorpay | Paying for classes each month |
| Consent form answers (camps and excursions) | Parent, child | You | The provider's safety duties on the day, such as an emergency contact |
| Reviews and messages to providers or support | Parent | You | Showing honest reviews, handling questions and complaints |
| Join Hands group membership | Parent | You | Running the group and refunding if it doesn't fill |
| Device and app data (app version, device type, push token, crash reports) | Parent | Your device | Sending notifications, fixing bugs, security |
| Consent records | Parent | Our system | Proving what you agreed to and when |
| Provider staff name, mobile and role | Provider staff | The provider | Staff login and check-in records |
| Provider owner identity, PAN, GSTIN, bank account | Provider | The provider and Razorpay | KYC, tax and same-day payouts |
3. Children's data and parental consent
Under the DPDP Act a child is anyone under 18. FunWala accounts are for adults only: children cannot sign up or use the apps themselves.
3.1 Verifiable parental consent. Before you add your first child profile, we confirm that you are an adult, as Rule 10 of the DPDP Rules requires. You do this once, by sharing an age confirmation from DigiLocker (it tells us only that you are over 18, not your date of birth or any document). You then confirm that you are the child's parent or lawful guardian and consent to us using your child's first name and age band as described here.
3.2 What we do not do. We do not track, monitor or profile children, do not show children targeted advertising, and do not use children's data to build marketing audiences, as section 9 of the DPDP Act forbids.
3.3 Consent forms. For camps and excursions, the provider's consent form may ask for an emergency contact and information the provider needs to keep your child safe. Only that provider sees it, only for that booking, and we delete it 30 days after the activity ends (section 6).
3.4 Photos. Providers may not upload photos or video of children to FunWala without the parent's written consent for that specific use (Provider Agreement clause 6.4).
3.5 Removing a child profile. You can delete a child profile at any time in the app. Past bookings keep only the ticket type, not the child's name.
4. How we use data, and on what basis
The DPDP Act lets us use personal data either with your consent or for certain "legitimate uses" it lists in section 7. Each use below is one or the other. We never sell personal data.
| What we use it for | Basis |
|---|---|
| Creating your account and logging you in | Consent, given at sign-up |
| Taking bookings and payments, sending tickets, reminders and refunds | Consent, given at sign-up and at each booking |
| Sharing booking details with the provider you booked | Consent, given at each booking |
| Child profiles | Verifiable parental consent (section 3) |
| UPI Autopay for classes, with a notice at least 24 hours before each debit | Consent, given when you set up the mandate |
| Keeping invoices, tax and payment records | Legitimate use: complying with GST and income-tax law (DPDP Act section 7) |
| Handling complaints, disputes and chargebacks | Consent, and legitimate use where a law or court requires it |
| Fraud prevention and security of the service | Consent, given at sign-up |
| Marketing messages about deals (WhatsApp, SMS, push, email) | Separate, optional consent. Off unless you switch it on |
| Product analytics to improve the apps (counts and screens used, never children's data) | Separate, optional consent. Off unless you switch it on |
| Responding to lawful requests from government or courts | Legitimate use (DPDP Act section 7) |
You can withdraw any consent at any time (section 7 of this policy). If you withdraw consent needed for bookings, we can't take new bookings for you, but bookings already paid for are not affected.
5. Who we share data with
We share personal data only with the parties below, only what each needs, and under contracts that require them to protect it.
| Who | What they receive | Why |
|---|---|---|
| The provider you book | Your name, a masked contact route through FunWala, children's first names and age bands, tickets, consent form, QR scan record | To deliver your booking. Providers may not use it for marketing (Provider Agreement clause 8.2) |
| Other Join Hands members | Only your first name and that you joined | So the group can see it filling |
| Razorpay | Order amount, your mobile and email, mandate details | Payments, refunds, UPI Autopay and same-day payouts to providers |
| Messaging services (WhatsApp Business Platform provider, SMS provider registered on DLT, email provider) | Your mobile or email and the message | Tickets, reminders, OTPs and, only if you opted in, offers |
| Apple and Google push services | A device token and the notification | App notifications |
| DigiLocker | Your request for an age confirmation | Verifiable parental consent |
| Hosting and backup providers in India (DigitalOcean, Bangalore; a second provider in India) | All data, encrypted | Running and backing up the service |
| AI service providers that help run support and operations | Support messages and booking details needed for that task, never child profiles | Faster support and checks. Contracts bar them from training on your data |
| Our own team in Australia | Access for building, maintaining and supporting the platform | Running FunWala |
| Government, regulators, courts, police | What the law requires | Legal duties such as tax filings and lawful orders |
If FunWala is sold or merged, your data passes to the new owner under this policy, and we will tell you first.
6. Where data is stored and for how long
All FunWala data is stored in India, on DigitalOcean servers in Bangalore, with encrypted backups at a second provider in India. Our team in Australia may access it remotely to build and maintain the platform; the DPDP Act allows this, and the same safeguards apply.
We keep data only as long as the table below says, then delete or anonymise it. Before deleting an account for inactivity we warn you at least 48 hours ahead, so you can log in to keep it.
| Data | How long we keep it |
|---|---|
| Parent account and child profiles | Until you delete them, or 3 years after your last login or booking |
| Child profile after you delete it | Removed within 30 days, including from backups as they cycle |
| Camp and excursion consent forms and emergency contacts | 30 days after the activity ends, unless needed for an incident report |
| Bookings, invoices, payment and refund records, tax ledger | 8 years after the end of the financial year, as GST and income-tax law require. Child names are removed from these after 1 year |
| QR scan records | 1 year, as evidence for disputes and chargebacks |
| Consent records | While the consent lasts, then 3 years |
| Support messages and complaints | 2 years after the case closes |
| Reviews | Until you delete them. On account deletion they stay without your name |
| Security and access logs | 1 year, as Rule 6 of the DPDP Rules requires |
| Marketing consent and preferences | Until you withdraw consent |
| Provider KYC and agreement records | 8 years after the provider leaves |
7. Your rights and how to use them
Under the DPDP Act you, and you on behalf of your child, can:
- Know what personal data we hold about you, what we do with it and who we have shared it with.
- Correct, complete or update it.
- Erase it, except what the law makes us keep, such as tax records (section 6).
- Withdraw consent as easily as you gave it, with one switch in the app for each consent. Withdrawal does not undo what we did lawfully before.
- Nominate someone to use these rights for you if you die or become unable to.
- Complain to our Grievance Officer, and then to the Data Protection Board of India (section 10).
How to use them. Most are in the app under Account → Privacy: download your data, edit or delete child profiles, switch consents on or off, add a nominee, or delete your account. For anything else, email [email protected] or use the contact form. We confirm your identity by a one-time password to your registered mobile, and respond within 30 days at most.
Deleting your account takes effect once your upcoming bookings, Join Hands passes and classes have been used or refunded, so you don't lose anything already paid for. We then delete everything except what section 6 says we must keep.
8. Security and breaches
8.1 How we protect data. Data is encrypted in transit and at rest. Staff access is limited by role and needs two-factor sign-in, and every access to personal data by our staff is logged. Payment details are handled only by Razorpay, so FunWala never holds card or bank credentials. QR tickets are signed and single-use. We test our security before launch and every year after, including an external penetration test.
8.2 Our suppliers. Every supplier in section 5 that handles personal data for us does so under a contract requiring safeguards at least as strong as ours.
8.3 If a breach happens. If personal data is lost or exposed, we will tell affected users without delay, in plain language: what happened, what data was involved, what we are doing, and what you can do to protect yourself. We will also report it to the Data Protection Board of India as the DPDP Rules require, including a full report within 72 hours, and to CERT-In within 6 hours where its directions apply.
9. Cookies, analytics, messages and app permissions
9.1 Cookies. funwala.in uses only cookies needed to keep you logged in, remember your language and protect against fraud. Optional first-party analytics run only if you switch them on. We use no advertising cookies or third-party trackers.
9.2 Messages. Booking messages (tickets, reminders, refunds, pre-debit notices) are part of the service and can't be switched off while you have bookings. Offers and deal alerts are sent only if you opt in, and every marketing message tells you how to stop them. SMS follows TRAI's DLT rules.
9.3 App permissions. We ask only when a feature needs it, and the app works without them:
| Permission | Used for | If you say no |
|---|---|---|
| Location (while using the app) | Showing activities near you | Choose your area by hand |
| Notifications | Tickets, reminders, deal alerts you opted into | Messages still arrive by WhatsApp or SMS |
| Camera (provider app only) | Scanning QR tickets at the door | Staff can type the ticket code |
We never read your contacts: Join Hands links are shared through your phone's own share menu.
10. Changes, languages and complaints
10.1 Changes. If we change this policy, we show the new version in the app and on funwala.in with its date. If a change affects how we use data you have already given, we tell you first and ask for fresh consent where the law requires it.
10.2 Languages. This policy is available in English, Hindi, Telugu and Malayalam. On request we will provide it in any language in the Eighth Schedule to the Constitution, as the DPDP Rules require. If versions differ, the English version applies.
10.3 Complaints. Contact our Grievance Officer first (section 1). If you are not satisfied with our answer, you may complain to the Data Protection Board of India, as section 13 of the DPDP Act provides.