GoYelo Privacy Policy

This Privacy Policy explains how GoYelo collects, receives, uses, discloses, stores and deletes digital personal data when providing its wedding and event technology services. It applies to event organisers and hosts, wedding planners and their authorised teams, guests, hotel personnel, drivers, concierge and logistics personnel, and other authorised platform users.

For this Policy, “GoYelo”, “we”, “us” or “our” means Enjay Luxury Events and Weddings Private Limited, having its registered office at 614/615, 6th Floor, Laxmi Industrial Estate, Sab TV Road, Andheri West, Mumbai - 400053, India. “Platform” means the GoYelo website, mobile application, RSVP links, dashboards, messaging workflows and related services.

This Policy is a notice. It is not a request for blanket consent. Where consent is required, GoYelo or the relevant Event Organiser will request it separately, in clear language, at the point at which the information or optional feature is offered.

2.1 Event Organiser

The “Event Organiser” is the host, family, wedding planner, event company or other client that determines why and how guest information is used for a particular event. For event-specific guest information, the Event Organiser is ordinarily the Data Fiduciary and GoYelo acts as its Data Processor under documented instructions.

2.2 GoYelo

GoYelo is an independent Data Fiduciary for personal data used to operate and secure its own accounts and Platform, administer support, prevent misuse, maintain required records, manage its service-provider relationships, and comply with law. GoYelo does not independently use an Event Organiser’s guest list for unrelated marketing or to build advertising profiles.

2.3 Hotels, transport providers and other service partners

A hotel, transport operator or other service partner may act as the Event Organiser’s service provider, GoYelo’s sub-processor, or an independent Data Fiduciary where it determines its own purposes or must retain records under law. Its separate privacy notice and legal duties may then also apply.

2.4 If you make a privacy request

For event-specific data, GoYelo may verify and fulfil the request for the Event Organiser or securely refer it to the relevant Event Organiser. For GoYelo account, security or Platform data, GoYelo will handle the request directly. We will not use this allocation of roles to prevent or unreasonably delay a valid request.

5.1 First contact and pre-RSVP information

The Event Organiser may supply limited contact and event-allocation information before a guest interacts with GoYelo. The Event Organiser must be entitled to use and disclose that information for administering the event. At or before GoYelo first seeks additional information or consent, the guest will receive a concise notice identifying the event, explaining that the contact details came from the Event Organiser, describing the intended use, linking to this Policy, and providing a way to stop communications or report an incorrect recipient.

5.2 Consent is purpose-specific

Where consent is the basis for processing, the request will identify the personal data and specified purpose and require a clear affirmative action. Declining an optional field will not prevent core RSVP use, although the corresponding optional convenience may be unavailable. Consent for one event or feature is not consent for another event, GoYelo marketing, the Social Directory, an ID upload or continuous location access.

5.3 Withdrawal

A user may withdraw consent through the relevant feature settings, an unsubscribe or opt-out control, or by contacting us. Withdrawal will be as easy as giving consent. We and the relevant processors will stop the consent-based processing within a reasonable period, unless continued processing is required or authorised by law or remains necessary to complete a service already requested. Withdrawal does not affect earlier lawful processing.

5.4 Event-service messages and marketing

Invitation, RSVP, itinerary, hotel, pickup, safety and event-update messages are event-service communications. GoYelo will not use event contact details for unrelated promotions unless the person separately opts in. Marketing consent may be withdrawn independently without affecting event communications.

6.1 Dietary and assistance information

Meal and assistance fields should contain only what the venue or event team needs. A guest should not include detailed medical, disability, religious or other intimate information unless necessary for a requested accommodation. Structured choices should be used where available. Such information is visible only to authorised personnel who need it for catering, accessibility or hospitality.

6.2 Tickets and travel extraction

If a ticket is uploaded, GoYelo or an approved document-extraction provider may read the image to populate itinerary fields. The user should review extracted details for accuracy. GoYelo does not use travel information for advertising or unrelated profiling.

6.3 Government identity documents

Identity-document upload is optional unless a specific hotel or legal requirement applies, and will be presented with a separate contextual notice. The document is used only to facilitate the guest’s stay or check-in for the identified event. Access is restricted to authorised event and hotel roles with a need to know. GoYelo does not use identity documents for marketing, social discovery, analytics or advertising.

Where feasible, GoYelo facilitates secure, time-limited transfer or access rather than permanent storage. ID images are scheduled for deletion no later than 30 days after the later of the event’s final date or the guest’s check-out, unless the guest deletes them earlier or a longer period is demonstrably required by law. A hotel may have an independent legal retention duty; its own notice will govern records it retains.

6.4 Driver and location data

An assigned driver receives only the information reasonably needed for the assigned trip, typically the guest’s name, contact number or masked contact method, pickup/drop point, arrival details and trip status. A driver must not reuse guest information after the trip. Live or precise location is collected only when the user enables it or actively uses a location-dependent feature, is limited to the trip or incident, and is not used for behavioural profiling.

6.5 SOS and emergencies

When a user activates SOS or requests urgent support, relevant information may be shared with authorised organisers, hotel staff, transport personnel, emergency contacts, medical responders or public authorities as reasonably necessary to protect life, health or safety. Emergency processing may continue where permitted by law even if ordinary consent is unavailable.

6.6 Gallery

Event photographs and videos may contain images of other people. Uploaders must use the gallery responsibly and must not upload unlawful, humiliating or intrusive content. Organisers should provide an appropriate event notice. Users may report content or request removal, subject to lawful retention and the Event Organiser’s review.

6.7 Social Directory

The Social Directory is off by default and requires a separate opt-in for each event. A guest chooses the profile fields displayed and may change them later. Phone number, email address, itinerary, hotel room, ID information, precise location, RSVP notes and dietary information are never made visible through the directory. Connection acceptance does not automatically reveal contact details. Users can decline, disconnect, block, report or leave the directory without losing RSVP access.

GoYelo is not designed for independent use by persons under 18 in India. An adult guest or Event Organiser may record a child count or limited dependent information for invitation, travel, accommodation or meal planning. Where a child’s name, photograph, ID document, ticket or other personal data is required, the adult submitting it must be the parent or lawful guardian or must be authorised by that person. GoYelo will obtain verifiable parental or guardian consent where required by applicable law. Children are not permitted to join the Social Directory independently, and GoYelo does not track, behaviourally monitor or target advertising to children.

GoYelo does not sell or rent personal data. Service providers may process personal data only for contracted services, under confidentiality, security, deletion and assistance obligations appropriate to their role. GoYelo maintains an internal record of processors and periodically reviews access and need.

GoYelo and its service providers may process personal data in India and in other locations where approved infrastructure or support is operated. Cross-border processing will be subject to contractual and technical protections and to any restriction notified by the Government of India under applicable law. Where another jurisdiction applies, GoYelo will use any additional transfer mechanism required by that law. Users may contact us for current information about relevant processing locations and provider categories.

We retain personal data only for the period reasonably necessary for the specified purpose, to fulfil a valid Event Organiser instruction, or to meet a legal, security, dispute or claims requirement. The following are GoYelo’s default maximum operational periods; a shorter event configuration or valid deletion request may apply, and a demonstrable legal obligation may require longer retention.

Deletion from active systems may be followed by expiry from encrypted backups during the stated backup cycle. During that period, backup data is isolated from ordinary use. Where data cannot yet be deleted because of law, an active dispute, fraud or security investigation, it will be restricted to that purpose and deleted when the reason ends.

GoYelo uses reasonable technical and organisational safeguards designed for the nature and risk of the information processed. These include encryption in transit and, for protected stored content, at rest; role-based and least-privilege access; event-level access separation; authentication controls; logging and monitoring; backup and recovery measures; vulnerability and patch management; access reviews; service-provider controls; incident response; and secure deletion processes. Additional restrictions apply to identity documents, location and SOS data.

Users must protect account credentials and OTPs, keep contact information current, use authorised devices and promptly report suspected unauthorised access. No internet service can guarantee absolute security.

GoYelo maintains procedures to identify, contain, investigate, document and remediate personal data breaches. Where GoYelo is processing event data for an Event Organiser, it will notify and assist the Organiser without undue delay in accordance with the parties’ agreement. Where GoYelo is the responsible Data Fiduciary, it will notify affected Data Principals and the Data Protection Board of India in the form and within the timelines required by applicable law, and will provide information and mitigation steps as they become available.

Subject to the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 as and when the relevant provisions apply, and any lawful exceptions, a Data Principal may:

• obtain a summary of personal data being processed and the processing activities;
• obtain information about other Data Fiduciaries and Data Processors with whom personal data has been shared, where the law requires disclosure;
• request correction of inaccurate or misleading data, completion of incomplete data and updating of data;
• request erasure where retention is not necessary for the specified purpose or law;
• withdraw consent for consent-based processing;
• use GoYelo’s readily available grievance-redressal mechanism;
• nominate another individual to exercise statutory rights in the event of death or incapacity; and
• make a complaint to the Data Protection Board of India after exhausting the applicable grievance mechanism, as required by law.

To protect users, we may verify identity and the event/account concerned before acting. A request should be authentic and should not impersonate another person, conceal material information or be false or frivolous. We will not charge for ordinary requests unless permitted by law.

13.1 How to submit a request or grievance

Email teams@go-yelo.com with the subject “Privacy Request” or “Privacy Grievance”. Include your name, mobile number, relevant event (if known), the right or concern, and enough detail to locate the information. Do not email identity documents unless specifically requested through a secure method.

We will acknowledge the request, coordinate with the relevant Event Organiser where necessary, and respond within the period prescribed by applicable law. If no statutory period is then in force, we aim to provide a substantive response within 30 days. If you are dissatisfied after completing this process, you may approach the Data Protection Board of India through the mechanism it makes available.

If the law of another country applies to your personal data, you may have additional rights, such as objection, restriction or data portability. GoYelo will honour those rights to the extent required by that applicable law. This section does not represent that every such right applies to every user.

The Platform may link to hotel, airline, railway, mapping, payment, messaging or other third-party services. Information a user submits directly to an independent third party is governed by that party’s privacy notice. GoYelo is not responsible for an independent third party’s practices, but remains responsible for its own disclosures and processor oversight as required by law.

We may update this Policy to reflect changes in law, technology, services or data practices. The effective date and version will be revised. Material changes will be communicated through an appropriate channel, such as the Platform, RSVP page, email, WhatsApp or SMS. Where a change requires fresh consent, we will request it; continued use alone will not substitute for consent where law requires an affirmative action.

These short notices form part of GoYelo’s layered privacy approach and should be displayed in the relevant journey. Product wording may be shortened further without omitting the identified data, purpose, choice, policy link and contact/rights route.

This Policy is designed around the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, including phased commencement.

This document should be read with GoYelo’s terms of service, Event Organiser agreement/data-processing terms, information-security and incident-response procedures, processor register, access-control matrix and product-level consent records.