RED STUB CLUB
ABOUT US EXPERIENCES GALLERY MEMBERSHIP CONTACT

Red Stub Club (RSC)

Privacy Policy

Owned and operated by Peppo Technologies Private Limited.

Effective date: 22 October 2026

1. Who we are

  1. 1.1
    This Privacy Policy is issued by Red Stub Club, owned and operated by Peppo Technologies Private Limited having its registered office at Ground Floor, Tirupati Enterprises, No. 15, Rest House, Crescent Road, Bangalore North, Karnataka, India - 560001 (“RSC”, “we”, “us”). We operate the RSC mobile application and related services (the “App”). For the personal data described in this Policy, RSC is the Data Fiduciary.
  2. 1.2
    This Policy explains how we handle your personal information, including sensitive personal data or information such as passwords, payment details and Face Data. It is read along with the RSC membership terms and the App Terms & Conditions.
  3. 1.3
    By clicking on “I agree”, you consent in writing (including electronically) to the collection, use, storage and disclosure of your personal data as described here. From the date on which the Digital Personal Data Protection Act, 2023 (“DPDPA”) will come into effect, we will rely on your consent as already given for each purpose, or on another ground the DPDPA permits. You have the choice to retract your consent at a later date but in such a scenario, we may then not be able to provide some or all of our services.
  4. 1.4
    Until the DPDPA Effective Date, we shall continue to handle personal data under the Information Technology Act, 2000 and the rules made under it. From the DPDPA Effective Date, we will handle it under the Digital Personal Data Protection Act, 2023 (“DPDPA”) and the rules made under it. “DPDPA Effective Date” means the date on which the substantive provisions of the DPDPA and its rules on notice, consent and the rights of Data Principals come into force. Parts of this Policy that start with “From the DPDPA Effective Date” apply only from that date.
  5. 1.5
    “Data Principal” means the individual the personal data relates to (you, and any Nominee or Guest whose data we process). “Data Fiduciary” means the entity that decides why and how personal data is processed. “Data Processor” means a service provider that processes personal data on a Data Fiduciary’s behalf. Face Data, Member, Nominee, Guest, Turnstile Provider, RSC Terms, App Terms and other capitalised terms have the meanings given in the RSC Terms and the App Terms.

2. What we collect, why, and on what basis

  1. 2.1

    What we collect

    • Account details: name, mobile number, email address
    • Profile details: address, company name
    • Membership and booking details: plan, bookings, usage history, Voucher and Benefit usage, entry preferences and special requests
    • Payment details: transaction ID, amount, status, UPI ID/payment reference (card or bank credentials are entered on the payment gateway’s page and are neither shared with us nor stored by us)
    • Device and usage data: browser type, IP address, language, cookies and ID and location, other hardware and software information
    • Communications: support queries, feedback, and our WhatsApp, SMS and e-mail exchanges with you
    • Identity and KYC details: details and documents needed to verify your identity or eligibility for membership, collected only with your separate consent
    • Nominee and Guest details: names, contact details, delivery address and other details needed for bookings, given by the Member or by the Nominee or Guest directly
    • Face Data: your facial image and any template made from it, collected only if you choose facial recognition (FR) entry at an Event (see “Face Data and facial recognition”)
    • Event attendance data: entry and check-in records and the Access Method used
    • Device permissions: camera, notifications, photos or files, contacts (to add Guests) and, where enabled, location, but only if you allow them on your device. Sign-in with Face ID or a fingerprint is handled by your device, and we do not receive that data.
  2. 2.2

    Why we need it

    • To provide the various benefits and services which are associated with the membership
    • To create and secure your account and contact you about the service
    • To personalize the App and deliver membership services
    • To provide and manage your membership and the services you request
    • Marketing and promotional purpose
    • To process payments and issue invoices
    • To keep the App working, secure and improved
    • To show nearby locations and enable check-in
    • To respond to you and resolve issues including service messages like confirmations, reminders, security alerts, etc.
    • To verify identity in order to comply with law
    • Fix bugs and improve the App
  3. 2.3
    We collect only what is needed for the stated purpose. We do not share your personal data except as provided under clause 6 of this Policy. We may also use or disclose data without further consent where the law requires it, for example to comply with a legal obligation or a lawful order of a court or government agency.
  4. 2.4
    We process your personal data (a) with your consent; (b) where you have voluntarily given us the data for a specified purpose, such as joining or booking an Event, and have not told us that you do not consent to that use (from the DPDPA Effective Date, as permitted by DPDPA); and (c) where the law requires or permits it, for example to issue tax invoices or to follow a court order or government direction.
  5. 2.5
    We treat payment details, KYC, and Face Data as sensitive personal data. We collect Face Data and other sensitive personal data only on your separate, specific and express consent.

3. Your consent and how to withdraw it

  1. 3.1
    For Face Data and other sensitive data, consent is separate, specific and express, is given by a clear action, is not bundled with acceptance of the RSC Terms or the App Terms, and is not a condition for using any feature that does not need that data. From the DPDPA Effective Date, the same applies to every consent we ask for. We keep a record of every consent and withdrawal.
  2. 3.2
    You can withdraw consent at any time through consent settings in the App, or by emailing contact@redstub.club or writing to your relationship manager. Once you withdraw, we will stop processing and delete the relevant data within a reasonable time, unless we must retain it by law. Withdrawal does not affect processing done before it and may mean we can no longer provide features that depend on that data.

4. Face Data and facial recognition

  1. 4.1
    At selected Events we may offer facial recognition (FR) entry, run through a Turnstile Provider. FR is optional. If you do not choose it, you can still attend, and entry is managed through the standard means for that Event.
  2. 4.2
    If you consent, your Face Data is captured through the App and used only for FR entry at the Event(s) you chose. We share it with the Turnstile Provider only to verify your entry at those Events. We ask for your consent separately for each booking or Event.
  3. 4.3
    Your Face Data registration is revoked, and the Face Data deleted, when the Event ends. We also require the Turnstile Provider to delete it. We keep a record that you gave and withdrew consent (without the Face Data itself).
  4. 4.4
    You can withdraw consent at any time by reaching out to your designated relationship manager or contacting the Club. We do not use Face Data for any purpose other than FR entry, do not share it except as provided under clause 6 of this Policy, and do not use it to track or profile you.
  5. 4.5
    We handle the Face Data of a person under 18 only with the verifiable consent of a parent or lawful guardian (see “Minor’s Data”).

5. Nominees and Guests

  1. 5.1
    A Member may give us the details of a Nominee or Guest so that we can arrange bookings. A Nominee or Guest is a Data Principal in their own right. We take their consent directly.
  2. 5.2
    A Member who gives us a Nominee’s or Guest’s details confirms that the person knows their data will be used for the booking and Event entry (including FR, if they choose it). A Member must not give us another person’s data without that person’s knowledge.
  3. 5.3
    We use Nominee and Guest details only to manage the booking, entry and Benefits concerned.

6. Who we share data with

  1. 6.1

    We share data only as needed, and only with:

    • Service providers acting for us
    • BookMyShow (BMS), for ticketing and the delivery of m-Tickets
    • Turnstile Providers, for FR entry at the Events you choose (Face Data only)
    • Couriers, to deliver Physical Tickets/Bands
    • Event Organisers, Promoters and Venues
    • Ticketing Platforms and authorized sellers
    • Payment Gateways
    • Overseas Recipients
    • Group entities or partner operators
    • Professional advisers and auditors, under confidentiality; and
    • Courts, regulators, law-enforcement or government bodies, when required by law or a valid legal order.
  2. 6.2
    Service providers and others who process data on our behalf (Data Processors) may use it on our instructions that require them to keep it secure and delete it when it is no longer needed. Event organisers, BMS, payment gateways, venues and other parties who decide their own purposes are separate Data Fiduciaries and handle your data under their own privacy policies.

7. Transfers outside India

  1. 7.1
    We store data on servers located in India. Some service providers may process data outside India. We transfer personal information outside India only to a party that ensures the same level of data protection this Policy requires, and only where necessary to perform our contract with you or where you have consented.

8. How long we keep your data

  1. 8.1
    We keep personal data only as long as needed for the purpose it was collected, or as the law requires. When data is no longer needed, we delete it or make it anonymous.

9. Security

  1. 9.1
    We follow reasonable security practices and procedures as required by the law (and, from the DPDPA Effective Date, the reasonable security safeguards the DPDPA requires), including encryption in transit, access controls, secure authentication, activity logging and regular reviews. If a personal data breach affects you, we will inform you where appropriate. From the DPDPA Effective Date, we will tell you without delay of any data breach, the likely consequences, what we have done and what you can do, and we will report the breach to the Data Protection Board of India as the DPDPA requires.
  2. 9.2
    Please keep your password and OTPs confidential and tell us immediately to block it if you suspect unauthorised access.

10. Your rights

  1. 10.1

    You may:

    • Review and access: ask to see the personal information we hold about you
    • Correct and update: ask us to correct, complete or update inaccurate, incomplete or outdated information
    • Withdraw consent at any time in accordance with clause 3
    • Delete: ask us to delete your data, unless we must keep it by law
    • Nominate: from the DPDPA Effective Date, nominate another individual to exercise your rights if you die or become unable to act (this is separate from a Nominee under the RSC Terms); and
    • Grievance redressal: raise a complaint with us about how your information is handled.

    To exercise any right, use the App or write to the contact below. We will acknowledge your request promptly and respond within 30 days.

11. Minor’s Data

  1. 11.1
    The App is intended for users aged 18 and above, as persons under 18 cannot enter a binding contract in India. We do not knowingly collect information about children, except that a Member may register a person under 18 for FR entry at select Events, which we allow only with the verifiable consent of that person’s parent or lawful guardian. We also do not track or monitor the behaviour of, or target advertising at, a person under 18, and for a person with a disability who has a lawful guardian we obtain the guardian’s verifiable consent. If we learn that we have collected a child’s data without the required consent, we will delete it.

12. Cookies and similar technologies

  1. 12.1
    A “cookie” is a small text file that may be used, for example, to collect information about web-site activity. Some cookies may serve to recall Personal Information previously indicated by a user. Most browsers allow you to control cookies, including whether or not to accept them and how to remove them.
  2. 12.2
    You may set most browsers to notify you if you receive a cookie, or you may choose to block cookies with your browser, but please note that if you choose to erase or block your cookies, you will need to re-enter your original user ID and password to gain access to certain parts of the App.

13. Third-party links and services

  1. 13.1
    The App may link to third-party services including but not limited to a Payment Gateway, WhatsApp or BookMyShow. Their privacy practices are their own, and we encourage you to read their policies.

14. Grievance Officer and contact

Grievance Officer: Kinali Das

Email: contact@redstub.club

Phone: +91 93264 00794

We acknowledge complaints promptly and will revert within 30 days. The Grievance Officer is also the contact person for any question about how we process your personal data.

15. Changes to this Policy

  1. 15.1
    We may update this Policy from time to time. We will notify you in the App or by email of material changes, and where the change needs fresh consent, we will ask for it. We will give you at least thirty (30) days’ notice of a material change. A change that adds a new purpose, or otherwise needs your consent, applies to you only after you give it. On the DPDPA Effective Date we will update this Policy as needed and give you a notice that meets the DPDPA. The latest version is always available in the App.