Privacy Policy

A. INTRODUCTION

This Privacy Policy (“Policy”) sets out the practices of ASANPAY INNOVATION PRIVATE LIMITED, having its registered office at H No. 103, Street No. 10, Main Bazar, Birla Road, Malout, District Sri Muktsar Sahib, Punjab 152107 (the “Company”, “We”, “Our” or “Us”, including its affiliates, if any), for the collection, use, processing, storage, retrieval, disclosure and transfer of Your (“You”, “Your” or “User”, meaning a super distributor, distributor, retailer or other user of the Platform, and where relevant a Customer served by them) information, including personal data and sensitive personal data or information (“Information”). This Information may be received through Your access to and use of the services provided by Us (“Services”) through Our portal, website or mobile application (“Platform”). This Policy is limited to Information collected or received by Us through Your use of the Platform or the Services.

By accessing or using the Platform or availing the Services, and by ticking the acceptance box at sign-up or login, You agree to this Policy. The collection, use, processing, storage, retrieval, disclosure and transfer of Your Information will be carried out in accordance with this Policy and with applicable laws, including the Digital Personal Data Protection Act, 2023 (“DPDPA”), the Information Technology Act, 2000 and the rules under them, and the directions, circulars and guidelines of the Reserve Bank of India (“RBI”), NPCI, UIDAI and other regulators in India (together, “Applicable Laws”). For the personal data of its users, the Company acts as a Data Fiduciary under the DPDPA.

The Company makes Services available through banks, business correspondents, payment aggregators, BBPS operating units, API providers and other service partners (“Service Partners”). Information required for a Transaction is shared with the relevant Service Partner, which may also process it under its own privacy policy.

All terms, conditions and policies governing the use of the Platform (including the Terms & Conditions) are incorporated into this Policy by reference. Please read this Policy carefully. If You disagree with it, do not provide Your Information to Us or use the Platform or the Services.

You represent to the Company that:

(a) the Information You provide is and will be authentic, correct, current and updated, and You have all rights, permissions and consents required to provide it to Us, including any Customer Information You enter on the Platform;
(b) Your providing the Information, and Our storage, collection, use, transfer, access and processing of it, will not violate any agreement, law, judgment, order or decree;
(c) You will keep the Information You provide accurate and up to date at all times; and
(d) You are at least 18 years of age, have not previously been suspended or removed from the Platform, have the right and capacity to accept this Policy, and will not impersonate any person or misrepresent Your identity, age or affiliation.

Your Information is primarily stored in electronic form, though certain records may be kept in physical form. We may engage third parties to store or process Information, and will require them to adopt reasonable security standards to safeguard it.

Note: “Personal Information” means personal data and sensitive personal data or information as defined under Applicable Laws.

B. WHAT WE COLLECT

We may collect, access or record the following Information:

B.1 KYC-related information

(a) Personal details such as name, email ID, mobile number, residential and business address, date of birth, and identity documents such as PAN, Aadhaar-based KYC details (stored only in masked or tokenised form where a regulated partner permits), voter ID, driving licence or passport, provided by You to avail the Services.

(b) Images or photos of documents, a live photo or selfie, and video where required for KYC or outlet verification.

(c) Business details such as shop name, business type, GST details (including GST details fetched from PAN or GST number), shop photographs and Retailer Location, as part of onboarding and record retention required under Applicable Laws.

(d) Bank account details (account number, IFSC, account holder name) and the result of bank account verification.

B.2 Financial information and Transactions

(a) Transaction history, Wallet balances (MAIN and AEPS), Commissions, fund requests, settlements, reversals, chargebacks and payment details, for maintaining records of Your Wallet as required under Applicable Laws.

(b) Customer details entered by You to perform a Transaction, such as name, mobile number, beneficiary bank details, biller or subscriber numbers and, for AEPS, the Aadhaar number and an encrypted biometric data block. Biometric data is captured by the certified RD device, passed in encrypted form to the Service Partner or bank for authentication, and is never stored by Us.

(c) Your phone number and the transactional and promotional SMS, WhatsApp and app notifications sent to You.

B.3 Fraud detection and prevention

(a) Device information such as device model, operating system, app version, device identifiers made available by the device, network carrier, IP address, and login, session and security events (including failed logins and OTP request events, but never the OTP value).

(b) Your approximate or precise location, based on the best available sources including GPS, mobile network, Wi-Fi and IP, at login and when performing certain Transactions, where requested through Your device’s permission prompt. Banks and Service Partners require geo-tagging of certain Transactions.

(c) Your password and MPIN, stored only in hashed form that cannot be read by anyone, including Us.

B.4 Other actions

(a) Feedback, survey responses, complaints and support messages You send to Us.

(b) Usage patterns on the Platform, such as features used and preferences, to improve the Services.

(c) Records of Your acceptance of the Terms & Conditions and this Policy, with version, date, time and method.

Note: You may refuse to provide Personal Information, but this may prevent You from accessing certain Services.

You may withdraw Your consent for the collection and use of Your Personal Information at any time as set out in Section J. However, We will not be able to delete Your KYC-related information, financial information and Transactions, or fraud detection and prevention records, for the period these must be retained under Applicable Laws (see Section F).

C. WHAT WE DO WITH THE PERSONAL INFORMATION WE GATHER

We may use Your Personal Information to:

(a) process Transactions and settle them with Service Partners;
(b) create, administer and personalise Your account and the Services;
(c) verify Your identity, complete KYC and register Your outlet with Service Partners;
(d) process Your requests, instructions and fund requests;
(e) calculate Commissions, TDS, GST and other deductions;
(f) share updates on changes to the Services and their terms, including the Platform’s terms and conditions;
(g) investigate complaints, claims, chargebacks and disputes;
(h) respond to Your queries and feedback, and send important notices, including changes to this Policy;
(i) carry out screening and due diligence checks as lawfully required;
(j) detect, prevent and investigate fraud, money laundering, misuse and security incidents;
(k) undertake research and analytics to improve the Services, their security and quality, and troubleshoot issues;
(l) carry out financial, regulatory and management reporting, maintain risk management models, conduct audits and keep records;
(m) show You relevant offers, promotions and new Services, and send newsletters, where You have not opted out; and
(n) comply with Applicable Laws, regulations, court orders and regulatory directions.

We do not sell Your Personal Information.

D. COLLECTION AND USE OF NON-PERSONAL INFORMATION

We may collect non-personal information when You use the Platform, such as browser type, device type, operating system, internet service provider and similar technical information. This information is aggregated and used to improve the Platform and understand which parts of the Services are of most interest to Users. If We combine non-personal information with Personal Information, the combined information is treated as Personal Information for as long as it remains combined.

The web portal uses strictly necessary cookies and local storage to keep You signed in, secure Your session and remember basic preferences. Disabling them in Your browser may stop the portal from working.

D.1 Sharing of information with authorities

We may disclose Your Personal Information to courts, law-enforcement agencies and any government, regulatory or statutory authority, as required by them under Applicable Laws or in connection with any proceeding or investigation.

E. SECURITY

We are committed to keeping Your Personal Information secure. We adopt appropriate data collection, storage and processing practices and security measures, including encryption in transit, hashed passwords and MPINs, role-based access controls, audit logs and monitoring, to protect against unauthorised access, alteration, disclosure or destruction of Your Personal Information and Transaction data.

We implement reasonable security practices and procedures as required under the Information Technology Act, 2000 and the DPDPA, with managerial, technical, operational and physical security controls appropriate to the Information collected and the nature of Our business.

While We try Our best to keep Your Information safe, no method of transmission or storage over the internet is completely secure, and We cannot guarantee absolute security. If We become aware of a personal data breach, We will notify the Data Protection Board of India and affected Users as required under the DPDPA, and take steps to contain it.

We will never call, SMS, email or WhatsApp You asking for Your password, MPIN or OTP. Keep them confidential.

F. RETENTION OF PERSONAL INFORMATION

We retain Your Personal Information for as long as the purpose for which it was collected exists, or until You withdraw Your consent, whichever is earlier, after which it will be erased, except where retention is required under Applicable Laws. In particular, KYC records and Transaction records are retained for at least 5 (five) years after the end of the business relationship or the date of the Transaction, as required under the Prevention of Money Laundering Act, 2002 and related rules, or longer where required by RBI, a bank, a Service Partner, an investigation or a legal proceeding.

Payment system data is stored only in India, as required by RBI directions. Our servers are located in India.

F.2 Sharing Personal Information

We use third-party service providers to help Us operate Our business and provide the Services. We share Personal Information with them only on a need-to-know basis and for limited purposes, and require them to keep it confidential and protect it. Certain Service Partners (such as banks, payment aggregators and BBPS operating units) have their own privacy policies for the Information We are required to give them, and We recommend that You read them. Once You leave the Platform or are redirected to a third-party website or app, this Policy no longer applies and that party’s policy applies instead.

F.3 Disclosures

Your Personal Information may be shared with:

(a) Service Partners and payment processing partners: banks, business correspondents, payment aggregators, API providers, BBPS operating units, NPCI and other payment networks, to register Your outlet and process, settle and reverse Transactions;
(b) IT service providers: cloud hosting, SMS, email, WhatsApp, push notification, customer support and analytics providers engaged to operate the Platform;
(c) Identity and information verification providers: to complete KYC, PAN, bank account and other verification as required under Applicable Laws;
(d) Your Upline: Your super distributor or distributor, limited to the information needed to manage the network (such as Your name, mobile number, account status, fund requests and Transaction summaries);
(e) Government and regulatory bodies: government, law-enforcement agencies, authorities and regulators, to comply with legal obligations;
(f) Business partners: partners offering financial products or services through the Platform, only with Your consent;
(g) Auditors and professional advisers: for audit, legal and compliance purposes;
(h) Affiliates and successors: Our affiliates (if any) and any successor entity in a merger, acquisition or restructuring, in compliance with Applicable Laws; and
(i) any other party where We have Your consent for the purpose disclosed to You at the time You provide the Information.

G. THIRD-PARTY WEBSITES

The Platform may contain links to the websites and services of Service Partners and other third parties. We do not control those websites and are not responsible for their content or privacy practices. Your interaction with any such website or service is governed by its own terms and privacy policy.

H. CHANGES TO THIS POLICY

We may change, update or modify this Policy from time to time. The updated version and effective date will be published on the Platform, and for material changes We may ask You to accept the updated Policy at Your next login. Please check this Policy regularly. Your continued use of the Platform after a change indicates Your acceptance of the updated Policy.

I. YOUR ACCEPTANCE OF THIS POLICY

By using the Services or accessing the Platform, You agree to be bound by this Policy and give Your specific and explicit consent for Us to collect, use, process and share Your Personal Information and non-personal information as set out in this Policy. If You do not agree, please do not use the Services.

You confirm that Your consent is free, specific, informed, unconditional and unambiguous, and signifies Your agreement to the processing of Your Personal Information for the purposes specified in this Policy.

J. YOUR RIGHTS

Subject to the DPDPA and other Applicable Laws, You have the right to:

(a) Access: obtain a summary of Your Personal Information processed by Us and the processing activities, the identities of the third parties with whom it has been shared along with a description of the information shared, and any other information prescribed under Applicable Laws;
(b) Correction: review, correct, complete or update inaccurate or incomplete Personal Information;
(c) Erasure and withdrawal of consent: withdraw Your consent and request erasure of Your Personal Information, except Information We are legally required to retain (see Section F). Withdrawal may mean that We can no longer provide the Services for which the Information was needed;
(d) Promotional messages: opt out of promotional communications at any time;
(e) Nomination: nominate another person to exercise Your rights in case of death or incapacity; and
(f) Grievance: raise a grievance with Our Grievance Officer and, if not resolved, approach the Data Protection Board of India.

To exercise these rights, email help@asanpay.in or the Grievance Officer in Section K from Your registered email, or raise a request through the Platform. We may verify Your identity before acting on a request. Records retained under Applicable Laws will be made available to regulators and investigating agencies when required.

K. CONTACT US / GRIEVANCE OFFICER

Please contact Our Grievance Officer at the details below. We will acknowledge a grievance within 24 hours and try to resolve it within 15 days, or any shorter period required by law.

Grievance Officer

Name: Ajay Kumar

Designation: Director & Grievance Officer

Email: help@asanpay.in (subject: “Attn: Grievance Officer”)

Address: ASANPAY INNOVATION PRIVATE LIMITED, H No. 103, Street No. 10, Main Bazar, Birla Road, Malout, District Sri Muktsar Sahib, Punjab 152107

Customer Support

Phone: 9780777781

Email: help@asanpay.in

Hours: Business days (except public holidays)

L. GOVERNING LAW AND DISPUTE RESOLUTION

The Platform and the Services are controlled and operated from India and are intended for use in India. If You access the Platform from outside India, You are responsible for complying with local laws.

This Policy is governed by and construed in accordance with the laws of India. Disputes relating to this Policy will be resolved as set out in the governing law and jurisdiction section of the Terms & Conditions, and the courts at Sri Muktsar Sahib, Punjab have exclusive jurisdiction, without affecting Your right to approach the Data Protection Board of India.