Privacy Policy

We are committed to protecting your privacy and handling your personal data lawfully, fairly, and transparently. This policy is published in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and — where applicable to users in the EU/EEA — the General Data Protection Regulation (GDPR).

1. Data we collect

1.1 Information you provide

• Identity & KYC: full name, date of birth, photograph, PAN, passport, and other government IDs required by our payment partner.
• Business KYC: certificate of incorporation, GSTIN, IEC, beneficial-ownership details, authorised-signatory information, and bank-account proof.
• Contact: email, mobile number, residential and registered address.
• Financial: your bank-account details, your customers' details, transaction amounts, FEMA purpose codes, and the invoices and documents supporting them.

1.2 Information collected automatically

• Device & technical: IP address, device identifiers, browser, OS, and app version.
• Usage: pages visited, features used, timestamps, and referral URLs.
• Cookies & similar technologies: as described in our Cookie Policy.

1.3 Information from third parties

We may receive data from KYC/verification providers, credit-information companies, banking and payment partners, sanctions/watch-list databases, and publicly available registries, to verify identity and meet legal obligations.

2. Why we use your data & legal basis

3. Consent & its withdrawal

Where we rely on consent, you may withdraw it at any time by writing to grievance@payzoplus.com. Withdrawal does not affect processing carried out before withdrawal, nor processing required to meet a legal obligation or to provide a service you have requested.

4. How we share data

We share the information needed to open and operate your account with our RBI-authorised payment partner, named in the Payment Partner Terms you accept at sign-up, which uses it to verify your business, process payments and meet its legal obligations. We also use service providers such as cloud hosting, email and analytics under data-processing agreements. Your personal data is stored in India. We respond to requests to access, correct or erase your data within 30 days. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India without delay, as required by the DPDP Act, 2023 and DPDP Rules, 2025.

• Payment partner and authorised dealers to execute transactions and settlement;
• KYC, fraud, and sanctions-screening providers to verify identity and meet AML obligations;
• Regulators, law-enforcement, and courts where required by law or valid legal process;
• Service providers (cloud hosting, communications, analytics) under binding data-processing agreements;
• Professional advisers and auditors bound by confidentiality.

5. Cross-border transfers

Some service providers may process data outside India. Where we transfer personal data internationally, we do so in accordance with the DPDP Act and apply appropriate safeguards (such as contractual protections) to ensure a comparable level of protection. Transfers are not made to jurisdictions restricted by the Central Government.

6. Data retention

We retain personal data for as long as your account is active and thereafter for the periods mandated by law — including a minimum of five (5) years for KYC and transaction records under the PMLA and RBI directions — after which data is securely deleted or anonymised.

7. Information security

• Encryption in transit (TLS) and at rest using industry-standard algorithms;
• Access controls, least-privilege, and audit logging;
• Regular security testing and monitoring.

8. Your rights

Subject to applicable law, you have the right to:

• Access a summary of your personal data and the processing activities;
• Correct, complete, update, or erase your personal data;
• Withdraw consent and request data portability (where applicable under GDPR);
• Nominate another individual to exercise your rights in the event of death or incapacity (DPDP Act);
• Grieve and escalate (see Section 10).

To exercise these rights, contact our Data Protection Officer, Ajaj Mohammad Qureshi (Founder & CEO), at grievance@payzoplus.com. We respond within 30 days.

To close your account and have your personal data erased, see Delete Your Account, which sets out how to do it from the app, what is deleted, and which records we are required to keep after an account closes.

9. Children's data

Our Services are not directed to individuals under 18. We do not knowingly process the personal data of children except as permitted by law. If we learn that we have collected such data without verifiable guardian consent, we will delete it.

10. Grievances & Data Protection Officer

For any privacy concern, contact our Data Protection Officer / Grievance Officer, Ajaj Mohammad Qureshi (Founder & CEO), at grievance@payzoplus.com or +91 98932 28615. See our Grievance Redressal Policy for escalation steps. Unresolved complaints may be referred to the Data Protection Board of India.

11. Updates

We may update this policy from time to time. Material changes will be notified through the Platform or by email, and the “last updated” date above will be revised.