Privacy Policy

1. Introduction

Paytric Technologies Pvt. Ltd. ("Paytric", "we", "us" or "our") operates the website paytric.in and its associated payment products and services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, store and safeguard your information when you use our Services, and describes the rights you have in relation to your personal data.

By accessing or using our Services, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please discontinue use of the Services.

2. Information We Collect

We collect information in the following ways:

• Account & KYC information: name, business name, email address, phone number, PAN, Aadhaar (where required by law), bank account details, GSTIN, and incorporation documents, as required for identity verification under applicable KYC/AML regulations including RBI guidelines.
• Transaction information: payment amounts, currency, payer/payee identifiers, card network tokens, UPI IDs, settlement records, refunds and chargeback history.
• Device & usage data: IP address, browser type, operating system, device identifiers, pages visited, session duration, and interaction logs, collected automatically when you use our Services.
• Communications: records of support tickets, emails, calls, feedback and survey responses.
• Cookies & similar technologies: see Section 5 below.

3. How We Use Your Information

We use the information we collect to:

1. Provide, operate and maintain the Services, including processing payments, refunds, payouts and settlements;
2. Verify your identity and complete KYC/AML obligations;
3. Detect, prevent and investigate fraud, money laundering and other prohibited activities;
4. Send transactional communications (payment receipts, settlement alerts, OTPs) and, with your consent, product updates and marketing;
5. Improve and personalise the Services, including analytics and product research;
6. Comply with legal, tax, audit and regulatory obligations, including reporting to authorities where required;
7. Enforce our Terms & Conditions and protect the rights, safety and property of Paytric, our users and the public.

4. Sharing & Disclosure

We do not sell your personal data. We share information only as described below:

• Banking & payment partners: acquiring banks, card networks, NPCI/UPI ecosystem participants and payout partners, strictly as needed to complete transactions.
• Service providers: cloud hosting, KYC verification agencies, fraud-screening, customer support and analytics vendors, bound by confidentiality and data-processing agreements.
• Regulators & law enforcement: where disclosure is required by law, regulation, court order or government authority (including RBI, FIU-IND and tax authorities).
• Business transfers: in connection with a merger, acquisition or sale of assets, subject to this Policy's protections continuing to apply.
• With your consent: any other sharing will occur only with your explicit consent.

5. Cookies & Tracking

We use cookies and similar technologies for:

• Essential cookies — authentication, session security and fraud prevention (cannot be disabled);
• Preference cookies — remembering settings such as language and dashboard layout;
• Analytics cookies — understanding usage patterns to improve the product (aggregated/pseudonymous);
• Marketing cookies — measuring campaign performance, used only with your consent.

You can control cookies through your browser settings. Disabling essential cookies may prevent parts of the Services from functioning.

6. Data Security

We implement industry-standard administrative, technical and physical safeguards, including:

• 256-bit TLS encryption in transit and AES-256 encryption at rest;
• PCI DSS Level 1 certification and ISO/IEC 27001-aligned controls;
• Role-based access control, multi-factor authentication and audit logging for internal systems;
• Continuous vulnerability assessment, penetration testing and 24×7 security monitoring;
• Tokenisation of card data and strict data minimisation practices.

While we work hard to protect your data, no method of transmission over the internet is 100% secure. In the unlikely event of a breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy and to satisfy legal obligations. Transaction and KYC records are retained for a minimum period mandated under applicable Indian law (typically 5–10 years), after which they are securely deleted or anonymised.

8. Your Rights

Subject to applicable law, you may have the right to:

• Access a copy of the personal data we hold about you;
• Correct inaccurate or incomplete information;
• Request erasure of your data where it is no longer needed or consent is withdrawn (subject to legal retention requirements);
• Object to or restrict certain processing, including direct marketing;
• Data portability for information you provided to us;
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@paytric.in. We will respond within 30 days.

9. International Data Transfers

Your data is primarily stored and processed in India. Where data is transferred outside India (for example, to cloud regions or global card networks), we ensure appropriate safeguards are in place in accordance with the Digital Personal Data Protection Act, 2023 and other applicable laws.

10. Children's Privacy

Our Services are intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us personal information, please contact us and we will promptly delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website at least 15 days before they take effect. The "Last updated" date above reflects the latest revision. Continued use of the Services after the effective date constitutes acceptance.

12. Grievance Officer & Contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, we have appointed a Grievance Officer to address your concerns: