Who we are and what this covers
This policy explains how Kadyan Paygate India (OPC) Private Limited ("we", "us") collects, uses, shares, stores and protects personal data, and how you can exercise your rights over it. It covers our website, our console and mobile app, our API, and our support channels. It is written to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it, the Information Technology Act, 2000 and the rules on reasonable security practices, and the Reserve Bank of India's directions on the storage of payment system data.
Our Grievance Officer for data-protection matters is Harsh Kadyan, reachable at merchant.support@kadyanindustries.com. Legal notices may be sent to legal@kadyanindustries.com.
What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, designation, company, email address, mobile number, postal address | You, or the business that onboards you |
| Verification (KYC) data | Officially valid documents and their numbers, PAN, photographs, video verification recordings, date of birth, Aadhaar-based verification results where you choose that method, CKYC identifiers | You, DigiLocker, CKYCR, our RBI-licensed partners |
| Business and ownership data | Registration numbers, constitutional documents, beneficial-owner details, bank account details, financial statements | The business, public registries (MCA, GST) |
| Financial and transaction data | Card identifiers (tokenised), balances, loads, spends, merchant details, bill payment references, consumer numbers, reward and points activity, expense receipts you upload | Generated on the platform; partner banks; the Bharat Connect network |
| Technical and device data | IP address, device identifiers, operating system, browser, app version, approximate location derived from IP, log and crash data | Your device, automatically |
| Usage data | Pages and features used, actions taken in the console or app, timestamps | Your use of our services |
| Communications | Emails, support tickets, feedback, call recordings where we tell you a call is recorded | You |
| Cookies and similar technologies | See the cookies section below | Your browser |
We do not deliberately collect data about your religion, caste, health, sexual orientation, political opinions or biometrics, other than the photograph and, where you choose it, the video used for identity verification, which is handled by our licensed partners in accordance with the RBI's KYC directions.
Why we use it and on what basis
Under the DPDP Act we process personal data either with your consent or for a legitimate use the Act recognises. The table shows which applies.
| Purpose | Basis |
|---|---|
| Providing the services you or your business asked for: issuing and managing instruments, applying spend controls, running rewards, fetching and paying bills, producing statements and reports | Consent given when you sign up or accept a programme; for employees, the legitimate use relating to employment where the programme is provided by your employer |
| Verifying identity and complying with anti-money-laundering, sanctions, tax and other legal obligations, and with the requirements of the RBI, NPCI and our licensed partners | Legitimate use: compliance with law, and with judgments, orders and directions of authorities |
| Detecting and preventing fraud, abuse and security incidents | Legitimate use; and consent where the processing goes beyond what is necessary for the service |
| Responding to your requests and complaints | Consent implied by your request; legitimate use for grievance handling |
| Improving the platform, fixing errors and understanding how features are used | Consent, which you may withdraw; analytics cookies are set only with your consent |
| Sending you service notices about your account, security and changes to terms | Necessary to provide the service; these cannot be opted out of while you hold an account |
| Sending marketing about our services | Consent only; you may withdraw at any time using the link in every message or by writing to us |
Where we rely on consent, the request is presented separately from other terms, in plain language, and you may withdraw it as easily as you gave it. Withdrawal does not affect processing that already took place, and we may still need to retain some data to meet legal obligations described below.
Who we share it with
We share personal data only where necessary, only with recipients bound by contract or law to protect it, and never by selling it. Recipients include:
- RBI-licensed partner banks and prepaid instrument issuers that issue the cards on our platform and hold the funds. They are data fiduciaries for the instrument they issue and receive the identification and transaction data the RBI's directions require.
- NPCI Bharat BillPay and the operating units and billers on the Bharat Connect network, to fetch and settle bills you ask us to pay and to handle complaints.
- Card networks (for example RuPay) to authorise and settle card transactions.
- Verification providers including the Central KYC Records Registry, DigiLocker, and the income-tax, MCA and GST databases used to verify documents.
- Service providers that host our infrastructure in India, send emails and SMS, provide analytics under our instructions, and support us with security monitoring and customer support tooling. Each acts on our documented instructions under a written contract.
- The business that enrolled you, where you use the platform through your employer's or a brand's programme: it sees the data needed to administer its programme — for example the transactions on a corporate card, or points earned — and not data unrelated to that programme.
- Auditors, professional advisers, and insurers under duties of confidentiality.
- Regulators, law-enforcement agencies and courts where the law requires or permits disclosure, including the Financial Intelligence Unit – India through our reporting-entity partners.
- A successor in the event of a merger, acquisition or reorganisation, subject to this policy continuing to apply.
Where and how long we keep it
Location. Personal data and all payment system data are stored on infrastructure located in India, in line with the Reserve Bank of India's directions on the storage of payment system data. We do not transfer personal data outside India except where a service provider needs limited access for support purposes under a contract that requires equivalent protection and where the law permits, and never for payment system data covered by the RBI's localisation requirement.
Retention. We keep personal data only as long as needed for the purpose it was collected, and then delete or anonymise it, subject to the legal minimums below.
| Data | Retention |
|---|---|
| Identification and KYC records | At least five years after the relationship ends, as the PML Rules require, and longer where a competent authority or partner requires |
| Transaction records | At least five years from the date of the transaction; longer where required for disputes, audit or tax |
| Complaint and grievance records | Five years from closure |
| Account and profile data for active users | For the life of the account, then per the categories above |
| Support communications | Three years from the last interaction |
| Technical logs | Twelve months, unless retained for a security investigation |
| Marketing consent and preferences | Until you withdraw consent, plus a record of the withdrawal |
| Cookie data | As set out in the cookies section |
How we protect it
- Card numbers are tokenised; full card numbers are never stored on our systems and are handled only within a PCI-DSS scoped environment operated with our partners.
- Data is encrypted in transit using TLS and at rest using industry-standard encryption. Verification documents and recordings are stored in encrypted, segregated storage with restricted access.
- Access to personal data is limited to staff who need it for their role, controlled by role-based permissions, protected by multi-factor authentication, and logged. Money movement requires two people.
- Systems are monitored continuously for security events, tested regularly for vulnerabilities, and patched on a defined schedule. Backups are encrypted and stored in India.
- Staff and contractors are screened before appointment, bound by confidentiality, and trained in data protection on joining and annually.
- We maintain an incident-response plan. If a personal data breach occurs, we notify the Data Protection Board of India and each affected individual in the manner and within the time the DPDP Act and its rules require, and we tell you what happened, what data was involved, what we are doing, and what you can do.
No system is perfectly secure. If you believe your account has been compromised, freeze any card from the console or app immediately and write to us with URGENT in the subject line.
Your rights and how to use them
As a data principal under the DPDP Act you have the right to:
- Access a summary of the personal data we hold about you, the purposes for which it is processed, and the categories of recipients with whom it has been shared.
- Correction and completion of inaccurate or incomplete data, and updating of data that has changed.
- Erasure of personal data that is no longer necessary for the purpose it was collected, unless the law requires us to retain it (for example KYC and transaction records for five years).
- Withdraw consent at any time for processing based on consent.
- Grievance redressal through our Grievance Officer, and thereafter to the Data Protection Board of India if you are not satisfied with our response.
- Nominate another person to exercise your rights in the event of your death or incapacity.
To exercise any right, write to merchant.support@kadyanindustries.com from your registered email, or use the Help section in the console or app. We will verify your identity before acting, respond within 30 days, and tell you if we need longer and why. Where we cannot comply — usually because a law requires us to keep the data — we will explain which law and for how long. If you use the platform through a business's programme, we may direct your request to that business as the data fiduciary and will support it in responding.
Children
Our services are provided to businesses and to adults. We do not knowingly process the personal data of anyone under 18 without the verifiable consent of a parent or lawful guardian, and we do not track, monitor behaviourally, or direct advertising at children. If you believe we have collected data from a child without such consent, write to us and we will delete it.
Cookies and similar technologies
Cookies are small text files placed on your device by a website. We also use local storage and similar technologies in the console and app. This section explains which we use, why, and how to control them.
Categories
| Category | Purpose | Consent |
|---|---|---|
| Strictly necessary | Keep you signed in, remember your session, protect against cross-site request forgery, balance load across servers, and remember your cookie choices. The service cannot work without them. | Not required; cannot be switched off |
| Functional | Remember preferences such as language, layout and the last programme you viewed. | Consent, via the banner or settings |
| Analytics | Understand which pages and features are used and where errors occur, so we can improve the platform. Data is aggregated and we configure providers not to build cross-site profiles. | Consent, via the banner or settings |
| Advertising | We do not use advertising or retargeting cookies on our website or platform. | Not applicable |
Cookies we set
| Name | Category | Purpose | Duration |
|---|---|---|---|
| kpg_session | Strictly necessary | Maintains your authenticated session in the console | Session |
| kpg_csrf | Strictly necessary | Protects forms against cross-site request forgery | Session |
| kpg_consent | Strictly necessary | Records the cookie choices you made in the banner | 12 months |
| kpg_prefs | Functional | Stores interface preferences | 12 months |
| kpg_analytics | Analytics | Assigns an anonymised identifier used to count visits and feature use; set only if you accept analytics cookies | 13 months |
Our public website loads fonts from Google Fonts, which may result in your IP address being sent to Google when the font files are requested. No cookies are set by that request. Where we embed third-party content in future, we will update this table.
Managing cookies
- When you first visit, a banner lets you accept all cookies, reject all but the strictly necessary ones, or choose categories. You can change your choice at any time from the Cookie settings link in the footer.
- Every major browser lets you block or delete cookies through its settings. Blocking strictly necessary cookies will prevent you from signing in.
- We honour the Global Privacy Control signal where your browser sends it, treating it as a refusal of analytics and functional cookies.
Third-party links and changes to this policy
Our website and platform may link to sites operated by our partners, billers or others. Those sites have their own privacy practices, which we do not control and which you should read.
We may update this policy when our services, the law or our partners' requirements change. Material changes are announced by notice in the console or app and, for changes affecting how we use your data, by email to your registered address before they take effect. The version and effective date are shown at the top of this page, and previous versions are available on request from merchant.support@kadyanindustries.com.