Data Protection Agreement

1. Roles We Play

For services like web hosting, cyber security, and API/portal development, PayzonIndia typically acts as a Data Processor, handling data strictly under the client's instructions. For our own client relationship data (billing, contact and account information), we act as the Data Controller and are responsible for how that information is used.

2. Data We Collect

• Business and contact details: name, company, email, phone number, billing address
• KYC and verification documents: Aadhaar, PAN, GST, corporate registration details submitted for verification services
• Technical data: server logs, IP addresses, and API usage logs generated through hosting and API products
• Project data: content, credentials, and assets shared for the purpose of building or maintaining your service

3. Purpose of Processing

Data is processed strictly to deliver the contracted service — building and maintaining your website or application, completing Aadhaar/PAN/GST/corporate verification, provisioning and securing hosting infrastructure, running marketing campaigns you've authorized, and communicating project updates, invoices, and support responses. We do not sell personal data to third parties under any circumstance.

4. Data Security Measures

• Encryption of sensitive data (KYC documents, credentials) both in transit (TLS/SSL) and at rest
• Role-based access controls limiting data visibility to authorized team members only
• Firewalls, intrusion detection, and continuous monitoring across our hosting and server infrastructure
• Automated, encrypted backups with disaster recovery protocols for hosted client data
• Periodic internal security audits and vulnerability assessments

5. Data Retention

Personal and project data is retained only for as long as necessary to fulfil the purpose it was collected for, or as required by applicable law (for example, financial records under Indian tax regulations). KYC verification data is retained in line with regulatory recordkeeping requirements and deleted or anonymized thereafter unless you request earlier deletion, subject to any legal obligation to retain it.

6. Sub-Processors & Third Parties

We may share limited data with vetted third-party providers strictly necessary to deliver our services — for example, payment gateways, SMS/DLT providers, cloud infrastructure partners, and government verification APIs (Aadhaar, PAN, GST, MCA). These providers are bound by confidentiality and data protection obligations, and are engaged only to the extent required for the specific service.

7. Your Rights as a Data Subject

• Request access to the personal data we hold about you
• Request correction of inaccurate or outdated information
• Request deletion of your data, subject to legal or contractual retention requirements
• Withdraw consent for marketing communications at any time
• Raise a grievance with our designated Grievance Officer regarding data handling

8. International Data Transfers

Our infrastructure and data are primarily hosted within India. Where a client's project requires data to be processed by an overseas cloud or software partner, we ensure such transfers occur only with appropriate safeguards and in compliance with applicable Indian data protection law.

9. Breach Notification

In the unlikely event of a data breach affecting personal data we control or process, we will assess the impact promptly and notify affected clients without undue delay, along with the steps being taken to contain and remediate the incident, in accordance with applicable law.

10. Regulatory Compliance

This Agreement is framed in accordance with the Information Technology Act, 2000 (and associated rules), and the Digital Personal Data Protection Act, 2023 of India. Our verification services additionally operate under the applicable guidelines for Aadhaar, PAN, and GST data handling issued by the relevant government authorities.