Privacy Policy
Effective 3 August 2026 · TrustPay
This policy explains what personal data TrustPay [Registered Entity Name] Private Limited ("TrustPay", "we", "us") collects, why we collect it, who we share it with, and how long we keep it.
It applies to merchants who hold an account with us, to people acting on a merchant's behalf, and to end customers whose payment data passes through our systems. It is written to meet the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under it.
01Data we collect
We collect only what we need to onboard you, move money, meet regulatory obligations and keep the platform secure. Broadly, it falls into four groups.
- Identity and business data — registered name, constitution, PAN, GST registration, CIN, business address, website, and KYC documents for directors, partners or proprietors
- Contact data — name, designation, email address, phone number of the people who operate your account
- Financial data — settlement bank account details, transaction records, settlement history, chargeback and dispute records
- Technical data — IP address, device and browser identifiers, log data, and session activity in the dashboard
For end-customer transactions we receive the data needed to process a payment. Card numbers are tokenised and we do not store raw card details on our systems.
02How we use it
- Verifying your identity and eligibility during onboarding, as required by KYC and anti-money-laundering rules
- Processing payments, payouts, refunds and settlements
- Reconciling transactions and producing statements and reports
- Detecting, investigating and preventing fraud, money laundering and platform abuse
- Providing support, and communicating about outages, changes and account activity
- Meeting obligations to regulators, banks, card networks and law enforcement
- Improving reliability and performance of the platform
We do not sell personal data. We do not share it with advertisers, and we do not use your transaction data to build marketing profiles.
03Consent and legal basis
We process personal data on the basis of your consent, given when you open an account or use the platform, and on the basis of legitimate uses permitted under the Digital Personal Data Protection Act, 2023 — including compliance with law and the performance of our contract with you.
You may withdraw consent at any time by writing to us. Where withdrawal prevents us from providing the service or from meeting a legal obligation, we will tell you plainly and, where necessary, close the account rather than continue processing without a basis.
05How long we keep it
Transaction and KYC records are retained for the period required by Indian law — currently a minimum of five years from the date of the transaction or the end of the business relationship, whichever is later, under prevention of money laundering rules.
Data no longer required for a legal, regulatory or dispute-resolution purpose is deleted or anonymised. Retaining records you have asked us to delete is sometimes a legal obligation rather than a choice, and where that is the case we will say so.
06How we protect it
- Encryption in transit over TLS, and AES-256 encryption for stored data
- Tokenisation of card data, so raw card numbers are not retained
- Access controls limiting internal access to staff with a business need
- Audit logging of access to systems holding personal data
- Segregated production and sandbox environments
No system is immune. Where a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required under the Digital Personal Data Protection Act, 2023.
07Your rights
Under the Digital Personal Data Protection Act, 2023 you may:
- Ask for a summary of the personal data we hold about you and how it is processed
- Ask us to correct or complete inaccurate or incomplete data
- Ask us to erase data that is no longer needed for the purpose it was collected
- Nominate another person to exercise these rights in the event of death or incapacity
- Raise a grievance about how we handle your data
Write to grievance@trustpay.example to exercise any of these. We will respond within 30 days of receipt.
09Data outside India
Payment and KYC data relating to Indian transactions is stored in India, in line with the Reserve Bank of India's data storage requirements.
Where any processing takes place outside India, it is limited to countries not restricted by the Central Government, and is subject to contractual protections equivalent to those applied domestically.
10Children
The platform is for registered businesses and is not directed at children. We do not knowingly process the personal data of a child except where it appears in a transaction record initiated by a merchant, and we do not undertake behavioural monitoring or targeted advertising directed at children.
11Changes to this policy
We update this policy when the law changes or when what we do with data changes. Material changes are notified by email to account holders and reflected in the effective date at the top of this page. Continuing to use the platform after a change takes effect means you accept the updated policy.
12Grievances and contact
Grievance Officer: Grievance Officer name, grievance@trustpay.example.
Nodal Officer: Nodal Officer name, nodal@trustpay.example.
Written correspondence: TrustPay [Registered Entity Name] Private Limited, Registered address line 1, City, State, PIN.
If your grievance is not resolved to your satisfaction, you may escalate to the Reserve Bank of India under the Reserve Bank – Integrated Ombudsman Scheme, or to the Data Protection Board of India for data protection matters.