Privacy Policy

PRIVACY POLICY

OPTION PAY INDIA

Last Updated: 22nd September 2025

Option Pay India ("Company", "we", "our", "us") values the privacy and trust of its users.
This Privacy Policy explains how we collect, use, store, share, and protect your information
when you use our website www.optionpay.in, mobile applications, products, and services

(collectively, "Services").

By accessing or using our Services, you agree to the terms of this Privacy Policy.

1. SCOPE & APPLICABILITY

This Privacy Policy applies to:

• Individuals using our B2C payment services, digital wallets

• Merchants and businesses using our payment gateway, merchant acquiring,
and B2B solutions

• Customers availing our lending and credit services
• All visitors accessing our website, applications, and platforms

It is applicable globally, with specific compliance under Indian laws (RBI, IT Act 2000,
DPDP Act 2023, and allied regulations) and international standards

2. INFORMATION WE COLLECT

We may collect the following categories of information:

a. Personal Identifiable Information (PII)

• Full name, contact number, email ID, address
• Government-issued IDs (PAN, Aadhaar, Passport, Voter ID, Driving License, etc.)

for KYC/AML compliance
• Date of birth, photographs, and identity verification documents

• Merchant and business registration documents

3. HOW WE USE YOUR INFORMATION

We process data strictly for lawful, necessary, and transparent purposes, including:

• Payment Processing – To process transactions, settlements, domestic and
international transfers

• KYC/AML Compliance– To verify identity, prevent fraud, and comply with RBI &
legal mandates

• Credit & Lending Services – To assess creditworthiness, provide loans, and
manage repayments

• Fraud & Risk Management– To detect, investigate, and prevent suspicious or
unlawful activity using AI/ML algorithms

• Customer Support – To respond to queries, resolve disputes, and provide
assistance

• Service Improvement– To enhance user experience, optimize systems, and develop
new features

• Marketing & Communication – To send updates, offers, and service-related
information (with opt-out choice)

• Regulatory Reporting– To meet RBI, tax, and other statutory reporting
requirements

4. LEGAL BASIS FOR PROCESSING

We process information based on

• Consent – When you agree to share data for specific purposes (especially
biometric data)

• Legal Obligation– Compliance with RBI, IT Act 2000, DPDP Act 2023, KYC/AML
regulations

• Contractual Necessity– To deliver payment, merchant acquiring, and lending
services

• Legitimate Interest– To maintain security, prevent fraud, and improve services

5. DATA SHARING & DISCLOSURE

We may share information with:

Service Delivery Partners

• Banks, card networks (Visa, Mastercard, RuPay), UPI, and payment partners for
processing transactions

• Credit bureaus (CIBIL, Experian, Equifax) and KYC agencies for verification and
scoring

• Technology and cloud providers (including servers outside India) under strict
data processing agreements

Regulatory & Legal Requirements

• Regulatory authorities(RBI, FIU-IND, SEBI) for compliance and supervision
• Government agencies and law enforcement for legal investigations

• Tax authorities for statutory reporting and compliance
• Courts and tribunals in response to legal proceedings

Business Operations

• Third-party service providers for fraud detection, analytics, customer support, or
marketing

• Collection agencies for loan recovery (with limited data sharing)
• Affiliates and group companies for consolidated service delivery

We do not sell, rent, or trade your personal information for commercial profit.

6. INTERNATIONAL DATA TRANSFERS

Since we operate globally, your data may be transferred and stored outside India for:

• Cross-border payment processing and settlement
• International banking partnerships and correspondent banking

• Global technology infrastructure and cloud services
• Regulatory compliance in operating jurisdictions

Safeguards Applied:

• Standard contractual clauses approved by data protection authorities
• Adequacy decisions and certified privacy frameworks

• End-to-end encryption for all international data transfers
• Critical financial data localization as required by Indian law

7. DATA RETENTION

Personal data is retained only as long as necessary for business, legal, and regulatory
purposes:

• KYC documents: 5 years after account closure (RBI requirement)
• Transaction records: 10 years from transaction date (statutory requirement)

• Credit information: 7 years from loan closure/settlement
• Marketing data: Until opt-out or 2 years of inactivity

• Biometric data: Until consent withdrawal or account closure
• Technical logs: 1 year for security and audit purposes

Data may be anonymized or securely deleted once retention periods expire.

8. DATA SECURITY

We implement robust security measures including:

Technical Safeguards

• Encryption & Tokenization of all sensitive data (AES-256 standard)
• PCI-DSS Level 1 compliance for payment card data protection

• Multi-factor authentication and biometric verification systems
• Advanced fraud detection using machine learning algorithms

Operational Safeguards

• Access controls & monitoring to prevent unauthorized data access
• Regular security audits, penetration testing, and vulnerability assessments

• Incident response procedures with 24/7 security monitoring
• Employee training on data protection and security best practices

Physical Safeguards

• Secured data centers with biometric access controls
• Environmental controls and redundant backup systems

• Secure disposal of storage media and equipment

While we implement industry-leading safeguards, no system is 100% secure. Users
are encouraged to maintain strong account security practices.

9. BIOMETRIC DATA PROTECTION

Given our use of biometric authentication, we provide enhanced protections:

• Explicit consent obtained before any biometric data collection
• Local processing where biometric matching occurs on your device

• Template storage- we store mathematical representations, not raw biometric
images

• Advanced encryption with dedicated security keys for biometric data
• Alternative authentication methods always available

• Immediate deletion upon account closure or consent withdrawal

10. YOUR RIGHTS

Depending on applicable law, you may exercise the following rights:

• Access & Portability – Request a copy of your personal data in structured format
• Correction – Update or rectify incorrect information through your account or

support
• Withdrawal of Consent – Opt-out of biometric authentication, marketing

communications, or location tracking
• Erasure/Deletion – Request data deletion, subject to regulatory retention

requirements
• Restriction/Objection – Limit certain processing activities or object to data use
• Data Portability – Export your account data when switching service providers

How to Exercise Rights:

• Use privacy controls in your account dashboard
• Email us at info@optionpay.in with specific requests
• Contact our Grievance Officer (details in Section 13)

We will respond to verified requests within 30 days.

11. COOKIES & TRACKING TECHNOLOGIES

We use cookies and similar technologies to:

• Maintain secure user sessions and prevent fraud
• Analyze website traffic and improve user experience
• Provide personalized content and targeted advertising

• Enable social media features and third-party integrations

Types of Cookies:

• Essential cookies for website functionality (no consent required)
• Analytics cookies for performance measurement (consent-based)
• Marketing cookies for advertising and promotions (consent-based)

Users may manage cookie preferences through browser settings or our consent
management platform. Disabling cookies may limit website functionality.

12. POLICY FOR MINORS

Our Services are not directed to individuals under 18 years of age. We do not knowingly
collect personal data from minors without verified parental/guardian consent. If we

become aware of data collection from a minor, we will take immediate steps to delete such
information.

For educational institution partnerships or family accounts, additional parental consent and
monitoring mechanisms apply.

13. GRIEVANCE REDRESSAL & CONTACT INFORMATION

In accordance with Indian data protection laws and RBI guidelines, we have appointed
dedicated officers:

Grievance Officer

Name: Ganesh Sharma
Designation: Chief Executive Officer

Email: info@optionpay.in
Phone:

Address: C-231, KA-324, The Arcade, Sector-12, Pratap Vihar, Ghaziabad-201009
Response Time: 7 business days for acknowledgment, 30 days for resolution

General Privacy Inquiries

Email: info@optionpay.in
Customer Support: 9910632077

Website: www.optionpay.in/privacy-policy

If unsatisfied with our response, you may escalate complaints to:

• RBI Ombudsman for payment-related issues
• Relevant regulatory authorities based on the nature of complaint

• Consumer protection forums under applicable law

14. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in:

• Technology and business practices
• Legal and regulatory requirements

• Service offerings and features
• Industry standards and best practices

Notification of Changes:

• Email notification to registered users for material changes
• Prominent notice on our website and mobile applications

• 30-day advance notice before changes take effect
• Previous versions available for reference upon request

Updated versions will be posted on optionpay.in with the "Last Updated" date. Continued
use of our Services after changes indicates acceptance of the updated policy.

15. COMPLIANCE AND CERTIFICATIONS

Option Pay India maintains compliance with:

Indian Regulations

• Reserve Bank of India (RBI) - Payment System Operator authorization
• Information Technology Act, 2000 and Rules
• Digital Personal Data Protection Act, 2023

• Prevention of Money Laundering Act (PMLA)
• Companies Act, 2013 and corporate governance requirements

International Standards

• Payment Card Industry Data Security Standard (PCI-DSS) Level 1

Industry Certifications

Regular audits and assessments ensure ongoing compliance with applicable standards and
regulations.

16. GOVERNING LAW & JURISDICTION

This Privacy Policy is governed by the laws of India. Any disputes arising from this Policy
shall be subject to the exclusive jurisdiction of the courts located in [Ghaziabad/Uttar

Pradesh].

For international users, local data protection laws may provide additional rights and
protections, which will be honored in accordance with applicable legal requirements.

ACKNOWLEDGMENT

By using Option Pay India services, you acknowledge that:

1. You have read and understood this Privacy Policy
2. You consent to the collection and processing of your data as described

3. You understand your rights and how to exercise them
4. You agree to our international data transfer practices with appropriate

safeguards
5. You provide explicit consent for biometric data processing where applicable

For any questions about this Privacy Policy or our privacy practices, please contact us
using the information provided in Section 13.

Policy : 2.0
Effective Date: 16th September 2025

Next Review Date: 22nd December 2025

Visit www.optionpay.in/privacy-policy for the most current version of this Privacy
Policy.

© 2025 Option Pay India. All rights reserved.