Privacy Policy.

Your trust matters to us, especially when your business and payment information is involved. This Privacy Policy explains, in straightforward terms, what personal data DIGIWAY PAYMENT PRIVATE LIMITED (“Digiway”, “we”, “us” or “our”) collects, why we use it, when we share it and the choices available to you.

This Policy applies when you visit digiwaypayment.com, contact our team, submit an onboarding request, access our dashboard, use our APIs or use any product or service that links to this Policy. Some payment and banking services are delivered by third-party banks, payment aggregators, payment gateways, bill-payment providers or other service partners. Their privacy notices may also apply when they independently collect or process your data.

DIGIWAY PAYMENT PRIVATE LIMITED is a company incorporated in India.

Digiway provides technology, onboarding support and access to business payment, collection, payout, reconciliation, bill-payment and related financial-technology solutions, including services made available through contracted third-party partners.

The information we collect depends on how you interact with us.

Information you provide

We may collect:

• your name, job title, business name and contact details;
• account registration details and login credentials;
• business registration, tax, bank-account and merchant-onboarding information;
• identity and verification information relating to proprietors, directors, authorised signatories, beneficial owners or representatives;
• transaction-related information, such as payment reference, amount, status, time, payer or beneficiary details and settlement or reconciliation records;
• support requests, complaints, call records, emails and other correspondence;
• preferences, consent records and responses submitted through forms; and
• any other information you choose to give us.

Information collected automatically

When you use our website or platform, we may collect:

• IP address, device type, browser, operating system and language;
• login time, pages viewed, referring URL and interaction data;
• device or session identifiers and cookie data;
• API requests, system events, audit trails and security logs; and
• approximate location derived from an IP address.

Information received from other sources

We may receive information from your organisation, merchants, customers, banks, payment partners, verification providers, fraud-prevention services, publicly available records and other service providers where permitted by law.

We use personal data only for defined business and legal purposes, including to:

• respond to enquiries and provide requested information;
• create, administer and secure business accounts;
• assess applications and coordinate onboarding with relevant service partners;
• verify identity, business ownership and eligibility;
• enable collections, payouts, settlements, reconciliation, billing and support;
• send transaction, operational, security and service communications;
• prevent fraud, misuse, unauthorised access and financial crime;
• investigate incidents, disputes, complaints and failed transactions;
• maintain records, audit trails and service performance;
• improve our website, dashboard, APIs, products and customer experience;
• comply with contracts, court orders and applicable legal or regulatory requirements; and
• send marketing communications where you have consented or where otherwise permitted by law.

We process personal data for lawful purposes, including where processing is necessary to provide a service you requested, perform a contract, meet a legal obligation, protect against fraud or security threats, address a legitimate business need recognised by applicable law, or act on your consent.

Where consent is required, we aim to make the request clear and specific. You may withdraw consent through the same channel in which it was provided, through available account controls, or by contacting us. Withdrawal will not affect processing already carried out lawfully. It may, however, prevent us from providing a feature that depends on that information.

Payments may be processed on checkout pages, applications or infrastructure operated by contracted payment partners. Depending on the integration, Digiway may receive transaction references, payment status, amount, method category, timestamps and reconciliation information. We do not intend to receive or store CVV, card PIN, UPI PIN or OTP.

Card and bank-account information may be handled directly by the relevant bank, payment aggregator, payment gateway, card network or other payment service provider under its own terms and privacy practices. Merchants should review the final technical data flow for their chosen integration.

We may share relevant information with:

• banks, payment aggregators, payment gateways, payment networks, bill-payment providers and other partners needed to evaluate or deliver a requested service;
• identity-verification, KYC, fraud-prevention, risk and compliance providers;
• cloud hosting, communications, analytics, customer-support and cybersecurity providers;
• professional advisers, auditors and insurers;
• government agencies, courts, law-enforcement authorities or regulators where disclosure is legally required; and
• a successor or acquiring entity in connection with a lawful merger, restructuring, financing or sale, subject to appropriate safeguards.

We require service providers to handle information for authorised purposes and under appropriate confidentiality and security obligations. A third party acting as an independent data fiduciary or controller is responsible for its own processing.

When a business uses Digiway to facilitate payments, payouts or reconciliation, Digiway may process limited personal data relating to that business’s customers, vendors, employees or beneficiaries. The business is responsible for providing necessary notices, obtaining required permissions and ensuring that the information submitted to Digiway is lawful and accurate.

Depending on the service and contract, Digiway may act on the business’s documented instructions or may process certain information for its own compliance, security and operational purposes.

We use essential cookies to operate and secure our website. With your choice, we may also use functional or analytics technologies to understand website performance and improve user experience. Details are available in our Cookie Policy.

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain transaction and audit records, resolve disputes, enforce agreements and meet legal, tax, accounting, anti-fraud or regulatory obligations.

Retention periods vary by record type and the requirements of the relevant service partner. When information is no longer required, we delete it, anonymise it or securely isolate it unless continued retention is required by law. Digiway applies its approved record-retention schedule and the retention requirements applicable to the relevant service and service provider.

We use administrative, technical and organisational controls designed to protect personal data against unauthorised access, alteration, disclosure, loss or misuse. Measures may include encryption in transit, access controls, logging, backups, vulnerability management, secure development practices, vendor due diligence and incident-response procedures.

No internet-based service is completely risk-free. You are responsible for protecting account credentials, using strong passwords, enabling available security features and promptly reporting suspected misuse. Read more on our Security page.

Our systems and service providers may process information in India and, where lawful and operationally necessary, in other locations. Payment-system data subject to localisation requirements is handled in accordance with the obligations applicable to the responsible regulated or authorised entity and the relevant service arrangement.

Digiway documents the hosting and support locations used for each service and applies lawful transfer and localisation controls where required.

Subject to applicable law and relevant exemptions, you may ask us to:

• confirm or summarise personal data processed about you;
• correct inaccurate or incomplete personal data;
• erase personal data that is no longer required or lawfully retained;
• withdraw consent where processing is based on consent;
• identify the available grievance-redressal channel; or
• record a nomination where this right is applicable.

To protect you, we may verify your identity and authority before completing a request. We may refuse or limit a request where the law permits or requires us to retain or continue processing the information. To submit a request, write to js@digiwaypayment.com.

Our services are designed for businesses and adults authorised to act for them. We do not knowingly offer accounts directly to children. If a service involves the personal data of a child—for example, an education-fee collection service—the relevant institution and Digiway must apply the consent and safeguarding requirements applicable to that use case.

If you believe a child has provided personal data to us without appropriate authorisation, contact js@digiwaypayment.com.

You may opt out of promotional emails using the unsubscribe link or by contacting us. We may still send essential service, transaction, security or legal messages where necessary.

Our website may link to partner or third-party websites. We do not control their content, security or privacy practices. Review the relevant third party’s privacy notice before providing information.

For a privacy question, complaint or rights request, contact:

Please include your name, contact information, relationship with Digiway, a clear description of the concern and any relevant reference number. Do not include passwords, OTPs, UPI PINs or full card details.

We may update this Policy when our services, technology or legal obligations change. The revised version will be posted on this page with a new “Last updated” date. Where a change materially affects your rights or the way we use personal data, we will provide additional notice where required.

Questions about this Privacy Policy can be sent to js@digiwaypayment.com or to our registered office at 26C, Ram Vihar, Kaimri Road, Hisar, India, 125001.