Privacy Policy (DPDP 2023)

1. Introduction

Welcome to Webfino Solutions Pvt. Ltd. ("Webfino", "we", "our", or "us"). We are a digital financial technology company providing services such as payment gateway integrations, UPI payment solutions, API-based merchant collections, and lending support infrastructure for regulated entities and partners.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you use our website, mobile application, APIs, and partner platforms (collectively, the "Services").

We are committed to safeguarding your privacy and complying with the Digital Personal Data Protection Act, 2023 (DPDP Act), Reserve Bank of India (RBI) guidelines for digital lending and payments, and other applicable data protection regulations.

2. Definitions

• "Personal Data" refers to any data about an individual who is identifiable by or in relation to such data.
• "Data Principal" means the individual to whom the personal data relates.
• "Data Fiduciary" means Webfino Solutions Pvt. Ltd., which determines the purpose and means of processing personal data.
• "Processing" means the collection, storage, use, disclosure, and sharing of personal data.
• "Cookies" are small files stored on your device that help us analyze website usage.
• "Third-Party Services" refer to external platforms, APIs, or integrations (such as banks, NBFCs, UPI partners, or analytics tools) that assist in delivering our services.

3. Categories of Data Collected

We collect and process the following categories of personal and non-personal data:

• A. Basic Information: Name, email address, mobile number, business name, designation (for partners).
• B. KYC & Identity Data: PAN number, masked Aadhaar number, address proof, or business registration documents.
• C. Financial Data: Bank account details, UPI ID or VPA, payment transaction history, and credit or lending information (if applicable through NBFC partners).
• D. Device & Network Data: IP address, operating system, browser type, device identifiers, and app usage logs.
• E. Behavioural & Analytical Data: Website or app activity, clickstream data, preferences, and feedback.
• F. Third-Party Data: Data received from regulated entities such as banks, NBFCs, or credit bureaus, where applicable, for the purpose of credit or loan support.

4. Methods of Data Collection

We collect data through the following means:

• User Registration & Onboarding Forms
• Payment and Transaction Processing
• KYC Verification APIs (RBI/NPCI regulated)
• Cookies, SDKs, and Trackers on our website or app
• Third-party integrations such as payment gateways or NBFC partners
• Customer Support Channels (calls, WhatsApp, email)

5. Purpose of Processing

Your data is collected and processed for the following lawful purposes:

• To enable payment processing and UPI/PG integrations
• To verify your identity and perform KYC as per RBI/NPCI norms
• To process and record transactions securely
• To detect, prevent, and investigate fraud or unauthorized use
• To analyze performance and improve user experience
• To comply with applicable laws, RBI and NPCI regulations
• To offer marketing, promotions, or updates with your consent

6. Legal Basis & Consent

We process your Personal Data only after obtaining explicit consent as required under the DPDP Act 2023.

You may withdraw your consent at any time by writing to us at support@webfino.com, subject to legal and contractual obligations. Processing for regulatory, fraud prevention, or compliance purposes may continue without consent, as permitted by law.

7. Data Storage and Security

• All data is protected using industry-grade encryption (AES-256) in transit and at rest.
• Access is restricted through role-based access control and continuous monitoring.
• Our servers are hosted on secure cloud environments located in compliance with Indian data localization norms.
• We maintain regular backups and a disaster recovery plan to ensure business continuity.
• Data is retained only as long as necessary for the purpose collected or as mandated by law.

8. Data Sharing and Disclosure

We may share limited data with trusted and compliant third parties under confidentiality and data processing agreements:

We do not sell or rent personal data to any third party.

9. User Rights Under the DPDP Act 2023

As a Data Principal, you have the following rights:

• Right to Access: Request details of personal data processed by Webfino.
• Right to Correction: Request correction or updates to inaccurate data.
• Right to Erasure: Request deletion of your personal data, where legally permissible.
• Right to Withdraw Consent: Withdraw consent for processing.
• Right to Grievance Redressal: File a complaint regarding data processing.
• Right to Nominate: Nominate another person to exercise your rights in case of incapacity.

Requests may be made via email to our Grievance Officer listed below.

10. Cookies and Tracking Technologies

We use cookies and analytical tools to improve functionality and measure performance. You can modify your browser settings to block or delete cookies, although this may affect website usability.

11. International Data Transfers

If personal data is transferred outside India, it will be done in accordance with applicable data protection laws and only to entities that ensure comparable levels of data protection.

12. Grievance Redressal

If you have any questions, concerns, or complaints regarding this Privacy Policy or data processing, please contact our Grievance Officer:

13. Policy Updates

We may update this Privacy Policy periodically to reflect regulatory changes or improvements to our processes. The latest version will always be available on our website with the updated effective date.

14. Contact Us

For privacy or compliance-related queries, write to us at:

Email: support@webfino.com | Web: https://www.webfino.com