PRIVACY POLICY
This Privacy Policy explains what personal data we collect when you use the Platform, how we use it, and the choices you have. It is to be read together with the Terms and Conditions.
1.Applicability and Status as Data Fiduciary
This Privacy Policy applies to all personal data collected by ePayhub through the website, mobile application, customer support channels, and any offline KYC process conducted in connection with the Platform. This Policy is incorporated within, and is to be read together with, the ePayhub Terms and Conditions.
For the purposes of the DPDP Act, FlexyPay Technologies Private Limited is the "Data Fiduciary" in respect of personal data processed through the Platform, and the User is the "Data Principal". Contact details of ePayhub's Data Protection Officer/grievance contact are set out at Clause 20 and Annexure 1.
This Policy does not apply to information provided to, or collected by, an independent third party (such as a Biller, a Payee, a bank, or a social network) with whom the User interacts in connection with the Services; ePayhub encourages Users to separately review such third parties' own privacy practices.
2.Personal Data Collected
Identity and contact information: name, mobile number, email, address, date of birth.
KYC documents: PAN, Aadhaar or other government-recognised identifier (collected and used solely for identity verification as permitted by Applicable Law), photograph, and signature.
Financial and transaction data: Biller/Payee details, bank account/UPI VPA, amount, payment method, timestamps, and tokenised payment credentials ePayhub does not store full card numbers or CVV in a manner inconsistent with RBI's tokenisation and data-storage norms.
Device and usage data: IP address, device identifiers (including device ID, used in fraud-prevention efforts), geolocation, browser type, internet service provider, operating system, domain name, access time, referring page, page views, and log data, collected for security, authentication, and fraud-prevention purposes.
Bill-fetch/consumer data: where the User avails an automated bill-fetch feature, the relevant Biller account/consumer number and due-amount information fetched from the Biller or the BBPS ecosystem.
Communications: records of correspondence with ePayhub's customer support and Grievance Redressal Officer, and any feedback, ratings, or survey responses the User chooses to submit.
3.SMS/Notification Data Access (Bill-Fetch Feature)
Where the User grants ePayhub permission to access SMS or notification data on their device for the purpose of the bill-fetch/auto-detection feature, ePayhub shall access and process only transactional and bill-related messages (such as biller due-amount alerts) strictly for the purposes of: (a) auto-populating bill/consumer details to assist the User; (b) verifying the authenticity of a fetched bill; and (c) fraud-prevention and payment-instruction accuracy checks. ePayhub shall not access, read, or process personal or non-financial messages unrelated to bill payment, and the User may revoke this permission at any time through their device settings, subject to the bill-fetch feature thereafter requiring manual entry.
5.Background Verification of Payees
As part of the onboarding process for a Payee under the ePayhub Tutor/Freelancer Onboarding Policy, ePayhub or a "Verifier" entity appointed or nominated by ePayhub for this purpose ("Verifier") may undertake background-verification checks of the Payee, in order to authenticate, among other things, the Payee's identity and the genuineness of the Payee's stated services. Where such a Verifier is engaged: (a) the Payee's personal information and documents (including name, gender, date of birth, address, mobile number, email, PAN, Aadhaar or other government-issued identification) may be shared with the Verifier solely for the purpose of background checks and verification; (b) the Verifier shall be contractually obligated to keep such information confidential and to store it securely; and (c) the Payee may request correction or deletion of their record on the Verifier's platform by writing to ePayhub, which shall facilitate such request with the Verifier.
6.Grounds for Processing (Consent and Legitimate Uses)
ePayhub processes personal data only on the grounds recognised under Section 4, namely consent (Section 6) or a certain legitimate use (Section 7).
6.1.Consent
Where processing is based on consent, ePayhub shall obtain the User's free, specific, informed, unconditional and unambiguous consent, through a clear affirmative act, for the specific purpose(s) set out in the notice accompanying the consent request.
The User may withdraw such consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal, by writing to the Data Protection Officer at the contact details in Clause 20. On withdrawal, ePayhub shall cease, and shall cause its Data Processors to cease, processing the User's personal data within a reasonable timeframe, except to the extent ePayhub has another lawful ground for continued processing (such as a record-retention obligation under Applicable Law). Withdrawal of consent may result in ePayhub being unable to continue providing the Services to the User.
Where applicable and once operationalised under the DPDP Rules, the User may also exercise consent-related choices through a registered Consent Manager, in accordance with Applicable Law.
6.2.Consent on Behalf of Another Individual
Where a User provides personal data of another individual (for example, a Beneficiary's bank account details, or a co-applicant's information), the User represents and warrants that they have obtained such individual's informed consent to share such data with ePayhub for the purposes described in this Privacy Policy, and shall indemnify ePayhub against any claim arising from the User's failure to obtain such consent.
6.3.Certain Legitimate Uses
In addition to consent, ePayhub may process limited personal data for a "certain legitimate use", without separate consent, including: (a) where the User has voluntarily provided personal data for a specified purpose and has not indicated non-consent to its use for that purpose; and (b) where processing is necessary for compliance with a legal obligation, including KYC/AML requirements under Applicable Law, or a judgment/order of a court or tribunal.
8.Purpose of Processing
ePayhub processes personal data for the specified purposes as described in the notice given to the User, being:
- To register, authenticate, and provide the Services to the User, and to verify the User's identity and authority to use the Services;
- To process, fetch, and settle Transactions, including sharing necessary details with payment gateways and banks;
- For customer support, and to respond to queries, complaints, and grievances;
- For internal record-keeping and audit purposes;
- For KYC/CDD and AML/sanctions compliance;
- For fraud, risk, and Transaction monitoring, including comparing information collected through the Platform with information obtained from third parties (such as Credit Information Companies) to verify its accuracy;
- To send technical notices, security alerts, and transactional communications, and (subject to opt-out under Clause 19) promotional/marketing communications regarding ePayhub's products, offers, or services that ePayhub believes may interest the User;
- To conduct internal market research and service-improvement analysis, including through aggregated or de-identified data; and
- To comply with Applicable Law and requests from regulatory or law enforcement authorities.
If ePayhub's processing practices change in respect of personal data already collected, ePayhub shall make reasonable efforts to notify affected Users and, where required under the DPDP Act, obtain fresh consent before applying such new use.
9.General Obligations of ePayhub as Data Fiduciary
Consistent with Section 8 of the DPDP Act, ePayhub shall: (a) ensure the completeness, accuracy, and consistency of personal data where such data is likely to be used to make a decision affecting the Data Principal or is to be disclosed to another Data Fiduciary; (b) implement reasonable security safeguards to prevent a personal data breach; (c) notify the Data Protection Board of India and affected Data Principals of a personal data breach ; (d) erase personal data on withdrawal of consent or on the specified purpose ceasing to be served, unless retention is required by law; (e) publish the business contact information of a Data Protection Officer/person able to answer questions on ePayhub's behalf; and (f) remain responsible for compliance in respect of any processing undertaken by a Data Processor on ePayhub's behalf, under a valid contract.
10.2.Disclosure to Protect ePayhub and Others
ePayhub may disclose personal data where it reasonably believes disclosure is necessary to: (a) comply with a legal process (such as a court order or search warrant) or other requirement of a governmental authority; (b) mitigate ePayhub's liability in an actual or potential legal proceeding; (c) enforce this Policy or the ePayhub Terms and Conditions; (d) investigate or prevent unauthorised transactions, fraud, or other illegal activity; or (e) protect the rights, property, or safety of ePayhub, its Users, or any other person.
10.3.Third-Party Service Providers and Business Partners
ePayhub contracts with various third parties for the operation of the Platform and its business, including banks, card networks, payment gateways, NPCI/BBPS ecosystem participants, Credit Information Companies, fraud-prevention/KYC utilities, and cloud/IT service providers (collectively, Data Processors engaged by ePayhub). Such Data Processors will not receive any right to use the User's personal data beyond what is necessary to perform their obligations to ePayhub, and ePayhub remains responsible for their compliance with this Policy.
10.4.Disclosure to Billers/Payees in Furtherance of a Transaction
Where a User initiates a Transaction, ePayhub will share such of the User's personal data with the relevant Biller/Payee as is necessary to complete that Transaction (for example, the User's name, consumer/account number, and payment confirmation). Users should exercise care in providing information intended for a specific Biller/Payee, and should not expect ePayhub to control how that Biller/Payee subsequently uses such information, which is instead governed by that party's own privacy practices.
10.5.Business Transfer, Merger, or Insolvency
In the event that ePayhub undergoes a change in control, including a merger, acquisition, or sale of all or substantially all of its assets relating to the Platform, or a corporate reorganisation (a "Successor"), ePayhub may transfer personal data collected from Users to such Successor, subject to the Successor continuing to be bound by this Policy (or a substantially similar privacy policy) in respect of such data. In the event of ePayhub's insolvency, bankruptcy, or analogous proceeding, ePayhub's ability to control the further use of such personal data may be limited by the applicable insolvency process.
11.Cross-Border Transfer of Personal Data
Personal data shall not be transferred outside India except to countries not restricted by the Central Government under Section 16 of the DPDP Act, and subject to such conditions as may be notified from time to time. Payment system data relating to Transactions shall, in any event, continue to be stored in India in accordance with RBI's data-localisation requirements, which operate independently of, and in addition to, the DPDP Act's cross-border transfer regime.
12.Data Storage, Localisation and Retention
In accordance with RBI's data localisation requirements applicable to payment system data, all payment system data relating to Transactions is stored only in India.
Personal data is retained only for so long as necessary to fulfil the purpose of collection, after which ePayhub shall erase such personal data, save where continued retention is mandated by Applicable Law including the minimum 5 (five) year record-retention requirement under Section 12 of the Prevention of Money Laundering Act, 2002 or is necessary for the establishment, exercise, or defence of a legal claim.
Where a User's account is closed, ePayhub retains data associated with that account, notwithstanding closure, to the extent necessary to: comply with Applicable Law; prevent fraud; collect any fees owed; resolve disputes; investigate suspected misuse; and enforce the ePayhub Terms and Conditions such retention being consistent with the "compliance with law" exception under Section 8(7) of the DPDP Act.
13.Rights and Duties of Data Principals
Subject to the DPDP Act, a User (Data Principal) has the right to:
- Obtain a summary of personal data, the identities of Data Fiduciaries/Data Processors with whom it has been shared, and the categories of data shared;
- Seek correction, completion, updating, or erasure of personal data no longer necessary for the purpose of collection ordinarily self-serviceable by the User through the "Edit Profile"/account-settings section of the Platform, and otherwise by written request to the Data Protection Officer;
- Grievance redressal in respect of any act or omission of ePayhub regarding processing of personal data, exercisable prior to approaching the Data Protection Board of India;
- Nominate another individual to exercise these rights in the event of death or incapacity, in the manner as may be prescribed; and
- Withdraw consent at any time, as described in Clause 6.2 above.
Data Principals also have corresponding duties under Section 15 of the DPDP Act, including not to impersonate another person while providing personal data, not to suppress material information, and not to register a false or frivolous complaint with ePayhub or the Data Protection Board.
ePayhub shall respond to a request made under this Clause within a reasonable timeframe and, in any event, within the timelines prescribed under the DPDP Act and rules made thereunder. Requests may be made through the Platform's designated privacy request channel or by writing to the Data Protection Officer at the contact details set out in Clause 20 and Annexure 1.
14.Security Safeguards and Account Protection
ePayhub implements reasonable technical and organisational measures, including encryption, tokenisation of payment credentials, access controls, and periodic security audits, consistent with the RBI's Cyber Resilience and Digital Payment Security Directions and applicable PCI-DSS/PA-DSS standards, to protect personal data against unauthorised access, use, or disclosure. No method of transmission or storage over the internet is entirely secure, and ePayhub does not promise, and cannot guarantee, that personal data or private communications will never be accessed or used by an unauthorised third party.
The User's login credentials, password, and any OTP are the key to the User's account. The User must not disclose these to any other person, and is solely responsible for all activity conducted through the User's account, whether or not authorised by the User, save to the extent such activity is directly attributable to ePayhub's own breach of its security obligations. If the User suspects that their credentials or account have been compromised, the User must notify ePayhub immediately through the channels set out in Clause 20.
15.Links to External Websites
The Platform may contain links to third-party websites or resources (for example, a Biller's own payment portal or website) over which ePayhub has no control. Such links do not constitute an endorsement by ePayhub of the linked website. ePayhub is not responsible for the content, privacy practices, or security of any external website, and any information the User provides on such a website is governed by that website's own privacy policy, not by this Policy.
16.User-Generated Content
If the Platform allows Users to post comments, ratings, reviews, or other content that is visible to other Users or the public, any personal data the User includes in such a posting will be available to those who can view it, and ePayhub cannot control, and is not responsible for, subsequent use of such publicly posted information by other Users or third parties.
17.Promotional Communications and Opt-Out
Subject to the User's consent where required under Applicable Law, ePayhub may send the User promotional or informational communications regarding ePayhub's products, offers, or services, via email, SMS, WhatsApp, or push notification. The User may opt out of such promotional communications at any time by following the opt-out/unsubscribe instructions contained in the relevant communication, through the Platform's notification-preference settings, or by writing to support@flexypay.in; ePayhub shall process such opt-out requests within a reasonable period, ordinarily not exceeding 10 (ten) business days. Opting out of promotional communications does not affect ePayhub's ability to send transactional communications relating to the User's account or Transactions, which are necessary for the operation of the Services.
18.Children's Data
The Platform is not intended for use by individuals below 18 years of age, and ePayhub does not knowingly collect personal data of children as Users. Where a Buyer avails a tuition-fee payment Service on behalf of a minor (the student), only such minimal information about the minor as is strictly necessary to identify the fee obligation shall be collected; ePayhub shall not undertake tracking, behavioural monitoring, or targeted advertising directed at any such minor, and such information shall not be used for any purpose other than facilitating that specific payment.
19.Personal Data Breach Notification
In the event of a personal data breach, ePayhub shall notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and rules made thereunder.
20.Grievance Officer / Data Protection Officer
Any query, request, or grievance regarding this Policy may be addressed to the Data Protection Officer/Grievance Officer at the contact details set out at Annexure 1. If dissatisfied with the resolution, the Data Principal may approach the Data Protection Board of India, constituted under Section 18 of the DPDP Act.
21.Exemptions and Government Use
Nothing in this Privacy Policy limits or overrides the certain exemptions available to ePayhub or to any governmental authority under the DPDP Act, including in connection with the prevention, detection, investigation, or prosecution of an offence, or a request from the Central Government or a competent authority in the interest of sovereignty, integrity, or security of India.
22.Changes to this Policy
ePayhub may update this Policy periodically to reflect changes in its practices or in Applicable Law. Where ePayhub makes a significant change to this Policy, it will endeavour to provide reasonable advance notice, such as through a prominent notice on the Platform or to the User's registered email address, and, where required under Applicable Law, will obtain the User's consent to the update. The "last updated" date on this Policy will be revised accordingly, and the User's continued use of the Platform after such notice constitutes acceptance of the updated Policy, to the extent permitted under Applicable Law.
ANNEXURE 1
DATA PROTECTION CONTACT DETAILS
Data Protection Officer / Grievance Officer (Name, Designation, Email, Address):
Name: Jahnavi Valmiki
Designation: Grievance Officer
Email: grievance@epayhub.com
Address: Flexypay Solutions Pvt Ltd, 91Springboard, LVS Arcade, Jubilee enclave, Hitec City, Hyderabad-500081
Business Contact Address for Privacy Queries: Flexypay Solutions Pvt Ltd, 91Springboard, LVS Arcade, Jubilee enclave, Hitec City, Hyderabad-500081
Response Timeline for Data Principal Requests: Within 48 hours
Grievance Redressal Timeline: Within 48 hours / Within 15 business days
