1. Introduction
DHANSETU TECHNOLOGIES PRIVATE LIMITED (“Dhansetu”, “Oakpay”, “we”, “us” or “our”), which owns and operates the Oakpay brand, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, store and protect your personal data when you use the Oakpay website, mobile application, customer panel and related services (the “Platform”).
This Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”), as applicable. For the purposes of the DPDP Act, we act as a Data Fiduciary for the personal data we process about you.
By using the Platform or providing your personal data, you consent to the processing described in this Policy.
2. Personal data we collect
a) Information you provide
- Identity and contact details: name, mobile number, email address, date of birth, gender and address.
- KYC information: PAN, Aadhaar (masked or as permitted by law) or other officially valid documents, photographs or selfies, and verification results.
- Financial information: beneficiary bank account details, IFSC, and payment instrument details required to complete a Transaction (card and UPI credentials are handled by authorised payment partners; we do not store your card PIN, CVV or UPI PIN).
- Service information: mobile numbers, DTH subscriber IDs, biller consumer numbers, traveller details and other inputs needed to process your request.
- Communications: messages, support requests, feedback and call records.
b) Information collected automatically
- Transaction data: amount, date, time, status, reference numbers and Service Provider details.
- Device and usage data: IP address, device identifiers, operating system, browser type, app version, log data and pages or features used.
- Location data: approximate location derived from IP address, and precise location only if you grant permission, for fraud prevention and compliance.
c) Information from third parties
- Verification results from KYC and identity verification agencies, Transaction status from banks, operators and billers, and fraud-risk signals from our partners, as permitted by law.
3. How we use your personal data
- To create and manage your Account and verify your identity (KYC).
- To process Transactions, recharges, bill payments, money transfers and bookings, and to send receipts and status updates.
- To provide customer support, resolve complaints and handle refunds.
- To detect, prevent and investigate fraud, unauthorised access, money laundering and other unlawful activity.
- To comply with legal and regulatory obligations, including those under RBI directions, the Prevention of Money Laundering Act, 2002 and tax laws, and to respond to lawful requests from authorities.
- To maintain, secure, analyse and improve the Platform and develop new features.
- To send you service, security and, with your consent, promotional communications.
4. Consent and legitimate uses
We process your personal data on the basis of your consent, which you give when you register or use a Service, and for legitimate uses permitted under the DPDP Act, such as complying with law, responding to legal obligations, and fulfilling a request you have voluntarily made.
You may withdraw your consent at any time by contacting our Grievance Officer. Withdrawal does not affect processing already carried out, and we may be unable to continue providing some or all Services. Data that we are legally required to retain will continue to be retained for the required period.
5. How we share personal data
We do not sell your personal data. We share it only as needed, with:
- Service Providers: banks, payment system participants, wallet issuers, telecom and DTH operators, billers and travel operators, to complete your Transactions.
- Verification partners: KYC, identity and fraud-prevention agencies.
- Technology vendors: cloud hosting, SMS/email/notification providers, analytics and customer-support tools, bound by confidentiality and data-protection obligations.
- Professional advisers: auditors, legal and tax advisers.
- Authorities: regulators, law enforcement, courts and government bodies, where required by law or to protect rights, safety and property.
- Corporate transactions: a successor entity in the event of a merger, acquisition or restructuring, subject to this Policy.
6. Data security
We implement reasonable security practices and procedures, including encryption of data in transit using TLS, access controls on a need-to-know basis, OTP-based authentication, logging and monitoring, and periodic security reviews. Our vendors are required to maintain appropriate safeguards.
No system is completely secure. You can help protect your Account by keeping your password, PIN and OTPs confidential and by logging out on shared devices. In the event of a personal data breach, we will notify affected users and authorities as required by law.
7. Data retention
We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by applicable law. KYC and Transaction records are retained for the periods prescribed under applicable laws and regulatory directions (for example, record-keeping obligations under the Prevention of Money Laundering Act, 2002), even after your Account is closed. Thereafter, data is deleted or anonymised.
8. Data storage and location
Your data is stored on secure servers. Payment-related data is stored in India in accordance with RBI directions on storage of payment system data. Any transfer of personal data outside India will be made only as permitted under the DPDP Act and other applicable law.
9. Your rights
Subject to applicable law, you have the right to:
- Access a summary of your personal data and the processing activities carried out on it;
- Correct, complete or update inaccurate or incomplete personal data;
- Erase personal data that is no longer necessary, unless retention is required by law;
- Withdraw consent for processing based on consent;
- Nominate another person to exercise your rights in the event of your death or incapacity;
- Grievance redressal through our Grievance Officer, and if unresolved, approach the Data Protection Board of India.
To exercise these rights, contact our Grievance Officer (Section 13). We may need to verify your identity before acting on a request.
10. Cookies and similar technologies
We use cookies and similar technologies to keep you signed in, remember preferences, secure the Platform and understand how it is used. You can control cookies through your browser settings; disabling some cookies may affect functionality.
11. Children
The Platform is not intended for persons under 18 years of age. We do not knowingly create Accounts for or collect personal data from children. If we learn that we have collected such data without verifiable parental consent as required by law, we will delete it.
12. Third-party links
The Platform may link to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.
13. Grievance Officer
In accordance with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, the details of our Grievance Officer are:
We will acknowledge your grievance promptly and endeavour to resolve it within the timelines prescribed under applicable law.
14. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices or the law. The updated Policy will be posted on this page with a revised “Last updated” date, and material changes will be notified through the Platform.
15. Contact us
For any questions about this Policy or our data practices, please contact:
Email: info@dhansetus.com · Phone: +91-86978 89788