Paylite Financial Services — Privacy Notice
Alyssum Global Services Pvt Ltd· Effective: January 1, 2025· Version 3.0· ID: AEBBC352
DPDP Act 2023RBI GuidelinesIT Act 2000CustomersKYC ApplicantsPayment UsersPrivacy Policy
In plain language
Paylite collects your name, email, phone, Aadhaar, PAN and payment details to provide UPI/wallet services and comply with RBI KYC norms. You can withdraw marketing consent anytime. You have rights to access, correct and erase your data under the DPDP Act 2023.
testing dpflo
testing
Section last updated August 7, 2026
About This Notice
DPDP Act 2023 §5(1)Test-This Privacy Notice applies to Paylite Financial Services and its services including UPI payments, digital wallet, money transfers, and KYC verification. Data Fiduciary: Paylite Financial Services Registered Address: Mumbai, Maharashtra, India Grievance Officer: privacy@paylite.me This notice is effective from 1 January 2025 (Version 3.0). Reference ID: PFS-PN-2025-V3.0
Section last updated August 7, 2026
What Data We Collect
DPDP Act 2023 §5We collect the following categories of personal data: **Identity & KYC Data** - Full name, date of birth - Aadhaar number (masked after verification) - PAN card number - Government-issued ID documents **Contact Data** - Email address, mobile number, postal address, pincode **Financial Data** - Bank account details, UPI IDs, transaction history - Wallet balance and top-up history **Device & Usage Data** - IP address, device ID, app version, login timestamps - Transaction logs and payment behaviour **Consent Records** - Your consent choices, timestamps, and withdrawal history
Section last updated August 7, 2026
Why We Collect Your Data (Purposes)
DPDP Act 2023 §7We process your data for the following purposes: 1. **Account Registration & KYC** — Required by RBI/PMLA regulations. Lawful basis: legal obligation. 2. **Payment Processing** — To execute UPI transactions and wallet operations. Lawful basis: contract performance. 3. **Fraud Detection & Security** — To detect and prevent fraudulent transactions. Lawful basis: legitimate use. 4. **Regulatory Compliance** — RBI reporting, tax filings, AML obligations. Lawful basis: legal obligation. 5. **Customer Support** — To respond to queries, grievances, and DSR requests. Lawful basis: contract performance. 6. **Marketing & Offers (Optional)** — Promotional communications, personalised offers. Lawful basis: consent. You may withdraw at any time.
Section last updated August 7, 2026
Cross-Border Data Transfers
DPDP Act 2023 §16, RBI Data Localisation Circular 2018Your financial data and KYC records are stored in India (AWS Mumbai, ap-south-1 region) in compliance with RBI data localisation requirements. Fraud analytics signals may be processed by vendors with servers outside India. We ensure adequate safeguards (Standard Contractual Clauses) are in place for any such transfers, subject to Central Government approval under DPDP Act 2023 §16.
Section last updated August 7, 2026
How Long We Keep Your Data
DPDP Act 2023 §8(7), PMLA 2002| Data Type | Retention Period | Reason | |-----------|-----------------|--------| | KYC Documents | 5 years after account closure | PMLA 2002 requirement | | Transaction Records | 5 years | RBI / IT Act | | Aadhaar Reference | Deleted after verification | UIDAI mandate | | Marketing consent | Until withdrawn | DPDP Act §6 | | Login/Device Logs | 1 year | Security & fraud | Data is deleted or anonymised once the retention period expires.
Section last updated August 7, 2026
How We Protect Your Data
DPDP Act 2023 §8(5)We implement the following security measures: - **Encryption in transit**: TLS 1.3 for all API communications - **Encryption at rest**: AES-256 for stored financial and KYC data - **Access controls**: Role-based access; minimal privilege principle - **Aadhaar masking**: Full Aadhaar number never stored post-verification - **Security audits**: Annual penetration testing and vulnerability assessments - **Breach response**: Incident response plan compliant with DPDP Act §8(6)
Section last updated August 7, 2026
Your Rights Under DPDP Act 2023
DPDP Act 2023 §§6, 11-14As a Data Principal under the DPDP Act 2023, you have the following rights: 1. **Right to Access (§11)** — Request a summary of personal data we hold about you 2. **Right to Correction & Erasure (§12)** — Request correction of inaccurate data or erasure of data we no longer need 3. **Right to Grievance Redressal (§13)** — Raise a complaint; we will respond within 30 days 4. **Right to Nominate (§14)** — Nominate a person to exercise your rights in case of death or incapacity 5. **Right to Withdraw Consent (§6)** — Withdraw any consent-based processing at any time **To exercise your rights:** Email privacy@paylite.me or use the Privacy section in the Paylite app. If unsatisfied with our response, you may escalate to the Data Protection Board of India.
Section last updated August 7, 2026
Children's Privacy
DPDP Act 2023 §9Paylite services are not directed at individuals below 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us data without parental consent, please contact privacy@paylite.me and we will delete such data promptly.
Section last updated August 7, 2026
Contact & Grievance Officer
DPDP Act 2023 §13**Grievance Officer (DPDP Act §13)** Name: Privacy Team, Paylite Financial Services Email: privacy@paylite.me Response time: Within 7 days (acknowledgement), 30 days (resolution) **Registered Address** Paylite Financial Services Mumbai, Maharashtra — 400001, India **Data Protection Board Escalation** If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.
Section last updated August 7, 2026
Changes to This Notice
DPDP Act 2023 §5(3)We may update this Privacy Notice from time to time. When we make material changes, we will notify you via email and in-app notification, and obtain fresh consent where required. We will update the version number and effective date at the top of this notice. Continued use of Paylite after notification of non-material changes constitutes acceptance.
Section last updated August 7, 2026
Personal Data We Collect & Why
The table below shows exactly which data we collect, which purpose it serves, the legal basis we rely on, how long we keep it, and whether you can withdraw consent.
| # | Data | Purpose | Legal basis | Retention | Withdrawable? |
|---|---|---|---|---|---|
| 1 | Criminal record (if applicable and disclosed) | Background verification With your consent, we verify your employment history, educational qualifications, and other background details with authorised third-party verification agencies. This may include checks on publicly available records. You have the right to withdraw this consent, which may affect your candidacy. | Consent DPDP §6 | 6 months | Yes — anytime |
| 2 | Educational qualifications | Sharing your profile with prospective employer companies We share your resume and profile information with our client companies that have open roles matching your skills and experience. We disclose only the information relevant to the role. You can withdraw this consent at any time from your candidate portal. Retaining your profile in our talent pool for future roles With your permission, we keep your resume and profile in our candidate database so we can consider you for future roles that match your background. We will not use your data for any other purpose. You can withdraw this consent at any time. Background verification With your consent, we verify your employment history, educational qualifications, and other background details with authorised third-party verification agencies. This may include checks on publicly available records. You have the right to withdraw this consent, which may affect your candidacy. | Consent DPDP §6 | 1 year | Yes — anytime |
| 3 | Email address | Job alerts and relevant communications With your consent, we may send you job alerts, market insights, and relevant communications about opportunities matching your profile — via email, SMS, or WhatsApp (based on your channel preferences). You can unsubscribe at any time. | Consent DPDP §6 | 2 years | Yes — anytime |
| 4 | Employment history | Background verification With your consent, we verify your employment history, educational qualifications, and other background details with authorised third-party verification agencies. This may include checks on publicly available records. You have the right to withdraw this consent, which may affect your candidacy. | Consent DPDP §6 | 6 months | Yes — anytime |
| 5 | Identity documents | Background verification With your consent, we verify your employment history, educational qualifications, and other background details with authorised third-party verification agencies. This may include checks on publicly available records. You have the right to withdraw this consent, which may affect your candidacy. | Consent DPDP §6 | 6 months | Yes — anytime |
| 6 | Job preferences | Job alerts and relevant communications With your consent, we may send you job alerts, market insights, and relevant communications about opportunities matching your profile — via email, SMS, or WhatsApp (based on your channel preferences). You can unsubscribe at any time. | Consent DPDP §6 | 2 years | Yes — anytime |
| 7 | Job preferences and availability | Retaining your profile in our talent pool for future roles With your permission, we keep your resume and profile in our candidate database so we can consider you for future roles that match your background. We will not use your data for any other purpose. You can withdraw this consent at any time. | Consent DPDP §6 | 1 year | Yes — anytime |
| 8 | Mobile number | Job alerts and relevant communications With your consent, we may send you job alerts, market insights, and relevant communications about opportunities matching your profile — via email, SMS, or WhatsApp (based on your channel preferences). You can unsubscribe at any time. | Consent DPDP §6 | 2 years | Yes — anytime |
| 9 | Name | Job alerts and relevant communications With your consent, we may send you job alerts, market insights, and relevant communications about opportunities matching your profile — via email, SMS, or WhatsApp (based on your channel preferences). You can unsubscribe at any time. | Consent DPDP §6 | 2 years | Yes — anytime |
| 10 | Name and contact details | Sharing your profile with prospective employer companies We share your resume and profile information with our client companies that have open roles matching your skills and experience. We disclose only the information relevant to the role. You can withdraw this consent at any time from your candidate portal. Retaining your profile in our talent pool for future roles With your permission, we keep your resume and profile in our candidate database so we can consider you for future roles that match your background. We will not use your data for any other purpose. You can withdraw this consent at any time. Background verification With your consent, we verify your employment history, educational qualifications, and other background details with authorised third-party verification agencies. This may include checks on publicly available records. You have the right to withdraw this consent, which may affect your candidacy. | Consent DPDP §6 | 1 year | Yes — anytime |
| 11 | Photograph (if provided) | Sharing your profile with prospective employer companies We share your resume and profile information with our client companies that have open roles matching your skills and experience. We disclose only the information relevant to the role. You can withdraw this consent at any time from your candidate portal. | Consent DPDP §6 | 1 year | Yes — anytime |
| 12 | Reference check responses | Background verification With your consent, we verify your employment history, educational qualifications, and other background details with authorised third-party verification agencies. This may include checks on publicly available records. You have the right to withdraw this consent, which may affect your candidacy. | Consent DPDP §6 | 6 months | Yes — anytime |
| 13 | References | Sharing your profile with prospective employer companies We share your resume and profile information with our client companies that have open roles matching your skills and experience. We disclose only the information relevant to the role. You can withdraw this consent at any time from your candidate portal. | Consent DPDP §6 | 1 year | Yes — anytime |
| 14 | Resume / CV | Sharing your profile with prospective employer companies We share your resume and profile information with our client companies that have open roles matching your skills and experience. We disclose only the information relevant to the role. You can withdraw this consent at any time from your candidate portal. Retaining your profile in our talent pool for future roles With your permission, we keep your resume and profile in our candidate database so we can consider you for future roles that match your background. We will not use your data for any other purpose. You can withdraw this consent at any time. Sharing your profile with partner recruitment agencies In some cases we work with partner recruitment agencies to fill roles. With your consent, we may share your profile with these partners, who are bound by confidentiality agreements. You can withdraw this consent at any time. | Consent DPDP §6 | 1 year | Yes — anytime |
| 15 | Skills and certifications | Sharing your profile with prospective employer companies We share your resume and profile information with our client companies that have open roles matching your skills and experience. We disclose only the information relevant to the role. You can withdraw this consent at any time from your candidate portal. Retaining your profile in our talent pool for future roles With your permission, we keep your resume and profile in our candidate database so we can consider you for future roles that match your background. We will not use your data for any other purpose. You can withdraw this consent at any time. Sharing your profile with partner recruitment agencies In some cases we work with partner recruitment agencies to fill roles. With your consent, we may share your profile with these partners, who are bound by confidentiality agreements. You can withdraw this consent at any time. | Consent DPDP §6 | 1 year | Yes — anytime |
| 16 | Work experience and employment history | Sharing your profile with prospective employer companies We share your resume and profile information with our client companies that have open roles matching your skills and experience. We disclose only the information relevant to the role. You can withdraw this consent at any time from your candidate portal. Retaining your profile in our talent pool for future roles With your permission, we keep your resume and profile in our candidate database so we can consider you for future roles that match your background. We will not use your data for any other purpose. You can withdraw this consent at any time. Sharing your profile with partner recruitment agencies In some cases we work with partner recruitment agencies to fill roles. With your consent, we may share your profile with these partners, who are bound by confidentiality agreements. You can withdraw this consent at any time. | Consent DPDP §6 | 1 year | Yes — anytime |
| 17 | aadhaar | adhar card adhar card consent | Consent DPDP §6 | 10 days | Yes — anytime |
| 18 | bank account | testing testing KYC Data Processing testing on the paylite | Consent DPDP §6 Public Interest DPDP §7(c) | 1 month | Yes — anytime |
| 19 | biometric | Biometric Login (Face / Fingerprint) Faster login using your phone's face-unlock or fingerprint sensor | Consent DPDP §6 | 2 months | Yes — anytime |
| 20 | browser data | Paylite — Cookie Analytics Track anonymous usage analytics on paylite.me to improve the product. | Consent DPDP §6 | 1 year | Yes — anytime |
| 21 | credit card | credit-card testing | Legal Obligation DPDP §3(b) | 1 month | No — required by law |
| 22 | marketing emails for marketing marketing emails-2 fir local website testuing Sales Promotion for paylite | Consent DPDP §6 Legitimate Interest DPDP §7(d) Contract Performance DPDP §7(b) | 3 years | No — terminates service | |
| 23 | financial | Sales Promotion for paylite | Legitimate Interest DPDP §7(d) | 1 year | Yes — object via Grievance Officer |
| 24 | fraud | Fraud Detection & Security We profile your device and approximate city to detect logins from someone pretending to be you. | Legitimate Interest DPDP §7(d) | 1 year | Yes — object via Grievance Officer |
| 25 | health | Health health for testing | Consent DPDP §6 | 27 days | Yes — anytime |
| 26 | ip address | KYC Data Processing testing on the paylite Paylite — Cookie Analytics Track anonymous usage analytics on paylite.me to improve the product. | Public Interest DPDP §7(c) Consent DPDP §6 | 1 year | Yes — anytime |
| 27 | location | location acces for the loaction Sales Promotion for paylite | Consent DPDP §6 Legitimate Interest DPDP §7(d) | 1 year | Yes — object via Grievance Officer |
| 28 | name | marketing emails-2 fir local website testuing Sales Promotion for paylite Paylite — Account Registration & Login Collect and process name, email, phone and password to create and authenticate Paylite user accounts. | Consent DPDP §6 Legitimate Interest DPDP §7(d) Contract Performance DPDP §7(b) | 3 years | No — terminates service |
| 29 | pan | pancard coverage the consent Health health for testing | Consent DPDP §6 | 1 month | Yes — anytime |
| 30 | passport | passport for passport | Consent DPDP §6 | 2 months | Yes — anytime |
| 31 | phone | marketing emails-2 fir local website testuing Paylite — Account Registration & Login Collect and process name, email, phone and password to create and authenticate Paylite user accounts. Paylite — Transaction Notifications Send email and SMS notifications about fund transfers and account activity. | Consent DPDP §6 Contract Performance DPDP §7(b) | 3 years | No — terminates service |
Third-party data processors
Service providers Alyssum Global Services Pvt Ltd shares data with. Each is bound by a Data Processing Agreement.
Partner Agencies
third partyamazon we services
testing
third party· 🌐 india· consentaws-2
for testing
internal· legitimate interest
Grievance Officer
DPDP §13 — for any concerns about how your personal data is handled.
File a grievance →Data Protection Officer
DPDP §10 — for compliance escalations.
Acknowledge this notice
Confirm that you've read and understood this privacy notice. We log the timestamp + your email + IP against version 3.0 as proof of acknowledgment.
Your Rights
You can submit a rights request regarding your personal data.
Powered by DataCrux