PURASKRIT MERCHANT PRIVACY POLICY

DATA COLLECTION NOTICE (As required under Section 5, Digital Personal Data Protection Act, 2023)

Asraubh Private Limited ("Puraskrit") collects business profile data, authorised representative contact details, compliance data (GSTIN), and financial account information for the purposes of operating your merchant account, processing subscription payments, and enabling the loyalty platform. By completing merchant registration and tapping "I Agree," you provide your free, specific, informed, unconditional, and unambiguous consent to this collection and use. Financial account information is treated as Sensitive Personal Data or Information (SPDI) under applicable law and is subject to stricter protections as described in Section 6 of this Policy. To exercise your rights or raise a grievance, contact: support@puraskrit.com.

1. About This Policy

This Privacy Policy governs how Asraubh Private Limited ("Puraskrit") collects, uses, stores, and protects the personal and business data of merchants registered on the Puraskrit platform. This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("IT Rules 2011"), and the IT Act, 2000.

2. Definitions

• Data Fiduciary: Asraubh Private Limited, which determines the purpose and means of processing merchant data on the Puraskrit platform.
• Data Principal: The authorised representative of the merchant whose personal data is being processed.
• SPDI (Sensitive Personal Data or Information): As defined under IT Rules 2011, includes financial account information such as bank account details, credit/debit card numbers, and billing information.
• Data Processor: A third party that processes data on behalf of Puraskrit (e.g., cloud infrastructure providers).

3. Business Data Collection

To provide Puraskrit merchant tools and services, we collect the following categories of information:

3.1 Business Profile Data

• Business name, registered address, and operational category
• Business logo and visual assets (if provided)

3.2 Authorised Representative Information

• Full name of the primary account holder
• Professional email address
• Mobile phone number

3.3 Compliance Data

• GSTIN (Goods and Services Tax Identification Number)
• Business licences or other regulatory identifiers required for verified merchant status

3.4 Financial Data (SPDI)

Bank account details and billing information are collected solely for the purpose of processing subscription fee payments and issuing tax-compliant invoices. This information constitutes Sensitive Personal Data or Information (SPDI) under IT Rules 2011 and is governed by the specific protections set out in Section 6 of this Policy.

3.5 Transaction Logs

• Metadata regarding customer interactions and reward redemptions processed through your merchant terminal (these records do not include raw customer personal data beyond account identifiers)

4. Purpose of Data Usage

Merchant data is used for the following purposes only:

• Verifying your business identity and maintaining a secure, trusted merchant ecosystem
• Processing subscription payments and providing tax-compliant invoices
• Facilitating loyalty program tracking and customer communication tools
• Providing analytics and reporting on customer engagement and milestone progress
• Communicating critical platform updates, billing notices, and security alerts

Your data will not be used for any purpose beyond those listed above without your fresh, explicit consent.

5. Data Processing Roles & Obligations

5.1 Puraskrit as Data Fiduciary

Puraskrit acts as the Data Fiduciary with respect to the personal data of merchant authorised representatives, determining the purpose and means of processing in accordance with the DPDP Act 2023.

5.2 Merchant as Data Fiduciary for Customer Data

With respect to the personal data of the customers who transact at your business, you act as the Data Fiduciary. You are responsible for ensuring that your use of customer data accessed through Puraskrit complies with applicable Indian law, including the DPDP Act 2023. Puraskrit acts as a Data Processor on your behalf for the purpose of storing and managing loyalty data.

5.3 Joint Security Responsibility

While Puraskrit secures the platform infrastructure, you are responsible for securing your merchant login credentials. Unauthorised access to customer records arising from compromised merchant credentials is your responsibility. You must notify Puraskrit immediately at support@puraskrit.com if you suspect unauthorised access to your account.

6. SPDI: Financial Data Protection

Bank account details and billing information collected for subscription processing are classified as Sensitive Personal Data or Information (SPDI) under Rule 3 of the IT Rules 2011. The following additional protections apply:

• Written Consent: Your consent to the collection and processing of SPDI is obtained through the explicit consent screen at merchant registration. You may withdraw consent for SPDI processing, subject to your ability to fulfil your subscription payment obligations.
• Access and Correction: You have the right to review and update your financial account details at any time via your merchant account settings.
• No Third-Party Disclosure: Your bank account details will not be disclosed to any third party without your consent, except to payment processing partners strictly necessary to process your subscription fees and subject to confidentiality agreements.
• Restricted Internal Access: Financial data is accessible only to authorised Puraskrit personnel on a strict need-to-know basis, protected by role-based access controls.
• Retention: Financial and billing records will be retained for up to 7 years following account termination to comply with Indian tax and corporate audit laws (as required under the Income Tax Act and Companies Act).

7. Consent Mechanism

Your consent to the collection and processing of your business and personal data is obtained through a clear, affirmative action: by tapping "I Agree" on the consent screen presented during merchant registration. This consent is free, specific, informed, unconditional, and unambiguous.

You may withdraw your consent to non-essential data processing at any time by contacting support@puraskrit.com. Withdrawal of consent for essential processing (such as GSTIN retention for compliance purposes) may affect your ability to maintain an active merchant subscription.

8. Data Storage & Cross-Border Transfers

All business and transaction data is stored on secure AWS infrastructure located in India. Puraskrit implements AES-256 encryption for all merchant data at rest and in transit.

Puraskrit does not currently transfer merchant data outside India. In the event that any third-party service provider used in platform operations (such as analytics or billing tools) processes data offshore, Puraskrit will ensure such transfers comply with DPDP Act requirements, occur only to permitted jurisdictions, and are subject to adequate contractual protections.

9. Data Retention & Deletion

• Active Accounts: Business profile and operational data is retained for the duration of your active merchant subscription.
• Post-Termination: Upon termination of your merchant account, you may request deletion of your business profile data. Transaction records, financial data (SPDI), and compliance-related data (GSTIN) may be retained for up to 7 years to comply with Indian tax and corporate audit laws.
• Deletion Requests: To request deletion of your business profile data, contact: support@puraskrit.com. Verified deletion requests will be processed within 30 days, subject to applicable legal retention obligations.

10. Security & Compliance

Puraskrit implements the following security measures to protect merchant data:

• Strict role-based access controls limiting access to authorised personnel only
• AES-256 encryption at rest and in transit
• Continuous system monitoring and intrusion detection
• Security practices aligned with ISO 27001 standards

In the event of a personal data breach affecting merchant data, Puraskrit will notify affected merchants and the Data Protection Board (once constituted) in the manner and within the timeline prescribed by the DPDP Act. Notification will describe the nature of the breach, the data affected, and the remedial steps taken.

11. Your Rights as a Data Principal

As the authorised representative (Data Principal) of your merchant business, you have the following rights under the DPDP Act 2023:

• Right to Access: Request a summary of personal data held about you and how it is processed.
• Right to Correction and Updation: Request correction of inaccurate, incomplete, or outdated data.
• Right to Erasure: Request deletion of your personal data (subject to legal retention obligations).
• Right to Data Portability: Receive your personal data in a structured, commonly used format.
• Right to Grievance Redressal: Have grievances addressed within 30 days (see Section 12).
• Right to Nominate: Nominate another individual to exercise your data rights in the event of death or incapacity.

12. Grievance Officer

In accordance with Rule 5(9) of the IT Rules 2011 and the DPDP Act 2023, Asraubh Private Limited has designated a Grievance Officer:

• Name: Krishna Kumar Pradhan
• Designation: Krishna Kumar Pradhan, Director, Asraubh Private Limited
• Email: support@puraskrit.com
• Address: Asraubh Private Limited, Bengaluru, Karnataka, India
• Response Time: Acknowledgement within 48 hours; resolution within 30 days

Unresolved grievances may be escalated to the Data Protection Board of India once constituted under the DPDP Act 2023.

13. Merchant Communications

Puraskrit will communicate with merchants regarding:

• Critical platform updates and security alerts
• Billing and subscription notifications
• Performance reports and analytics summaries
• Loyalty program optimisation tips (promotional)

You may opt out of non-essential promotional communications at any time. Critical service-related and billing alerts will remain active as long as your subscription is active.

14. Amendments

Puraskrit reserves the right to update this Privacy Policy. You will be notified of all updates via email and through the merchant portal. Material changes affecting how your personal data is processed will require fresh, explicit re-consent before taking effect.

15. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India, including the DPDP Act 2023, IT Act 2000, and IT Rules 2011. Any disputes related to merchant data privacy shall be subject to the exclusive jurisdiction of the courts in Bengaluru, India.

— End of Merchant Privacy Policy —