Your privacy matters to us. This policy describes what personal data we process, why, who we share it with, how long we keep it and how you can exercise your rights under India’s Digital Personal Data Protection Act, 2023.
1. Company / Legal Entity Information
Pay2All is a brand owned and operated by PAY2ALL SERVICES PVT LTD (referred to as "Pay2All", "we", "us" or "our"). This document is published by PAY2ALL SERVICES PVT LTD under the provisions of the Information Technology Act, 2000 and the rules made thereunder (including the Information Technology (Intermediary Guidelines) Rules), and governs your use of https://pay2all.in.
Registered office: 24B, Sector 16A, Noida, UP - 201301.
2. About this policy
This policy explains how we process your digital personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025. We act as the Data Fiduciary for the personal data described below. By creating an account you give consent to the processing described here after reading our privacy notice; you can withdraw it at any time.
3. Personal data we collect and why
We collect only what we need for each purpose:
- Identity & contact — Name, mobile number, email, shop / business name. Purpose: Create and run your account, send login OTPs and service messages.
- KYC details — PAN, Aadhaar (masked), GST, address, photos you upload. Purpose: Identity verification required by law before financial services.
- Transactions & wallet — Recharges, bill payments, AEPS, money transfer, top-ups and payouts. Purpose: Provide the services, settle payments, statements and legal record-keeping.
- Device & login — IP address, device, and location at login (only if you allow it). Purpose: Keep your account secure and prevent fraud.
- Marketing (optional) — Your mobile number and email. Purpose: Offers and updates by WhatsApp, SMS or email — only if you opt in.
4. Legal basis
- Consent — given at sign-up (or when you first log in after this notice changes) by ticking the consent box. Marketing messages need a separate, optional consent.
- Legitimate uses permitted by Section 7 of the DPDP Act — for example, meeting legal obligations such as KYC and anti-money-laundering record-keeping, and responding to lawful requests from authorities.
5. Who we share it with
Payment gateways, SMS / email / WhatsApp providers, KYC and verification partners, service operators (telecom, billers, banks) and our cloud host — only what each needs to do its job. We never sell your data.
These partners act as our Data Processors under contract and may use the data only to provide their service to us. We may disclose data where required by law. We never sell your personal data.
6. Cookies and analytics
Essential cookies keep you signed in and secure and are always on. Analytics and advertising cookies (Google Analytics, Google Tag Manager, Meta Pixel) are used only if you choose “Accept all” in the cookie banner. You can change this any time with “Cookie settings” in the footer.
7. How long we keep your data
Account and transaction records are kept while your account is active and afterwards for as long as the law requires (e.g. KYC and transaction records under anti-money-laundering rules). Login and security logs are kept for 365 days. OTPs are never stored.
When a purpose is complete — or you withdraw consent or ask for erasure — we erase the data unless a law requires us to keep it. Where we must keep records (for example KYC and transaction records under anti-money-laundering rules), they are kept only for that period and not used for anything else.
8. Your rights
Under the DPDP Act you can, from Privacy & Data in your account (website or app):
- Access — get a summary of your personal data and processing, and the identities of those we shared it with (download your data any time).
- Correction and completion — fix inaccurate or incomplete data (most details can be edited directly in your profile).
- Erasure — ask us to delete your account and data we no longer need.
- Withdraw consent — as easily as you gave it; for marketing with one switch, for your account by requesting erasure. Withdrawal does not affect processing done before it.
- Nominate — name a person to exercise these rights if you die or become incapable.
- Grievance redressal — raise a complaint with our Grievance Officer.
9. Grievance Officer
Geeta Biswal · Email: geeta@pay2all.in · Phone: +918860181421.
We acknowledge requests promptly and resolve grievances within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
10. Children
Our services are meant for businesses and individuals aged 18 or above. We do not knowingly process children’s data and will delete it if we learn we have done so.
11. Security and breaches
We protect personal data with reasonable security safeguards, including encryption of sensitive fields and credentials at rest, encrypted connections, access controls, rate-limiting and audit logs. Card and bank credentials are handled by our payment gateways, not stored by us.
If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by the DPDP Act and Rules, describing what happened, its likely consequences and the steps we are taking.
12. Changes to this policy
When we change this policy materially we update the notice version below and ask you to review and accept the updated notice the next time you sign in.
13. Contact Us
For any questions, concerns or requests regarding this policy, please contact PAY2ALL SERVICES PVT LTD:
- Email: cs@pay2all.in
- Phone: +91 8448449290
- Address: 24B, Sector 16A, Noida, UP - 201301