PRIVACY POLICY
Erupaiya (A Brand of Innoplix IT Private Limited)
Created on: 05-06-2026
1. INTRODUCTION
This Privacy Policy (“Policy”) is issued by Innoplix IT Private Limited, operating under the brand name Erupaiya (“Company”, “We”, “Us”, “Our”), and governs the collection, use, processing, storage, disclosure, and protection of Personal Data in connection with the Company’s B2B financial and payment facilitation services.
This Policy is in compliance with applicable Indian laws, including but not limited to the Digital Personal Data Protection Act, 2023 (“DPDP Act”), rules, and regulations made thereunder.
By accessing, registering, or using our services, you (“User”, “You”, "Data Principal”) consent to the practices described in this Policy.
2. SCOPE OF POLICY
This Policy applies to all Personal Data processed by the Company in relation to the following services:
B2B Services
- Micro POS (MPOS)
- Micro ATM (MATM)
- Bharat Bill Payment System (BBPS) – Utility Payments
3. DEFINITIONS
- “Personal Data”: Any data about an individual who is identifiable by or in relation to such data.
- “Processing”: Includes collection, storage, use, sharing, disclosure, or erasure.
- “Data Principal”: The individual to whom the Personal Data relates.
- “Data Fiduciary”: The Company determining the purpose and means of processing Personal Data.
- “Consent Manager”: A registered entity enabling consent management (if applicable).
4. DATA WE COLLECT
We collect only such data as is necessary for lawful purposes, in compliance with Section 4 (Grounds for Processing Personal Data) and Section 6 (Consent) of the DPDP Act.
4.1 Personal Identification Data
- Name, mobile number, email address
- Government IDs (Aadhaar, PAN, etc., where applicable)
- Address and business details
4.2 Financial & Transactional Data
- Bank account details
- Transaction records
- Payment details
4.3 Technical Data
- IP address
- Device information
- Log data
4.4 KYC and Compliance Data
- Documents required for regulatory compliance
- Verification details
5. PURPOSE OF PROCESSING
In accordance with Section 4 and Section 7 (Legitimate Uses) of the DPDP Act, we process Personal Data for:
- Providing and facilitating financial services
- Identity verification and KYC compliance
- Processing transactions
- Fraud detection and prevention
- Regulatory compliance (RBI, UIDAI, NPCI guidelines)
- Customer support and grievance handling
- Business analytics and service improvement
6. CONSENT MECHANISM
As required under Section 6 of the DPDP Act:
- Consent shall be free, specific, informed, unconditional, and unambiguous.
- Users may withdraw consent at any time.
- Withdrawal of consent shall not affect processing already undertaken.
- Certain services may become unavailable upon withdrawal of consent.
7. LEGITIMATE USES
As per Section 7 of the DPDP Act, Personal Data may be processed without explicit consent for:
- Compliance with legal obligations
- Prevention and detection of fraud
- Enforcement of legal rights
- Responding to government or judicial requests
8. DATA SHARING AND DISCLOSURE
We may share Personal Data strictly on a need-to-know basis:
8.1 With Service Providers
- Banks, payment networks (NPCI, BBPS operators)
- KYC verification agencies
- Technology vendors
8.2 With Government Authorities
- As required under law or regulatory mandates
8.3 With Business Partners
- Only where necessary for service delivery
8.4 Cross-Border Transfers
Personal Data may be transferred outside India only in compliance with Section 16 of the DPDP Act and applicable government notifications.
8.5 Role as Intermediary / Facilitator
The Company operates strictly as a technology platform and intermediary facilitator enabling access to financial and payment services offered by regulated entities, including but not limited to banks, payment system operators, and networks such as NPCI.
The Company:
- Does not act as a bank, financial institution, or payment system operator;
- Does not independently control, determine, or assume responsibility for the underlying financial services or their end-use;
- Processes Personal Data solely for the limited purpose of facilitating transactions, authentication, and regulatory compliance;
- Relies on regulated entities for execution, settlement, and authorization of transactions.
9. DATA RETENTION
In accordance with Section 8(7) of the DPDP Act:
- Personal Data shall be retained only as long as necessary
- Data will be erased upon withdrawal of consent unless retention is required by law
- Financial transaction data may be retained as per RBI guidelines
10. DATA SECURITY MEASURES
As mandated under Section 8(5) of the DPDP Act, we implement:
- Encryption and secure storage
- Access control mechanisms
- Regular audits and monitoring
- Incident response protocols
11. DATA PRINCIPAL RIGHTS
Under Chapter III of the DPDP Act, users have the following rights:
11.1 Right to Access Information
Obtain details of processing activities
11.2 Right to Correction and Erasure
Request correction or deletion of inaccurate data
11.3 Right to Grievance Redressal
File complaints regarding misuse of data
11.4 Right to Nominate
Nominate a person to exercise rights in case of incapacity
12. USER OBLIGATIONS
As per Section 15 of the DPDP Act, users shall:
- Provide authentic information
- Not impersonate another individual
- Comply with applicable laws
13. GRIEVANCE REDRESSAL
In compliance with Section 13 of the DPDP Act, the Company appoints a Grievance Officer.
Contact Details:
- Email: [email protected]
- Address: 2nd, office no2, Mahesh Plaza, Mumbai Bangalore highway, Lodha hospital, Above KTM Showroom, Warje Malwadi, Pune, Maharashtra, 411058.
14. CHILDREN’S DATA
- We do not knowingly collect data of minors (below 18 years)
- If such data is collected, it shall be processed in compliance with Section 9 of the DPDP Act
15. COOKIES AND TRACKING
We may use cookies and similar technologies to:
- Enhance user experience
- Analyze usage patterns
- Improve services
16. THIRD-PARTY LINKS
The Company’s platform, website, or applications may contain links, integrations, or references to third-party websites, platforms, or services that are not owned, operated, or controlled by the Company. Such links are provided solely for convenience and informational purposes and do not constitute any endorsement, sponsorship, or recommendation by the Company of such third-party entities.
The Company does not exercise any control over, nor does it assume any responsibility or liability for, the privacy practices, policies, or content of such third-party websites or services. Any Personal Data collected, processed, or handled by such third parties shall be governed exclusively by their respective privacy policies and terms of use, and not by this Privacy Policy.
Users are advised to independently review and understand the privacy policies and practices of such third parties before accessing, interacting with, or providing any Personal Data to them. The Company shall not be liable, directly or indirectly, for any loss, damage, misuse of data, or other consequences arising from the use of or reliance on any third-party websites or services.
17. LIMITATION OF LIABILITY
While we implement reasonable security practices:
- We shall not be liable for unauthorized access caused by events beyond our control
- Users acknowledge inherent risks in digital transactions
18. AMENDMENTS TO POLICY
The Company reserves the right, at its sole discretion, to amend, modify, update, or replace this Privacy Policy, in whole or in part, at any time to reflect changes in legal, regulatory, operational, or business requirements, including compliance with applicable laws such as the Digital Personal Data Protection Act, 2023 and any rules or amendments issued thereunder.
Any such modifications shall become effective upon publication of the revised Policy on the Company’s website, platform, or other official communication channels, unless otherwise required by applicable law. The Company may, where required or deemed appropriate, provide reasonable notice of material changes to Users through electronic communication or platform notifications.
It is the responsibility of the User to periodically review this Privacy Policy to stay informed of any updates. Continued access to or use of the services after the publication of any changes shall constitute deemed acceptance of the revised Privacy Policy to the extent permitted under applicable law.
19. GOVERNING LAW AND JURISDICTION
This Privacy Policy shall be governed by and construed in accordance with the laws of India, including without limitation the Digital Personal Data Protection Act, 2023, and any rules, regulations, or amendments issued thereunder, as well as other applicable laws, regulations, and guidelines issued by competent authorities from time to time.
Subject to the foregoing, any dispute, controversy, or claim arising out of or in connection with this Privacy Policy, including any question regarding its existence, validity, interpretation, implementation, breach, or termination, shall be subject to the exclusive jurisdiction of the competent courts and tribunals at Pune, Maharashtra, India.
The parties hereby expressly submit to the exclusive jurisdiction of such courts and waive any objection to the exercise of such jurisdiction, including any objection based on inconvenience of forum or otherwise, to the fullest extent permitted under applicable law.
20. CONTACT INFORMATION
For any queries regarding this Policy:
Innoplix IT Private Limited (Erupaiya)
Email: [email protected]