1. Purpose and Scope
Payments Clarity recognises that responsible information handling is essential to maintaining trust with merchants, business partners, payment service providers, and website visitors.
This Data Protection Policy establishes the principles and operational approach we intend to follow when handling personal information and confidential business data in connection with our intermediary services.
It applies to information handled through our website, contact forms, business communications, merchant enquiries, provider introductions, and related business activities. This policy should be implemented alongside applicable privacy legislation, our Privacy Policy, contractual obligations, and any relevant information security procedures.
The policy describes our intended data protection practices. Actual compliance depends on the systems, controls, personnel, and procedures implemented by the company.
2. Data Protection Principles
Payments Clarity aims to handle personal information in accordance with the following principles.
- Lawful and fair processing: Information will be collected and used for lawful, specified business purposes. Where applicable law requires consent or another specific legal basis, the relevant processing will be undertaken only when the required conditions are satisfied.
- Purpose limitation: Information collected for merchant assessment or payment provider matching should not be repurposed for unrelated activities without an appropriate legal basis.
- Data minimisation: We aim to collect and share only information reasonably necessary for the relevant business purpose.
- Accuracy: We will take reasonable steps to correct inaccurate information where appropriate and practicable. Merchants are also responsible for ensuring that the information they provide is accurate and up to date.
- Confidentiality: Personal information and confidential business records should be accessible only to individuals and organisations with an authorised business need.
- Security: We aim to maintain appropriate technical and organisational safeguards against unauthorised access, disclosure, alteration, loss, or destruction of information.
- Retention limitation: Information should be retained only for as long as reasonably necessary for its intended purpose or as required by applicable law.
- Accountability: Appropriate responsibility should be assigned for managing information, responding to requests, maintaining safeguards, and addressing incidents.
3. Categories of Protected Information
Depending on the services requested, Payments Clarity may handle:
Personal information: Names and business contact details; professional roles and company affiliations; communication records; and information submitted through contact forms.
Business information: Company registration details; business models and product descriptions; transaction estimates and processing requirements; commercial proposals and provider correspondence; and business verification documents, where necessary.
Technical information: Website logs; device and browser information; security and diagnostic records; and cookie and analytics information, where applicable.
Confidential commercial information: Non-public pricing proposals; provider communications; merchant onboarding information; and business plans and operational requirements.
Information should be classified and handled according to its sensitivity and the potential consequences of unauthorised disclosure.
4. Collection and Use of Data
Information should be collected through appropriate channels and used only for authorised purposes. These purposes may include responding to merchant enquiries, evaluating payment processing requirements, facilitating provider introductions, coordinating merchant applications, maintaining business communications, improving service delivery, preventing fraud and unauthorised access, and meeting applicable contractual and legal obligations.
Where a business enquiry requires information to be shared with a prospective payment provider, the relevant information should be limited to what is reasonably necessary for the requested service.
Additional identity, ownership, financial, or compliance documents should be requested only where justified by the relevant assessment or legal requirement.
5. Access Control and Confidentiality
Access to personal information and confidential business data should be restricted according to role and business necessity.
Payments Clarity aims to implement appropriate controls, which may include individual user accounts, strong authentication practices, access restrictions based on job responsibilities, timely removal of access when it is no longer required, confidentiality commitments for relevant personnel, periodic review of access permissions, and secure handling of documents and communications.
Personnel and authorised service providers should not access, copy, disclose, or use confidential information for unauthorised purposes.
6. Secure Information Sharing
Payments Clarity may share information with payment processors, acquiring institutions, payment gateways, technology providers, or other relevant third parties where necessary for the services requested.
Before sharing information, the company should consider whether the disclosure is necessary, whether the intended recipient is appropriate, whether the information is relevant to the purpose, whether consent or another legal basis is required, whether contractual confidentiality obligations apply, and whether additional safeguards are appropriate.
Where necessary, information-sharing arrangements should establish the recipient's responsibilities, permitted uses, security expectations, retention requirements, and incident notification obligations.
Information must not be shared indiscriminately or disclosed to unrelated parties without an appropriate basis.
7. Payment Information and Sensitive Credentials
Payments Clarity's intermediary role should be reflected in its information collection practices.
We should not collect or store full payment card credentials, card security codes, online banking passwords, or payment authentication credentials through general website forms or ordinary business communications.
Where payment credentials are required for an actual payment transaction, they should be handled through the authorised payment provider's approved systems and processes.
If the company ever performs activities that bring it within the scope of payment card security standards or other payment-specific security requirements, the applicable obligations must be assessed and implemented.
Merchants should use approved secure channels for any identity, financial, or business verification documents requested during onboarding.
8. Data Storage and Retention
Personal information and business records should be stored in appropriate systems with access controls and safeguards proportionate to their sensitivity.
The company should establish retention periods for relevant information categories, taking into account the purpose for which information was collected, whether a merchant relationship remains active, contractual requirements, applicable legal or regulatory obligations, security and fraud prevention needs, and dispute
resolution and recordkeeping requirements.
When information is no longer needed, it should be securely deleted, anonymised, or otherwise disposed of where appropriate. Information subject to legal holds, contractual retention obligations, or other lawful retention requirements may need to be preserved for the applicable period.
9. Third-Party Service Providers
Payments Clarity may use external providers for hosting, email, business communications, customer relationship management, document storage, analytics, security, and related functions.
Where these providers process personal information on our behalf, we aim to establish appropriate contractual and operational safeguards. Relevant considerations may include the provider's security measures, access and confidentiality controls, permitted processing purposes, data retention and deletion arrangements, incident reporting procedures, international data transfer requirements, and ability to support applicable legal obligations.
Where a payment provider receives information to conduct its own underwriting or payment processing activities, its responsibilities may differ from those of a service provider acting on our instructions. The relationship and applicable responsibilities should be assessed according to the actual activities and contractual arrangements.
10. Data Subject Requests and Privacy Rights
Requests concerning personal information should be handled through an appropriate process. Depending on applicable law, an individual may request access to information, correction of inaccurate information, deletion where legally available, withdrawal of consent, or other applicable remedies.
Payments Clarity aims to:
1. Receive and record the request.
2. Verify the requester's identity where reasonably necessary.
3. Identify the information and processing activity involved.
4. Assess the request under applicable law.
5. Respond within the applicable legal timeframe.
6. Record the outcome and any action taken.
A request may be subject to lawful exceptions, including legal retention requirements. If information is held or processed independently by a payment provider, the individual may need to exercise relevant rights directly with that provider.
Privacy contact: hello@paymentsclarity.com
Telephone: +91 88005 03321
Requests may also be submitted through the website's Contact Us form.
11. Data Breach and Security Incident Management
A suspected data breach or security incident should be reported promptly through the company's designated internal reporting channel.
Examples include unauthorised access to business records, accidental disclosure of personal information, loss or theft of a device containing protected data, compromised employee or business accounts, malicious software affecting information systems, or unauthorised transmission of confidential documents.
Where an incident is identified, the company should:
1. Assess the nature and scope of the incident.
2. Take reasonable steps to contain the incident.
3. Secure affected systems and information.
4. Investigate the cause and likely consequences.
5. Preserve relevant evidence and records.
- 6. Determine whether notification to affected individuals, regulators, partners, or other parties is required.
7. Make required notifications within applicable statutory timeframes.
8. Implement corrective measures to reduce the likelihood of recurrence.
Incident handling should be proportionate to the risk and consistent with applicable law.
12. International Data Transfers
Payment processing arrangements may involve providers operating across different jurisdictions. Before transferring personal information internationally, Payments Clarity should assess the applicable legal requirements, contractual obligations, and any restrictions imposed by relevant authorities.
Where necessary, appropriate contractual, technical, or organisational safeguards should be implemented. International transfers must not be assumed to be permissible merely because a third-party provider is willing to receive the information.
13. Cookies and Website Security
Website cookies, analytics tools, and similar technologies should be used for defined purposes and configured appropriately. Where required, consent should be obtained before non-essential technologies are activated.
The company should also maintain reasonable website security measures, including appropriate software updates, access controls, monitoring, and protection against unauthorised access.
The specific controls should reflect the website's architecture, hosting environment, third-party integrations, and the types of information collected.
14. Employee and Contractor Responsibilities
Employees, contractors, and other authorised personnel who handle protected information should:
- Access information only for legitimate business purposes.
- Keep credentials confidential.
- Use approved systems and channels.
- Avoid storing business data in unauthorised locations.
- Verify recipients before transmitting confidential information.
- Report suspected security incidents promptly.
- Follow applicable retention and deletion procedures.
- Respect confidentiality obligations after their engagement ends.
The company should provide appropriate instructions and awareness training to individuals whose responsibilities involve personal or confidential information.
15. Compliance With Applicable Law
Payments Clarity aims to comply with the data protection and privacy requirements applicable to its actual activities. Depending on the nature of the business, the information handled, and the jurisdictions involved, relevant requirements may include India's Digital Personal Data Protection Act, 2023, the applicable DPDP Rules, 2025, and other privacy or data protection laws.
Applicable obligations must be assessed according to their scope, the company's role in processing, and the relevant commencement dates.
This policy does not by itself establish legal compliance or replace the need for operational procedures, appropriate contracts, and legal review.
16. Policy Review and Updates
This policy should be reviewed periodically and whenever material changes occur in the company's business model, information collection or sharing practices, technology systems, third-party provider arrangements, applicable legal requirements, or identified security risks.
Updates should be documented and communicated to relevant personnel where necessary.
17. Contact Information
For questions, concerns, or requests relating to this Data Protection Policy, contact:
Payments Clarity
Email: hello@paymentsclarity.com
Phone: +91 88005 03321
You may also use the Contact Us form on our website. Please avoid including passwords, full payment card credentials, or unnecessary sensitive information in your enquiry.
Payments Clarity aims to maintain responsible information-handling practices that support merchant confidentiality, appropriate provider matching, and the secure operation of its business.
Questions? Contact hello@paymentsclarity.com or call +91 88005 03321.
