Privacy Policy

Overview

Corpcash (the “Platform”) is made available by Kalp Digital Infra Private Limited (the “Company”, “we”, “our”, or “us”). We are committed to protecting your privacy. This Privacy Policy explains how personal data is collected, used, shared, and safeguarded when the Platform is made available to you by the Company as part of its employee benefits, rewards, payments, reimbursement, recharge, bill payment, Gift Card, and redemption programmes and related services. This Privacy Policy applies to our website, APIs, web and mobile applications, and any related services and subdomains (collectively, the “Services”). It is intended to be read together with the Corpcash Terms and Conditions. We process personal data in accordance with applicable Indian data protection and privacy laws, including the Digital Personal Data Protection Act, 2023 and applicable rules thereunder, as amended from time to time. By using our Services, you confirm that you have read and understood this Privacy Policy and agree to the data handling practices described in this Policy, subject to Applicable Law.

Definitions

“Platform” or “Corpcash” means the digital employee benefits, rewards, payments, recharge, bill payment, redemption, and related services platform made available by the Company for use by authorized Organizations and Users.

“Company” means Kalp Digital Infra Private Limited.

“Organization” or “Client” means the company, business, institution, or other entity that has entered into an arrangement with the Company for use of the Platform and whose authorized Users access or use the Platform.

“Client Admin” means an authorized representative of an Organization who is permitted to administer the Organization’s account, Users, programmes, Points, approvals, and other Platform features made available to the Organization.

“Employee” means a current employee or other individual authorized by an Organization who is invited, registered, or otherwise permitted to access and use the Platform.

“Vendor” means a third-party service provider, contractor, merchant, or business partner approved or enabled by the Company or Organization to accept Points or participate in permitted Platform transactions and, where enabled, to request settlement of eligible amounts through a Cash-Out Request, subject to applicable approval and settlement processes.

“Point” means a unit of value recorded on the Platform and made available to eligible Employees or other authorized Users for limited programme purposes. Unless otherwise specified for a particular programme or transaction, one (1) Point represents a value of ₹1 for the applicable Platform transaction or redemption. Points are subject to the applicable programme rules, restrictions, expiry conditions, and permitted uses specified by the Company or Organization.

“Wallet” means the Platform ledger account associated with a User that records Point balances, allocations, redemptions, transactions, and related transaction history.

“Service Wallet” means a Platform ledger or wallet maintained for the administration and settlement of services or transactions facilitated through Corpcash, as applicable to the relevant Organization or Platform workflow.

“Cash-Out Request” means a request raised by a Vendor through the Platform to redeem or settle a specified eligible Point amount, where such functionality is enabled. The request may be reviewed and either approved or rejected in accordance with the applicable Platform workflow. Upon approval, the corresponding Points may be burned, deducted, or otherwise settled on the Platform and the Company may settle the corresponding amount to the Vendor outside the Platform.

“Gift Card” means a prepaid gift voucher, gift card, or voucher code that may be made available through the Platform for redemption against the goods or services of a third-party merchant or brand (“Merchant”), and that may be fulfilled through a third-party Gift Card Partner and issued or honoured by the Merchant.

“Gift Card Partner” means a third-party fulfilment, distribution, reseller, or service partner engaged by the Company to facilitate Gift Card fulfilment, including any replacement or additional partner engaged from time to time.

“Merchant” means the third-party brand or service provider that issues and honours a Gift Card for redemption of its goods or services. The Merchant determines the applicable Gift Card terms, including validity and redemption rules, and is independent of the Company. The Company does not control, endorse, or assume responsibility for the Merchant’s goods, services, or actions.

“BBPS” means the Bharat Bill Payment System or any applicable bill payment infrastructure, network, operating unit, biller, agent, technology provider, or other participant through which bill payment services may be facilitated on the Platform.

“Recharge Services” means third-party prepaid or postpaid recharge services, including mobile, DTH, or other recharge services that may be made available through the Platform.

“Bill Payment Services” means bill payment services made available through the Platform, including electricity, water, piped gas, DTH, mobile postpaid, and other bill payments or services supported through BBPS or other third-party service providers.

“Applicable Law” means applicable laws, rules, regulations, governmental directions, orders, and regulatory requirements applicable to the Company, Platform, Organization, Users, Vendors, or relevant processing activity.

Capitalized terms not defined above shall have the meanings given elsewhere in this Policy or in the Corpcash Terms and Conditions.

Scope of this Privacy Policy

This Privacy Policy applies to personal data collected and processed through the Platform and any associated mobile or web interfaces used by the Company’s authorized Organizations and Users to access and use the Platform, including to manage and view Point balances and transaction history, participate in employee benefit and reward programmes, make payments to registered Vendors through supported QR or other payment workflows, submit or process reimbursements where enabled, purchase Gift Cards through the Company’s Gift Card Partner or other fulfilment partners where enabled, and use Recharge Services and Bill Payment Services, including services facilitated through BBPS or other third-party service providers.

The Privacy Policy also applies to personal data processed when the Company or an Organization registers, onboards, approves, updates, suspends, or offboards Users, when Users authenticate using one-time passwords (“OTPs”) or other supported authentication methods, and when Users contact Platform support or raise requests, disputes, refunds, complaints, or other service-related enquiries.

The Company may process Vendor personal data as part of enabling Vendor registration, processing Vendor transactions and Cash-Out Requests where enabled, facilitating settlement by the Company, and providing support or resolving disputes relating to Vendor transactions.

Where the Platform facilitates Recharge Services or Bill Payment Services, the Company may process personal data and transaction information required to identify the relevant service provider, customer account, mobile number, subscriber number, consumer number, biller account, or other service identifier, retrieve applicable bill or recharge information, initiate and complete the transaction, provide transaction status, process refunds or reversals where applicable, reconcile transactions, provide support, and comply with applicable legal, regulatory, fraud prevention, and audit requirements.

This Privacy Policy does not apply to any websites, applications, or services that are not operated by the Company, even if accessible through links, integrations, or services available on the Platform. In particular, Gift Cards may be issued and governed by third-party Merchants and may be fulfilled through third-party Gift Card Partners. Similarly, Recharge Services and Bill Payment Services may be provided, processed, or fulfilled by third-party recharge providers, BBPS participants, billers, payment service providers, technology partners, or other service providers. Any personal data you provide directly to, or that is collected independently by, such third parties is governed by their respective privacy notices and terms, and you should review those policies before using their services.

This Privacy Policy forms part of the documentation governing your use of the Platform alongside the Corpcash Terms and Conditions. In the event of any inconsistency, the Terms govern service use and contractual rights and obligations, and this Privacy Policy governs how personal data is collected and processed, in each case subject to Applicable Law.

The Platform is intended for use by authorized Users and is not designed for use by children. You must be at least 18 years of age to use the Platform, unless the Company and the relevant Organization expressly authorize access in exceptional circumstances in accordance with Applicable Law. If you believe a minor has been onboarded or provided access without appropriate authorization, please notify the Company at care@Corpcash.in.

Identity of the Data Fiduciary

Data Fiduciary: For the purposes of the Digital Personal Data Protection Act, 2023 and applicable rules thereunder, Kalp Digital Infra Private Limited is the Data Fiduciary in respect of personal data processed by the Company where the Company determines the purposes and means of such processing, including in connection with operation and security of the Platform, user access enablement, Platform administration, Point administration, transaction processing, service delivery, support, fraud prevention, audit, and compliance.

Depending on the nature of a particular processing activity, an Organization may independently determine the purposes and means of processing personal data relating to its Employees or other Users. Where the Company processes personal data solely on behalf of an Organization and in accordance with the Organization’s documented instructions, the Company may act as a data processor or service provider to the extent recognized under Applicable Law.

Data Processors and Independent Processing: The Company may engage third-party service providers to support operation of the Platform, including technology, infrastructure, hosting, security, authentication, OTP and communication, analytics, support, payment, recharge, BBPS, Gift Card fulfilment, and other service providers. Such service providers may process personal data on behalf of the Company or relevant Organization and are subject to applicable contractual, technical, and organizational safeguards.

The Company may also process personal data for its own purposes where necessary to comply with Applicable Law, secure and protect the Platform, maintain audit and security logs, prevent fraud and misuse, investigate security incidents, enforce the Terms, provide service communications, and protect the rights, safety, property, and integrity of the Company, Organizations, Users, Vendors, and the Platform.

Personal Data We Collect

Information you provide directly:

Account and profile data: Name, Organization email address, employee or user identifier, mobile number, job title or role, Organization details, and other information necessary for registration, onboarding, verification, account management, and access to the Platform.

Vendor and settlement data: Vendor name, contact details, business information, tax or invoicing information where collected, settlement information where required, information relating to transactions and Cash-Out Requests, and other information necessary for Vendor registration, settlement, support, and compliance.

Transaction and service information: Information necessary to process transactions made through the Platform, including Point allocations and redemptions, Vendor payments, Gift Card purchases, reimbursement transactions where enabled, Recharge Services, Bill Payment Services, BBPS transactions, and related transaction references and status information.

For Recharge Services and Bill Payment Services, this may include information such as mobile number, subscriber or customer number, consumer number, biller account number, service provider or biller details, recharge amount, bill amount, transaction reference, bill or recharge status, and other information necessary to process the requested service.

Communications: Information you provide when contacting support, reporting issues, raising disputes, requesting refunds or reversals, raising requests relating to Gift Cards, Recharge Services, Bill Payment Services, BBPS transactions, reimbursements, Vendor cash-out requests, or other Platform services.

The Platform is not intended for public posting, messaging, or user-generated content hosting. Please do not input or store any unlawful information, sensitive personal data that is not required for a Platform workflow, or data that infringes third-party rights.

Information collected automatically:

Transaction data: Point balances, allocations, redemptions, payments to Vendors, Gift Card purchase details and fulfilment status, reimbursement transactions where enabled, recharge and bill payment details, BBPS transaction references and status, Cash-Out Request status and approvals where enabled, and related transaction records.

Technical data: IP address, device identifiers, browser type, operating system, application version, timestamps of Platform access, authentication events, security and audit events, and other technical information necessary to operate and secure the Platform.

Usage data: Login frequency, features used, session information, performance and error logs, diagnostic data, and other information used to improve service quality, reliability, security, and fraud prevention.

Information from third parties:

The Company may receive information from Organizations or authorized personnel to manage User access, including employment, role, authorization, and joiner–mover–leaver information.

Gift Card Partners and Merchants may share fulfilment status, delivery or redemption information, cancellation or refund information, and fraud or risk alerts with the Company for transaction processing, support, reconciliation, and fraud prevention.

Recharge providers, BBPS participants, billers, payment or service providers, and other third-party service providers may provide transaction status, confirmation, failure, reversal, refund, reconciliation, fraud or risk information, and other information necessary to process or support Recharge Services and Bill Payment Services.

How We Use Your Personal Data

Service delivery and account management: We use personal data to create, verify, approve, and manage Platform access; authenticate Users; maintain Organization, Client Admin, Employee, and Vendor accounts; maintain Point balances and transaction history; administer Wallets and Service Wallets; process payments to registered Vendors; process reimbursements where enabled; facilitate Gift Card purchases and fulfilment; process Recharge Services and Bill Payment Services, including BBPS transactions; administer Vendor Cash-Out Requests and related settlement workflows where enabled; and provide other services and benefits made available through the Platform.

Recharge and Bill Payment Services: Where you use Recharge Services or Bill Payment Services, we use relevant personal data and transaction information to identify the applicable service provider or biller, retrieve or validate bill and recharge information, initiate the requested transaction, communicate transaction status, process applicable refunds or reversals, reconcile transactions, provide support, prevent fraud and misuse, and comply with Applicable Law. Where these services are facilitated through BBPS or other third-party service providers, relevant information may be shared with the applicable participants and service providers to complete the requested transaction.

Compliance and security: We use personal data to operate the Platform securely, detect and prevent fraud, misuse, unauthorized access, and other prohibited activities, maintain audit and security logs, enforce our Terms, comply with Applicable Law including responding to lawful requests by competent authorities, investigate security incidents, resolve disputes, and protect the rights, safety, property, and integrity of the Company, Organizations, Users, Vendors, and the Platform.

Communications and support: We use personal data to send service and transaction communications, including OTPs, account and registration communications, payment confirmations, Point-related notifications, Gift Card codes or links, recharge confirmations, bill payment confirmations, transaction status updates, reimbursement updates, Vendor settlement notifications, security alerts, policy updates, service changes, and support responses. We will not send you marketing communications unless you have separately opted in where required by Applicable Law.

Analytics and improvement: We may analyse usage, transaction, performance, and security trends to improve the Platform, reliability, functionality, and security. Where feasible, we use aggregated, anonymized, or de-identified information for analytics, reporting, and service improvement.

Legal Basis for Processing

The Company processes personal data in accordance with the Digital Personal Data Protection Act, 2023 and applicable rules thereunder. Depending on the context, processing may be carried out based on your consent, including consent obtained through Platform registration, use of the Platform, or relevant Organization onboarding processes, and/or on permitted grounds under Applicable Law, including processing necessary for providing the Services you request through the Platform, processing transactions, maintaining security, preventing fraud and misuse, record-keeping and audit, resolving disputes, and complying with legal obligations and lawful requests.

Where you initiate a Gift Card purchase, Recharge Service, Bill Payment Service, BBPS transaction, Vendor payment, reimbursement, or other service through the Platform, the Company may process and share the information necessary to execute and support that transaction with the relevant third-party service providers, partners, billers, Merchants, or other participants involved in providing the requested service.

The Company may engage third-party service providers as data processors to support the Platform, who process personal data on behalf of the Company or relevant Organization in accordance with applicable instructions, contractual safeguards, and Applicable Law.

Sharing and Disclosure

Within the Company and Organization: Authorized personnel of the Company and, where applicable, authorized Client Admins or other personnel of the relevant Organization may access personal data on a need-to-know basis to administer the Platform, including onboarding and offboarding, User management, Point administration, transaction processing, reimbursements, support, reporting, reconciliation, dispute resolution, security, and compliance activities. Access by Organization personnel may be subject to the permissions and Platform features configured for the relevant Organization.

Gift Card Partner and Merchants: When you purchase a Gift Card through the Platform, the Company may share the minimum personal data and transaction information necessary with the relevant Gift Card fulfilment partner and/or Merchant to facilitate fulfilment, issue or deliver the Gift Card, record and reconcile the transaction, process applicable refunds or cancellations, provide customer support, and prevent fraud. Depending on the Gift Card and fulfilment method, such information may include your name, email address, mobile number, delivery address where applicable, Point amount or Gift Card value, and transaction identifiers. Such parties may process the data for fulfilment, support, fraud prevention, compliance with Applicable Law, and responding to lawful requests by competent authorities, in accordance with their own privacy notices and legal obligations.

Recharge, BBPS and Bill Payment Service Providers: When you use Recharge Services or Bill Payment Services, including services facilitated through BBPS, the Company may share the minimum information and transaction details necessary with the relevant recharge provider, biller, BBPS participant, payment service provider, technology partner, or other service provider involved in completing the transaction. This may include your mobile number, subscriber or customer number, consumer or biller account number, service provider or biller information, transaction amount, transaction identifiers, and other information necessary to process, confirm, reconcile, reverse, refund, or support the transaction. Such third parties may process the information in accordance with their own privacy notices, contractual obligations, and Applicable Law. The Company does not control the independent privacy practices of such third parties.

Service providers: We engage third-party service providers, including cloud hosting providers, OTP and email delivery providers, customer support tools, security service providers, analytics providers, payment and transaction service providers, recharge and BBPS service providers, and Gift Card fulfilment providers, to operate and support the Platform. Such service providers may process personal data on behalf of the Company or relevant Organization and are subject to contractual obligations and applicable safeguards appropriate to their role.

Regulators and legal requests: We may disclose personal data where required by Applicable Law, court order, or lawful request by a competent authority, or where necessary to protect rights, safety, or property, investigate fraud or security incidents, resolve disputes, or enforce our Terms.

Transfers outside India: The Platform is designed primarily for use in India. Where cross-border transfer or processing of personal data is necessary, including through service providers or infrastructure located outside India, we will take reasonable steps to ensure such processing and transfers comply with Applicable Law.

We do not sell or rent personal data. Employees and other Users may not transfer personal data to other Users except through permitted Platform workflows and as otherwise authorized by the relevant Organization or Applicable Law.

Cookies and Similar Technologies

The Platform may use session cookies, local storage, device identifiers, and similar technologies that are necessary to maintain login sessions, support authentication flows, preserve User preferences, maintain Platform functionality, monitor performance, and protect the Platform against fraud and unauthorized access. The Platform is not designed to use cookies for cross-site behavioural advertising or to track Users across unrelated third-party websites.

Where the Platform integrates services operated by third parties, including Gift Card fulfilment, Recharge Services, Bill Payment Services, BBPS services, or redemption and payment services, those third parties may apply their own cookies or similar technologies under their own policies, and the Company does not control such practices.

You can control cookies through your browser or device settings; however, disabling strictly necessary cookies or local storage may prevent you from logging in or using certain Platform features reliably.

Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Privacy Policy and as required or permitted by Applicable Law, including accounting, audit, tax, security, dispute management, fraud prevention, contractual enforcement, and compliance requirements.

Transaction and accounting records relating to Point issuance, allocation, redemption, payments to Vendors, Gift Card purchases, reimbursements where enabled, Recharge Services, Bill Payment Services, BBPS transactions, and Vendor Cash-Out Requests and approvals where enabled are retained for the period required under Applicable Law and applicable internal retention requirements.

Security and operational logs are maintained for a reasonable period and may be retained longer where necessary for incident investigation, audit, dispute resolution, fraud prevention, security, or compliance with lawful directions.

Account and profile data is retained while you remain an authorized User and for a reasonable period thereafter to support offboarding, reconciliation, reversals, refunds, dispute resolution, security, and legal or regulatory requirements.

At the end of the applicable retention period, personal data is securely deleted, anonymized, or archived with appropriate access restrictions, subject to lawful holds or other requirements under Applicable Law.

After your authorization to access the Platform ends, you may lose access to your Wallet and transaction history, but the Company may retain records as required or permitted for legitimate business purposes, contractual obligations, accounting, audit, tax, security, dispute resolution, and legal compliance.

Security Measures

We implement appropriate technical and organizational security measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, consistent with Applicable Law. These measures may include encryption of sensitive data in transit and, where appropriate, at rest; authentication using one-time passwords (“OTPs”) and other supported authentication methods; role-based access controls and least-privilege administration; logging and monitoring; secure development and change-management practices; backup and recovery measures; and periodic security testing.

We require our relevant service providers and processors to implement reasonable security controls appropriate to the nature of the services they provide and to process personal data in accordance with applicable contractual arrangements and Applicable Law.

In the event of a suspected or confirmed personal data breach or cybersecurity incident affecting the Platform, we will take reasonable steps to contain, assess, investigate, and remediate the incident and will comply with applicable reporting and notification obligations under Applicable Law.

Users must also protect their access credentials and must promptly notify the Company at care@Corpcash.in of any suspected compromise, unauthorized access, or misuse of their account.

Your Rights

Access and information: Subject to Applicable Law, you may request from the Company information regarding the personal data processed about you through the Platform and information regarding such processing, including information concerning the purposes of processing and relevant data processors or third parties with whom such personal data has been shared, where required to be provided under Applicable Law. This right is subject to lawful exclusions and limitations, including restrictions under the Digital Personal Data Protection Act, 2023.

Correction: You may request correction, completion, or updating of your personal data where it is inaccurate, misleading, incomplete, or out of date, in accordance with Applicable Law.

Erasure: You may request erasure of personal data where such right is available under Applicable Law and where continued retention is not necessary or otherwise permitted. Upon receiving a valid request, the Company will erase such personal data unless retention is necessary or permitted for the purposes set out in this Privacy Policy or for compliance with Applicable Law, including record-keeping, audit, dispute resolution, security, fraud prevention, contractual enforcement, and legal compliance requirements.

Withdrawal of consent: Where processing is based on your consent, you may withdraw your consent through Platform features made available to you or through other means described in the relevant notice. The withdrawal process will be no more burdensome than the process by which consent was provided. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal and may result in suspension, restriction, or termination of your access to the Platform or to specific features where the relevant processing is necessary for providing those features.

Nomination: You may, in accordance with Applicable Law and the terms of access arranged by the Company or relevant Organization, nominate one or more individuals who may, in the event of your death or incapacity, exercise your rights under Applicable Law.

Grievance redressal and escalation: You may submit a grievance relating to the processing of your personal data or the exercise of your rights by contacting the Company at care@Corpcash.in.

To enable us to act on your request, we may verify your identity using reasonable means, for example by confirming control over your registered email address, mobile number, account identifiers, or other relevant information.

We will respond to grievances and privacy requests within the timeframe required under Applicable Law and our applicable grievance redressal mechanism. Where Applicable Law requires you to first exhaust the Company’s grievance redressal process before approaching the competent regulatory or adjudicatory authority, you may be required to do so.

Contact, Grievances and Data Protection Officer

Support Contact: For Platform support, including account access, OTP issues, transactions, Gift Cards, Recharge Services, Bill Payment Services, BBPS transactions, reimbursements, and other Platform-related queries, you may contact the Company at care@Corpcash.in.

Privacy and Grievance Contact: For matters relating to this Privacy Policy, your personal data, or to exercise your rights under Applicable Law, you may contact the Company at care@Corpcash.in.

Privacy Queries, Requests and Complaints: Privacy-related queries, requests, including access, correction, erasure, withdrawal of consent where applicable, and complaints may be submitted using the contact details above. We will acknowledge and respond in accordance with Applicable Law and our applicable grievance redressal mechanism.

Where the Company is required to appoint a Data Protection Officer or other designated privacy or grievance officer under Applicable Law, the relevant designation and contact details may be provided through the Platform or an updated version of this Privacy Policy.

Changes to this Policy

We may amend this Privacy Policy from time to time to reflect changes in Applicable Law, technology, security practices, or our Services. If any change materially affects your rights or the manner in which personal data is processed, we will provide reasonable notice through the Platform and/or via email to your registered address, unless a shorter notice period is required or permitted for legal, security, or operational reasons.

The updated Privacy Policy will be effective from the “Effective Date” stated in the revised Policy. Continued use of the Platform after the effective date constitutes acceptance of the updated Privacy Policy to the extent permitted by Applicable Law.

Governing Law and Dispute Resolution

This Privacy Policy is governed by the laws of India. Any dispute arising out of or relating to this Privacy Policy shall be resolved in accordance with the governing law and dispute resolution provisions set out in the Corpcash Terms and Conditions, subject to Applicable Law and any rights or remedies that cannot lawfully be excluded or restricted.