The Corpcash Merchant App (the “Merchant App”) is a mobile application developed and operated by Kalp Digital Infra Private Limited (the “Company”, “we”, “our”, or “us”) as part of the Corpcash platform (the “Platform”). The Company provides the Platform and the Merchant App as a technology provider to participating organizations. Each organization onboards, verifies, approves, and manages the merchants that accept Corpcash payments from its employees, and makes the Merchant App available to those merchants. This Privacy Policy explains how personal data is collected, used, shared, and safeguarded when a Merchant and its Authorized Personnel use the Merchant App. It applies to the Merchant App and related merchant-facing interfaces (collectively, the “Services”), and is intended to be read together with the Corpcash Merchant App Terms and Conditions. Personal data is processed in accordance with applicable Indian data protection and privacy laws, including the Digital Personal Data Protection Act, 2023 and applicable rules thereunder, and the Information Technology Act, 2000 and rules thereunder, as amended from time to time. By using the Services, you confirm that you have read and understood this Privacy Policy.

“Platform” or “Corpcash” means the digital employee benefits, rewards, payments, redemption, and related technology platform developed and operated by the Company and made available to participating Organizations.

“Merchant App” means the Corpcash Merchant mobile application made available through the Google Play Store, the Apple App Store, or any other Company-authorized distribution channel, together with related merchant-facing interfaces and features.

“Company” means Kalp Digital Infra Private Limited, the technology provider of the Platform and the Merchant App.

“Organization” or “Client” means the company, business, institution, or other entity that uses the Platform under an arrangement with the Company and that onboards, verifies, approves, and manages Merchants for its Employees.

“Client Admin” means an authorized representative of an Organization who administers the Organization’s account, Employees, Merchants, Settlement Requests, and other Platform features made available to the Organization.

“Merchant” means a business, shop, outlet, canteen, service provider, or other legal entity or sole proprietor onboarded and approved by an Organization to accept payments in Points from that Organization’s Employees through the Platform.

“Authorized Personnel” means the owner, partner, director, manager, cashier, staff member, or other individual authorized by a Merchant to access and use the Merchant App on the Merchant’s behalf.

“Employee” means a current employee or other individual authorized by an Organization who uses the Corpcash Employee App and may make payments to Merchants.

“User” or “you” means a Merchant or any Authorized Personnel who accesses or uses the Merchant App. Where the Merchant is a sole proprietor, “you” includes the proprietor.

“Point” means a unit of value recorded on the Platform and made available to eligible Employees for limited programme purposes. Unless otherwise specified for a particular programme, one (1) Point represents a value of ₹1 for the applicable Platform transaction.

“Merchant Wallet” means the Platform ledger account associated with a Merchant that records Points received from Employees, Settlement Requests, adjustments, and related transaction history.

“Merchant QR Code” means the unique QR code or other payment identifier generated on the Platform for a Merchant, or for a particular outlet or counter of a Merchant, for receiving payments from Employees.

“Settlement Request” or “Cash-Out Request” means a request raised by a Merchant through the Merchant App to redeem an eligible Point amount held in its Merchant Wallet. The request is reviewed and approved or rejected by the relevant Organization, which settles the corresponding amount directly with the Merchant outside the Platform.

“Applicable Law” means applicable laws, rules, regulations, governmental directions, orders, and regulatory requirements applicable to the Company, the Organization, the Merchant, or the relevant processing activity.

Capitalized terms not defined above shall have the meanings given elsewhere in this Policy or in the Corpcash Merchant App Terms and Conditions.

This Privacy Policy applies to personal data processed through the Merchant App, including when a Merchant is onboarded onto the Platform by an Organization; when Users log in using one-time passwords (“OTPs”) or other supported authentication methods; when Merchants display a Merchant QR Code and receive payments from Employees; when Merchants view dashboards, Transactions, balances, and reports; when Merchants raise and track Settlement Requests; and when Users contact technical support.

Much of the information processed in connection with a Merchant relates to a business rather than an individual. This Privacy Policy applies to the personal data within that information, including personal data of sole proprietors, partners, directors, authorized signatories, and Authorized Personnel.

Information that a Merchant shares directly with an Organization outside the Merchant App, including for the Merchant Arrangement or for settlement, is governed by that Organization’s own privacy practices. Personal data of Employees who use the Corpcash Employee App is governed by the privacy policy applicable to Employees; this Privacy Policy describes only the limited Employee information visible to Merchants in connection with Transactions.

This Privacy Policy does not apply to any websites, applications, or services not operated by the Company. App Store operators may process personal data under their own privacy notices and terms.

The Merchant App is intended for use by businesses and their adult personnel and is not designed for use by children. You must be at least 18 years of age to use the Merchant App.

The Organization that onboards a Merchant decides what Merchant information is collected and how it is used to onboard, verify, approve, manage, and settle with that Merchant. For that processing, the Organization is the Data Fiduciary under the Digital Personal Data Protection Act, 2023.

The Company processes Merchant data on behalf of the Organization, as its technology service provider and data processor, solely to host, operate, secure, maintain, and support the Platform and the Merchant App. The Company does not use Merchant data for its own commercial purposes, does not sell or rent it, and does not use it for advertising.

The Company is independently responsible only for the limited processing it carries out for its own legal and operational obligations as the provider and publisher of the Merchant App, namely: authentication and security of the Merchant App, technical and security logs, crash and diagnostic reports, technical support requests sent to the Company, and compliance with Applicable Law and lawful requests from competent authorities.

Access to Merchant data by Company personnel is restricted to authorized personnel on a need-to-know basis, and only for hosting, maintenance, technical support, security, and legal compliance purposes, or on the documented instructions of the relevant Organization. Such access is logged and subject to confidentiality obligations.

The Company engages third-party service providers, such as cloud hosting, OTP and SMS delivery, push notification, and crash reporting providers, to operate the Merchant App. These providers process personal data only on the Company’s instructions and are bound by contractual confidentiality and security obligations.

Account and profile data: Name of the Merchant’s owner, proprietor, authorized signatory, and Authorized Personnel; mobile number; email address; and role or designation, as required to create and manage the Merchant account and log in to the Merchant App.

Business and verification data: Business or trade name, legal entity type, business category, outlet names and addresses, business registration details, PAN, GSTIN where applicable, identity details of the owner or authorized signatory, and verification documents, as collected by the Organization during onboarding.

Support communications: Information you provide when contacting technical support.

Transaction data: Payments received from Employees, Transaction amounts, dates and times, Transaction references and status, the Merchant QR Code or outlet used, Merchant Wallet balances, Settlement Requests and their status, reversals, and adjustments.

Technical and device data: IP address, device model, device identifiers, operating system and version, Merchant App version, push notification token, timestamps of access, and authentication and security events.

Diagnostic data: Crash reports, performance and error logs, and similar diagnostic information used to keep the Merchant App working reliably and securely.

The Merchant App is not intended for public posting or user-generated content. Please do not upload information that is not required for a Merchant App workflow.

The Merchant App requests access to device features only where required for the relevant functionality. You can manage these permissions at any time through your device settings. Declining a permission may prevent the related feature from working but will not otherwise restrict your use of the Merchant App.

Camera: Used, where enabled, to capture photographs of documents during onboarding or profile updates, or to scan QR codes. Images are captured only when you choose to use this feature.

Photos, media, and files: Used, where enabled, to upload documents or images you select, and to save or share your Merchant QR Code, reports, or statements to your device.

Notifications: Used to send payment received alerts, Settlement Request updates, and security and service notifications.

Internet and network access: Required to connect to the Platform and process Transactions and requests.

Location: The Merchant App does not collect precise device location. Outlet addresses provided during onboarding are business information, not device location.

The Merchant App does not access your contacts, call logs, SMS messages, microphone, or other device data that is not required for its functionality.

Operating the Merchant App: To create and manage the Merchant account as set up by the Organization; authenticate Users; generate Merchant QR Codes; record Transactions; show Merchant Wallet balances, Transaction history, dashboards, and reports; record Settlement Requests and make them available to the Organization for approval; and send service notifications.

Enabling Employee payments: To display the Merchant’s business name, outlet name, logo, category, and address to the Organization’s Employees in the Corpcash Employee App so that they can identify and pay the Merchant, and to apply the Organization’s programme rules to Transactions.

Security and compliance: To keep the Merchant App and the Platform secure, including through automated fraud-prevention and security controls; to maintain security logs; to investigate and respond to security incidents; and to comply with Applicable Law and lawful requests from competent authorities.

Support and reliability: To respond to technical support requests and to diagnose and fix errors and crashes. Where analytics are used to improve the Merchant App, they are based on aggregated or de-identified information wherever feasible.

No marketing communications are sent through the Merchant App unless you have separately opted in where required by Applicable Law.

Personal data is processed in accordance with the Digital Personal Data Protection Act, 2023 and applicable rules thereunder, based on the consent obtained through Merchant onboarding by the Organization and use of the Merchant App, and/or on other permitted grounds under Applicable Law, including processing necessary to provide the Services you use, maintain security, prevent fraud, and comply with legal obligations.

With the Organization: Merchant account details, business details, outlet details, Transactions made by the Organization’s Employees, and Settlement Requests are available to the authorized Client Admins of the Organization that onboarded the Merchant, so that the Organization can manage, approve, and settle with the Merchant, subject to the permissions configured by the Organization.

With Employees: Merchant business name, outlet name, logo, category, and address are displayed to the Organization’s Employees in the Corpcash Employee App, and Transaction details, such as the Merchant name, amount, date, and reference, appear in the Employee’s own Transaction history.

With service providers: Personal data is shared with the Company’s technology service providers, such as cloud hosting, OTP and SMS delivery, push notification, and crash reporting providers, only to the extent necessary to operate the Merchant App.

With authorities: Personal data may be disclosed where required by Applicable Law, court order, or a lawful request from a competent authority.

Business transfers: Personal data may be transferred to a successor entity in connection with a merger, acquisition, or transfer of the Platform business, subject to Applicable Law and continued protection in accordance with this Privacy Policy.

Transfers outside India: The Merchant App is designed for use in India. Where any processing takes place outside India, including through service providers, reasonable steps are taken to ensure it complies with Applicable Law.

Personal data is not sold or rented to anyone.

In the course of Transactions, the Merchant App may display limited information about the paying Employee, such as the Employee’s name or a masked identifier, the Transaction amount, date and time, and Transaction reference. This information is provided solely to enable the Merchant to confirm, record, and support the relevant Transaction.

Merchants and their Authorized Personnel must keep such information confidential, must use it only for the Transaction for which it was provided, and must not copy, store outside the Merchant App, use for marketing, or disclose it to any third party, except as required by Applicable Law.

The Merchant App uses session tokens, local storage, device identifiers, and software development kits (“SDKs”) that are necessary to maintain login sessions, deliver push notifications, report crashes and errors, and protect the Merchant App against fraud and unauthorized access. These technologies are not used for advertising or to track Users across other apps or websites.

Personal data is retained only for as long as necessary for the purposes set out in this Privacy Policy, for the period instructed by the relevant Organization, and as required under Applicable Law.

Transaction and accounting records are retained for the period required under Applicable Law, including tax and accounting laws. Security logs are retained for a reasonable period and may be retained longer where necessary for incident investigation or compliance with lawful directions.

When a Merchant account is deleted or the Organization’s arrangement with the Company ends, personal data is deleted, anonymized, or returned to the Organization in accordance with the Organization’s instructions, except where retention is required under Applicable Law.

You may request deletion of your Merchant App account and associated personal data at any time by writing to care@corpcash.in from your registered email address, with the subject “Merchant Account Deletion Request”, and including your registered business name and registered mobile number. You may also raise the request with the Organization that onboarded you.

The request will be verified and coordinated with the relevant Organization. Once processed, the account and Merchant QR Code will be deactivated and associated personal data will be deleted or anonymized within a reasonable period, except for information that must be retained under Applicable Law, such as Transaction, tax, and accounting records, or records needed to complete pending Transactions or Settlement Requests. Any remaining eligible Merchant Wallet balance or pending Settlement Request will be settled directly between you and the relevant Organization.

Uninstalling the Merchant App does not by itself delete your account or personal data.

Appropriate technical and organizational security measures are implemented to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, consistent with Applicable Law. These include encryption of data in transit and, where appropriate, at rest; OTP-based authentication; role-based access controls and least-privilege access for Company personnel; access logging and monitoring; secure development practices; and backup and recovery measures.

In the event of a personal data breach affecting the Merchant App, reasonable steps will be taken to contain, investigate, and remediate it, and the relevant Organization and, where required, affected individuals and authorities will be notified in accordance with Applicable Law.

Users must protect their access credentials and devices and must promptly notify the relevant Organization, or care@corpcash.in for technical issues, of any suspected compromise of their account or Merchant QR Code.

Subject to Applicable Law, you may request access to information about your personal data processed through the Merchant App, correction or updating of inaccurate or incomplete personal data, erasure of personal data where it is no longer required, and withdrawal of consent. You may also nominate an individual to exercise your rights in the event of your death or incapacity, in accordance with Applicable Law.

As the Organization decides how Merchant data is used for onboarding, managing, and settling with Merchants, requests relating to that data should ordinarily be made to the relevant Organization. You may also send any request to care@corpcash.in, and the Company will forward it to the relevant Organization and assist it in responding.

Withdrawal of consent does not affect processing carried out before withdrawal and may result in the Merchant App, or certain features, no longer being available to you.

Your identity may be verified before a request is acted on, for example by confirming control over your registered email address or mobile number. Requests and grievances will be responded to within the timeframe required under Applicable Law.

Organization: For queries about onboarding, your Merchant account, Transactions, Settlement Requests, settlements, or how your Merchant information is used, please contact the Organization that onboarded you.

Technical Support and Privacy Contact: For technical issues with the Merchant App, account deletion requests, or privacy queries and grievances relating to the Merchant App, you may contact the Company at care@corpcash.in.

Where a Data Protection Officer or grievance officer is required to be appointed under Applicable Law, the relevant contact details will be provided through the Merchant App or an updated version of this Privacy Policy.

This Privacy Policy may be amended from time to time to reflect changes in Applicable Law, technology, security practices, or the Services. If any change materially affects your rights or the manner in which personal data is processed, reasonable notice will be provided through the Merchant App, unless a shorter notice period is required for legal, security, or operational reasons.

The updated Privacy Policy will be effective from the “Effective Date” stated in the revised Policy. Continued use of the Merchant App after the effective date constitutes acceptance of the updated Privacy Policy to the extent permitted by Applicable Law.

This Privacy Policy is governed by the laws of India. Any dispute arising out of or relating to this Privacy Policy shall be resolved in accordance with the governing law and dispute resolution provisions set out in the Corpcash Merchant App Terms and Conditions, subject to Applicable Law and any rights or remedies that cannot lawfully be excluded or restricted.