Privacy Policy

LP Fintech Private Limited ("LP Fintech," "we," "us") operates payment infrastructure, UPI switch solutions, API banking services, white-label payment platforms, WorkPulse HRMS, merchant onboarding systems, fraud monitoring, soundbox and PoS solutions, and verification suites across India.

This Policy governs collection, processing, storage, sharing, retention, and protection of personal data across all our platforms. It is aligned with the Digital Personal Data Protection Act, 2023 (DPDPA), the IT Act 2000, SPDI Rules 2011, and applicable RBI/NPCI guidelines.

This Policy applies to all individuals who interact with LP Fintech as:

Covered surfaces include: websites, mobile apps, payment APIs, HRMS portals, banking dashboards, UPI switch infrastructure, soundbox/PoS networks, reconciliation systems, verification platforms, and all digital services of LP Fintech.

Where LP Fintech acts as Processor, a Data Processing Addendum (DPA) governs the engagement. We do not process data beyond documented instructions from the Fiduciary, except where required by law.

Identity & Business

Name, date of birth, PAN, Aadhaar (where lawfully permitted), passport, CIN, GSTIN, director information, UBO details, digital signatures.

Financial & Transaction

Bank accounts, IFSC, UPI IDs/VPAs, masked payment instruments, settlement references, UTR numbers, reconciliation data, dispute records, ledger entries.

Technical & Device

IP addresses, browser fingerprints, device identifiers, cookies, session IDs, API logs, webhook payloads, telemetry, network performance metrics.

Workforce & HRMS

Employee ID, payroll components, EPF/ESI details, attendance logs, geolocation check-ins (where employer-enabled), appraisal data, disciplinary records, recruitment data, BGV reports.

KYC / KYB / AML

Identity proofs, business documents, AML risk records, sanctions screening results, PEP checks, UBO declarations, negative-list screening records.

API & Developer

API keys, OAuth tokens, webhook secrets, sandbox activity, SDK integration parameters, developer account details.

LP Fintech processes data solely for lawful, specified purposes:

LP Fintech deploys AI/ML models, rule-based risk engines, and analytical tools for: real-time transaction risk scoring, device fingerprinting, IP intelligence, velocity checks, AML monitoring, sanctions screening, and merchant risk profiling.

Certain decisions (transaction approval, merchant suspension triggers, onboarding risk outcomes) may involve automated processing. Where a decision produces significant effects, LP Fintech provides a mechanism for human review upon request through our Grievance Redressal process.

We share personal data only with: RBI, NPCI, FIU-IND, CERT-In (regulatory obligations); banking partners (settlement and reconciliation); KYC/AML bureaus (UIDAI, NSDL, authorised verification agencies); cloud and technology providers (within India-based infrastructure); auditors and legal advisors; and law enforcement under lawful orders.

In a merger or acquisition, data may be disclosed to successors subject to confidentiality obligations. All third-party subprocessors are bound by Data Processing Agreements.

All payment transaction data, UPI switch records, and HRMS workforce data are stored and processed on India-based servers, in compliance with RBI data localisation norms and NPCI operating guidelines. Limited cross-border processing (where technically necessary) is subject to standard contractual safeguards and is conducted without compromising RBI/NPCI residency requirements.

Our multi-layered security framework is aligned with PCI-DSS, ISO/IEC 27001 principles, and the RBI Cybersecurity Framework. Controls include:

In the event of a security incident, LP Fintech will: contain the breach, conduct forensic investigation, and notify affected Data Principals and relevant regulators. Critical incidents are reported to CERT-In within 6 hours as mandated. RBI and NPCI are notified per their respective frameworks. Breach notifications include: nature of the incident, data categories affected, estimated scale, and remediation measures.

Post the applicable period, data is securely deleted or anonymised unless a subsisting legal obligation, regulatory order, or dispute resolution process requires continued retention.

Under the DPDPA 2023, you have the right to: access a summary of your data being processed; correct inaccurate or incomplete data; erasure where retention is no longer legally required; withdraw consent for consent-based processing; nominate a person to exercise rights on your behalf; and raise a grievance (see §18).

Rights requests are responded to within 30 days (extendable by 30 days for complex cases). Requests may be declined where retention is legally mandated, required for fraud investigation, or necessary for legal defence — with written reasons provided.

Consent obtained by LP Fintech is free, specific, informed, unconditional, and unambiguous — obtained through affirmative action, not pre-ticked boxes. Consent records (timestamp, mechanism, scope) are maintained in our Consent Management System. Withdrawal of consent is possible at any time via account settings or by writing to privacy@lpfintech.com, and does not affect prior processing carried out on valid consent.

Employees may access payroll records, salary slips, attendance history, and leave balances through the WorkPulse HRMS self-service portal. Where WorkPulse HRMS is deployed as an enterprise SaaS, LP Fintech acts as Data Processor and the employer remains the Data Fiduciary responsible for employee notice and consent.

Monitoring disclosures: Geolocation attendance, IP tracking for remote sessions, and work-hour analytics may be deployed by employers — disclosed to employees at onboarding. Unsuccessful candidate data is retained for 12 months and then securely deleted.

If unsatisfied with our resolution, you may escalate to the Data Protection Board of India (on constitution), the RBI Integrated Ombudsman (payment disputes), FIU-IND (AML/KYC matters), or CERT-In (cybersecurity incidents).