Privacy Policy

This privacy policy document (“Privacy Policy”) is published in accordance with the provisions of Rule 4 (1) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 which requires the publishing of a privacy policy for handling of or dealing in personal information including sensitive personal data or information.

Onpoints Rewards Private Limited, a private limited company, incorporated and existing under the laws of India (hereinafter referred to as “Onpoint”, “We”, “Us”, “Company” or “Our”) is concerned about the privacy of the users (hereinafter referred to as “You”, “Your” or “User”, also referred to as “Data Principal” under applicable law) of its website or other applications/ services (“Website”) and has provided this Privacy Policy to familiarize You with: the manner in which Company collects, uses, stores and discloses Your information collected through the Website.

We act as a “Data Fiduciary” under applicable law.

0. Compliance with Applicable Law

This Privacy Policy is compliant with the provisions of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable laws in India. We process personal data in accordance with lawful purposes, obtain consent where required, and ensure protection of the rights of Data Principals.

1. Purpose

The purpose of this policy is to ensure that the information of / provided by any Users visiting the Website is stored in accordance with the applicable laws. The information stored in such a manner shall be protected by Onpoint via a secure server software, which is the industry standard and among the best software available today for secure transactions.

Company’s Privacy Policy explains:

  • What information is collected and why such information is collected;
  • How such information is used;
  • How such information can be accessed and updated.

Company has tried to keep the Privacy Policy as simple as possible. We value the trust you place in Us. That is the reason why we insist upon the highest standards for secure transactions and customer information privacy. Please read the following statement to learn about Our information gathering and dissemination practices.

2. Information We Collect

You will have to share some of your personal details with us to help us provide you a better experience and also, so you can use certain functions on the Website. This data will be protected but in some cases shared with third party vendors for functions like storage and processing payments. Please ensure that it is accurate and up to date.

We collect and process your personal data only upon obtaining your consent, except where processing is permitted under applicable law. Consent shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action. You have the right to withdraw your consent at any time, and upon such withdrawal, we shall cease processing your personal data unless otherwise required under law.

Depending upon the activity you wish to carry out on the Website, the information provided to Us shall be identified either as mandatory or voluntary. An activity which requires information to be mandatorily provided shall not be engaged if You abstain from providing such information.

Personal Information: This includes the information that can be used to uniquely identify or contact You. In order to avail the services provided by Us, We may collect a variety of Personal Information, including but not limited to, Your name, postal address, phone number, email address, contact preferences, etc. The term “Account” as referred to in this Privacy Policy shall mean and include the Account held by the User with Company (administered by a password) for using the services as provided by Company.

The Personal Information is collected from You in a voluntary fashion when You provide your credentials on the Website managed by Us. You are required to ensure that Your contact information and preferences are accurate, complete and up to date by logging into Your Account. We shall also make reasonable efforts to provide You with the opportunity to request correction of data relating to Your Personal Information if the same is inaccurate or delete the data.

Non-Personal Information: Non-Personal Information is any information that does not reveal Your specific identity, such as, browser information, information collected through Cookies, IP Address, pixel tags, etc.

Cookies: Cookies are pieces of information that are stored on a User’s PC when the User accesses a website. The Website may use temporary cookies to help you access some of the special functions within the database driven areas of the Website. Once you leave our Website, these cookies expire.

Information We Receive From Third Parties:

In addition to the information You provide directly, We may receive information about You from third-party sources for the purpose of verifying identity, assessing risk, and protecting the security and integrity of the Website and our services. This includes:

Gridlines, a regulated identity verification and KYC service provider, which We use for Aadhaar-based e-KYC, PAN verification, and related identity checks; Fraud detection and risk-scoring vendors (which may analyze device, network, and transaction-pattern signals); Credit bureaus, KYC Registration Agencies (KRAs), or similar regulated agencies, where applicable to Your use of the Website; Publicly available databases or registries, where relevant to verifying the accuracy of information You have provided.

We combine this information with the information You provide Us to confirm Your identity, assess and prevent fraudulent or unauthorized activity, and comply with our regulatory obligations. Where such information is obtained from a source other than You, We will provide notice of this processing as soon as reasonably practicable, in accordance with the Digital Personal Data Protection Act, 2023.

3. Use of Personal Information

Your Personal Information shall be processed only for lawful purposes that are clearly communicated to you at the time of collection or otherwise permitted under applicable law.

Your Personal Information may be used for Know Your Customer (KYC) purposes in accordance with regulatory requirements. KYC procedures are essential to verify the identity of our users and maintain the security and integrity of our services.

We offer an online platform system for carrying out transactions that collects such personal data or information to process your requests. The Personal Information so collected may be shared with SEBI/ NSE/ BSE, KYC Registration Agencies (KRAs) etc. solely for the purpose of processing your transaction requests or serving You better.

Fraud Prevention and Account Security

We use Personal Information — including information obtained from third parties as described in Section 2 — to:

Verify Your identity and the accuracy of information You provide; Detect, investigate, and prevent fraudulent, unauthorized, or suspicious activity on the Website; Assess risk associated with transactions or account activity; Protect the security of Your Account and the integrity of our platform.

This processing is carried out on the basis of Your consent, or, where applicable, on such other lawful basis as is permitted under the DPDP Act, including for the prevention and detection of fraud. Where We rely on a basis other than consent, We will notify You in accordance with applicable law.

Aadhaar-Based Verification

Where You choose to complete identity verification using Aadhaar, We use Gridlines (a UIDAI-authorized verification service provider) to perform Aadhaar-based authentication or e-KYC on Our behalf. Gridlines processes Your Aadhaar information directly with UIDAI and returns to Us the verification outcome and permitted demographic details (such as masked Aadhaar/Virtual ID, name, and date of birth), strictly for the purpose of confirming Your identity. We do not collect or store Your full Aadhaar number.

  • Separate, specific consent: Before initiating Aadhaar-based verification, We (or Gridlines, on Our behalf) will obtain Your explicit, informed consent specific to that purpose, separately from Your general consent to this Privacy Policy, and will inform You of the nature of information to be shared upon authentication.
  • No storage of full Aadhaar number: We do not store Your full Aadhaar number. Any Aadhaar-linked information We retain is limited to the masked Aadhaar number, Virtual ID, or verification outcome returned by Gridlines, held in a manner compliant with the Aadhaar (Data Security) Regulations, 2016.
  • Purpose limitation: Aadhaar-derived information is used solely for identity verification and is not used for profiling, marketing, or any purpose beyond what You consented to.
  • No further sharing: We do not share Your Aadhaar-derived information with any third party other than Gridlines (for the purpose of performing the verification) except as mandated by law, and We do not publicly display or print Your Aadhaar number.
  • Grievances: Complaints specific to Aadhaar-based verification may also be raised with UIDAI in addition to Our Grievance Officer (Section 10).

4. Information Security

Your data is safe with us.

We restrict access to personal data to authorized personnel and third-party service providers strictly on a need-to-know basis and subject to appropriate confidentiality obligations.

  • Encrypt our services using secure server software, which is the industry standard.
  • Review our information collection, storage and processing practices.

Data Breach Notification
In the event of a personal data breach, we shall notify the relevant authorities and affected Data Principals as required under applicable law.

5. Information We Share

We will only disclose your personal information if required by the authorities, or to protect and improve our Operations or with certain affiliates who provide services like data security, customer service and more. We do not sell your data to anyone.

We may share information — including information received from third parties for fraud prevention purposes — with identity verification providers, fraud-prevention and risk-assessment vendors, and regulatory or law enforcement authorities, solely for the purposes described in Section 3. We do not sell this information, and we limit sharing to what is necessary for these purposes.

6. Retention

Personal data shall be retained only for as long as necessary to fulfill the purposes for which it was collected or as required under applicable law. Thereafter, such data shall be deleted or anonymized.

Additionally, Onpoint has the right to retain the personal information for legal and regulatory purposes and as per applicable data privacy laws.

7. Your Rights

You have the right to:

  • Request what information we are holding of yours.
  • Request for an update of data we are holding that is inaccurate.
  • Request to delete the data we are holding of yours (where provided by law).
  • Object at any time to the processing of your personal data for direct marketing.
  • Withdraw consent previously given for processing of personal data.
  • Request grievance redressal from the Company.
  • Nominate another individual to exercise your rights in case of death or incapacity.

These rights apply equally to information We hold about You that was obtained from third-party sources.

8. Change in Privacy Policy

Company may update this Privacy Policy at any time, with or without advance notice. If a User uses the services after notice of changes has been published on the Website, such User hereby provides consent to the changed practices.

9. Advertisements

Some of the advertisements You see on the Website are selected and delivered by third parties. These third parties may collect information about You through cookies and web beacons.

10. Grievance Redressal

In accordance with the Digital Personal Data Protection Act, 2023, the Company has appointed a Grievance Officer to address your concerns regarding processing of your personal data.

Grievance Officer Contact:
Email: [email protected]

We shall respond to grievances within such time period as prescribed under applicable law.

11. Disclaimer

Company shall not be liable for any loss or damage sustained by reason of any disclosure (inadvertent or otherwise) of any information concerning the User's account.

12. Miscellaneous

The laws of India shall govern this privacy statement, and the courts of Gurgaon, India shall have exclusive authority to hear and determine any issues relating thereto.

13. Cross-Border Data Transfers

Personal data may be transferred outside India in accordance with applicable laws and subject to any restrictions notified by the Government of India.