Data Residency

This Policy describes Paywize’s approach to data storage, processing, security, residency, and governance in connection with its technology platform and services.

Paywize is a Technology Service Provider (TSP) that provides API-driven infrastructure enabling businesses to integrate with licensed banking and payment partners.

Paywize applies data-security and residency controls based on Applicable Law, contractual obligations, internal security requirements, and requirements communicated by applicable licensed partners.

Where regulated payment-system data is processed or maintained by a licensed banking or payment partner, the relevant partner remains responsible for its statutory and regulatory data-residency obligations.

Where Paywize maintains certifications or compliance attestations such as ISO/IEC 27001 or PCI DSS, references in this Policy apply only to the certified or assessed scope and should be read together with the applicable certificate or attestation.

This Policy applies to:

• Personal, business, merchant, partner, and platform data processed by Paywize;
• Transaction-related technology data generated, received, transmitted, or stored through Paywize systems;
• API requests and responses, webhooks, system logs, reconciliation information, and operational metadata;
• Data processed by authorised service providers acting on behalf of Paywize; and
• Cloud, application, database, backup, disaster-recovery, and other technology environments operated or controlled by Paywize.

Where data is independently processed or controlled by a licensed banking or payment partner, that partner’s own data-residency, privacy, security, and retention requirements will also apply.

Data categories may include:

• Personal information;
• Merchant and business information;
• KYC/KYB documentation collected or facilitated during onboarding;
• Transaction-related technology data;
• Payment status and reconciliation information;
• API requests and responses;
• Webhook records;
• System, application, and security logs;
• Device and network information;
• Audit trails; and
• Other information required to operate and secure Paywize’s technology services.

Where regulated payment-system data is controlled by a licensed partner, such data remains subject to that partner’s regulatory and contractual requirements.

Paywize uses cloud, hosting, and infrastructure providers selected based on security, availability, contractual, data-residency, and compliance requirements.

Where Paywize is required by Applicable Law, contractual obligations, or licensed-partner requirements to maintain particular data within India, the relevant production, backup, and disaster-recovery environments are configured accordingly.

Paywize evaluates the security and compliance posture of infrastructure providers, including applicable industry certifications and independent assurance reports.

Paywize evaluates cross-border transfers of personal, business, or platform data based on Applicable Law, contractual obligations, data classification, security requirements, and partner requirements.

Where a category of data is legally or contractually required to remain within India, Paywize applies appropriate controls designed to prevent unauthorised cross-border transfer of that data.

Where cross-border processing is legally permitted, Paywize may implement appropriate contractual, organisational, and technical safeguards.

Third-party service providers handling Paywize data are subject to due diligence and contractual requirements appropriate to the nature and sensitivity of the information they process.

Requirements may include:

• Data-residency obligations where applicable;
• Confidentiality and data-processing requirements;
• Information-security controls;
• Access restrictions;
• Incident-notification obligations;
• Applicable industry certifications or assurance reports; and
• Subprocessor and data-transfer controls.

Vendors may be subject to periodic security, compliance, and risk reviews based on their risk classification and services provided.

• Access to sensitive or restricted information is granted based on role, business need, and least-privilege principles.
• Relevant access events may be logged and monitored in accordance with Paywize’s security policies.
• Security controls may generate alerts for anomalous or potentially unauthorised data access or movement.

Paywize retains information only for periods reasonably necessary for the purposes for which it was collected, to provide its technology services, meet contractual obligations, resolve disputes, maintain security and audit records, or comply with Applicable Law.

Retention periods vary by data category, purpose, contractual requirement, licensed-partner requirement, and applicable legal obligation.

Where Paywize processes information on behalf of or in support of a licensed partner, applicable partner retention requirements may also apply.

Data that is no longer required may be securely deleted, anonymised, or otherwise disposed of in accordance with Paywize’s information-security procedures, subject to applicable retention obligations.

Paywize’s designated information-security, privacy, risk, and compliance functions oversee implementation of this Policy within their respective responsibilities.

Paywize’s information-security controls are mapped, where applicable, to recognised security frameworks and applicable certification requirements.

Employees, contractors, and authorised service providers are required to comply with applicable Paywize information-security, privacy, access-control, and data-handling requirements.

Violations may result in:

• Restriction or removal of system access;
• Internal investigation;
• Corrective or disciplinary action;
• Vendor remediation or termination;
• Security-incident response;
• Contractual remedies; and
• Legal or regulatory notification where required by Applicable Law.

Paywize Technologies Pvt. Ltd. operates as a Technology Service Provider (TSP). Paywize provides APIs, software, integration, orchestration, reconciliation, reporting, and related technology capabilities.

Where Paywize technology enables access to regulated banking or payment services, the underlying regulated service is provided by the applicable licensed banking or payment partner.

Data-residency, payment-system-data, regulatory-reporting, settlement, or other statutory obligations applicable to the licensed partner remain the responsibility of that regulated entity. Paywize implements appropriate technology and security controls within the scope of its role and applicable contractual obligations.

Depending on the nature of the interaction, Paywize may process information for its own legitimate business and platform purposes or process certain information in connection with services provided to Merchants or licensed partners.

The applicable role, processing purpose, and responsibilities may vary depending on the product, data category, and contractual arrangement.

Paywize Technologies Pvt. Ltd. is a Technology Service Provider (TSP). Paywize maintains data-security and residency controls appropriate to the information processed within its technology platform and its applicable legal and contractual obligations.

Where underlying regulated banking or payment services are provided by licensed partner institutions, regulatory data-residency and payment-system obligations applicable to those institutions remain subject to their respective responsibilities and Applicable Law.