PRIVACY POLICY

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Policy, unless a longer retention period is required or permitted by law. Our retention practices are guided by the principle that data should not be stored indefinitely without justification. Below is an overview of our retention approach:

• Operational Retention: For users of our Platforms (retailers, promoters, etc.), we keep your personal data active in our systems for the duration that you have an account or an ongoing relationship with us. For example, if you are a retailer participating in active schemes, your profile and KYC details will be retained so that you can continue to receive payouts and we can verify your eligibility. If a period of inactivity occurs (e.g., you have not logged into OpenPay or participated in any program for a long time), we may reach out to confirm if you wish to maintain your account.
• Program Records: Data related to specific campaigns or payout programs (such as transaction histories, payout records, and performance data) is retained at least until the relevant campaign is concluded and for a reasonable period thereafter for auditing or reconciliation. We might archive historical campaign data for our clients’ reference and our internal analysis, but we will either anonymize it or continue to protect any personal identifiers within it as long as it is retained.
• Legal and Regulatory Requirements: In certain cases, laws require us to keep data for a set period. For instance, financial transaction records and KYC documents might need to be stored for a minimum number of years under tax or anti-money laundering regulations. Even if you request deletion or withdraw consent, we may retain such data as needed to comply with law (we will retain only what is necessary and for the mandated duration). Likewise, if a legal dispute or investigation is ongoing, we would preserve relevant data until it is resolved. The DPDP Act specifically provides that personal data should be erased once the purpose is fulfilled or consent is withdrawn unless retention is needed for legal purposes – we adhere to this standard.
• Deletion and Anonymization: When the retention period for any personal data expires, or if you request deletion and we have no lawful basis to retain it further, we will take steps to securely delete or irreversibly anonymize the data. Secure deletion may involve erasing data from our databases, overwriting storage media, and instructing any third-party processors to also delete the data. Anonymization means we alter the data in such a way that it can no longer be associated with you (for example, aggregating it with others’ data or removing personal identifiers). Once anonymized, the information is no longer personal data and may be retained for analytics or statistical purposes without further notice to you.
• Backups and Residual Copies: Even after active deletion, some data may persist in our backup systems or logs for a short duration. We maintain backups for disaster recovery and business continuity, which are kept secure. Any personal data in backups will also eventually be purged or overwritten in the normal backup rotation cycle. We do not restore archived personal data back into active systems except as needed for legal, security, or performance reasons.

In summary, we do not keep your personal data longer than necessary. We periodically review the data we hold and erase or anonymize that which is no longer required. If you have specific questions about our retention periods for any category of data, you may contact us (see Grievance Redressal and Contact Us section below).

Data Security

We take the security of your personal data very seriously. OpenReach has implemented a variety of technical and organizational measures to prevent unauthorized access, loss, misuse, alteration, or disclosure of personal data under our control. Some of the key security practices we employ include:

• Encryption: Sensitive personal data (such as passwords, financial information, or identity numbers) is protected using encryption both in transit and at rest. For example, our applications use HTTPS (TLS encryption) for all data transmission between your device and our servers, preventing eavesdropping. Certain sensitive fields in our databases may also be encrypted or hashed so that even if the data were accessed, it would not be easily interpretable.
• Access Controls: We restrict access to personal data strictly to authorized personnel and service providers who need that information to perform their duties. Internal access to databases or systems containing personal data is permission-based, and employees are granted access on a role-based, need-to-know basis (for example, our finance team may access payout information, but not KYC documents, unless required). All staff members and contractors with such access are bound by confidentiality obligations.
• Authentication and Session Security: For our Platform users, we enforce secure authentication practices. This may include strong password requirements, OTP verifications, or multi-factor authentication for certain actions (especially for client managers on the portal). Sessions are encrypted and time-limited. We also encourage users to keep their credentials confidential and notify us immediately of any unauthorized account use.
• Network & System Security: Our servers and network are protected by firewalls, intrusion detection systems, and regular security monitoring. We apply security patches and updates to our software and infrastructure in a timely manner to guard against vulnerabilities. Regular backups are maintained to prevent data loss. We also run periodic security audits and penetration tests (either internally or via third-party experts) to identify and remediate potential security risks. Additionally, where feasible, we follow industry standards such as ISO 27001 for information security management and align with best practices for cybersecurity.
• Training and Awareness: We ensure that our employees are trained in data protection best practices and understand the importance of safeguarding personal data. We have internal policies regarding data handling, and we conduct background checks on staff as permissible. Employees are required to report any suspicious activities or potential security incidents so that quick action can be taken.
• Incident Response: Despite all precautions, no system can be guaranteed 100% secure. We have established a data breach response plan to deal with any potential security incident swiftly and effectively. If we detect any breach of personal data, we will immediately assess the scope and risk, take necessary containment measures, and notify affected parties and authorities as required. Under the DPDP Act, for example, we would inform the Data Protection Board of India and possibly the impacted individuals in the event of a significant data breach. We also log and analyze incidents to prevent future occurrences.

By implementing these measures, we strive to protect your personal data at all times. However, it is important for you as well to play a part in keeping your data secure: please use unique, strong passwords for our Services, do not share your account details with others, and inform us if you suspect any unauthorized activity on your account.

Your Rights and Choices

We respect your rights over your personal data. As an individual (or “Data Principal” under the DPDP Act), you have certain rights regarding the personal information that we hold about you. We have established procedures to enable you to exercise these rights easily and to the extent required by law. These rights include:

• Right to Access and Confirmation: You have the right to know whether we process any personal data about you, and to request access to that information. This means you can ask us to confirm if we have your personal data, and if so, request a copy of or details about the information we hold, including the categories of data, the purposes of processing, and any third parties with whom it has been shared. We will provide the requested information in a concise and transparent form, typically within a reasonable time. (Do note that repetitive or excessive requests may attract a reasonable fee or be subject to legal limitations, but we will inform you accordingly.)
• Right to Correction and Update: If any of your personal data we have is inaccurate, incomplete, or outdated, you have the right to request that it be corrected or updated. For example, if you change your phone number or identify an error in your stored address, you can ask us to rectify it. Where available, certain users (such as retailers via the app or portal) might be able to log in to their profile and directly update some details. For other changes, you can contact us with proof of the correct information, and we will make the amendments after verification.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances. You may exercise this right, for instance, if you no longer want to participate in our programs and wish to close your account, or if you believe our processing is unlawful or beyond the original purpose. Upon such request, we will erase your personal data from our active systems without undue delay, provided (a) there is no overriding legitimate ground or legal obligation for us to retain it (see Data Retention above), and (b) the data is not required for a contract performance that you are still a party to. We will also instruct our processors to delete respective data. Please note that we may retain limited information as required (e.g., to fulfill legal retention or to maintain suppression lists of those who do not wish to be contacted).
• Right to Withdraw Consent: In cases where we rely on your consent to process personal data (for example, for using your KYC data in a specific optional program, or for sending marketing communications, or for using certain cookies), you have the right to withdraw that consent at any time. If you withdraw consent, we will stop the processing for which consent was provided. For example, you can withdraw your consent for us to use your location data by revoking location permissions on your device or in the app settings; or you can opt out of marketing emails by clicking “unsubscribe” in the email. Withdrawing consent will not affect the lawfulness of processing done before the withdrawal. However, note that if certain data is necessary for providing a service (e.g., KYC for payouts) and you withdraw consent for that essential processing, we may have to limit or terminate your access to that service (since we cannot provide it without the data). We will inform you if such a situation arises.
• Right to Restrict or Object (Applicable in some jurisdictions): Under GDPR and similar global regimes, individuals have the right in certain situations to object to processing or request restriction of processing. For example, you might object to processing that is based on our legitimate interests or done for direct marketing. While Indian law (DPDP Act) doesn’t explicitly enumerate a broad right to object, it aligns by allowing withdrawal of consent and requiring consent for most processing. If you are an EU resident or otherwise entitled to such rights, you may object to our processing of your personal data on grounds relating to your particular situation. We will consider such objections and comply unless we have compelling legitimate grounds to continue or a legal obligation. You may also request that we temporarily restrict processing your data (other than storing it) if you contest its accuracy or the lawfulness of processing, or if you need us to preserve it for legal claims.
• Right to Data Portability: To the extent provided by law (such as under GDPR for EU users), you may have the right to data portability, which means you can request a digital copy of certain personal data you provided to us in a structured, commonly used, machine-readable format, and have the right to transmit that data to another service provider. If applicable, we can directly transfer the data to a third party at your direction, where technically feasible. In the context of our services, this might include basic registration information and KYC details you provided. (Note: This right may not be explicitly available under current Indian law, but we mention it here for completeness for global standards. We will endeavor to assist with such requests if made.)
• Right of Grievance Redressal: Under Indian law, you have the right to raise a grievance with us regarding the processing of your personal data. We are required to provide a readily available means for you to lodge any privacy-related complaints and to address them within a stipulated time. If you have any concerns or complaints about how we are handling your data, you can contact our Grievance Officer (see contact details below). We will acknowledge and strive to resolve your grievance expeditiously, typically within 30 days or as mandated by law. If you are not satisfied with our response, you have the right to escalate the matter to the appropriate regulatory authority (such as the Data Protection Board of India under the DPDP Act, or a supervisory authority in the EU, etc., depending on your jurisdiction).
• Right to Nominate a Representative: The DPDP Act grants you the right to nominate another individual to exercise your data rights on your behalf in case of your death or incapacity. You may inform us if you wish to designate an authorized person (such as a family member or legal heir) who can act as your nominee for your data. We will require proper verification and legal documentation to validate any requests from a nominee.
• Right to Opt-Out of Communication: Even outside the strict legal rights, we provide you simple ways to control your preferences. You can opt out of receiving promotional communications from us by using the unsubscribe link in our emails or by contacting us. For push notifications or SMS, you can disable them via your device or notify us that you do not wish to receive such messages. For cookies, as mentioned, you can adjust your browser settings to opt out of non-essential tracking.

To exercise any of your rights, please contact us through the channels provided in the Contact Information section below. We may need to verify your identity (and authority, in case you make a request on someone else’s behalf) to process your request. Verification is to ensure that we do not disclose data to the wrong person or delete data at the wrong person’s request. Verification may involve answering a few questions or providing identification.

We will do our best to honor your request promptly and within the timeframes stipulated by law. If we cannot fulfill your request (due to legal reasons or certain exemptions – for example, if you ask us to delete data which we are required by law to keep), we will inform you of the reasons (unless prohibited). Rest assured, we never discriminate against anyone for exercising their privacy rights. We provide all users with equal service and support regardless of their choices about personal data.

International Data Transfers

OpenReach is an India-based company and, as such, we primarily store and process personal data on servers located within India. However, in the course of our operations, your personal data may be transferred to, and processed in, other countries in the following scenarios:

• Cloud Hosting and Service Providers: Some of our third-party service providers (for cloud infrastructure, email delivery, analytics, etc.) may store or process data in data centers outside India. For example, if we use a cloud service whose servers are in the United States or the European Union, or if we use a multinational email/SMS provider, some personal data (such as your name, email, or usage data) might be transmitted and stored on those foreign servers. We carefully select service providers who assure a high standard of data protection.
• Client or Partner Access: If any of our client brand partners or their authorized users access the secure portal from outside India (for instance, a regional manager based abroad reviewing an India campaign), then technically personal data is being accessed from outside the country. Additionally, if in future OpenReach expands or has affiliates in other jurisdictions that need to access data for support or processing, such access would constitute a transfer.

We are mindful of the rules governing cross-border data transfers. The DPDP Act requires that transfers of personal data outside India comply with conditions as may be prescribed by the government, potentially including whitelisting of certain countries or similar mechanisms. Globally, laws like GDPR require that if personal data is exported out of the origin country, it must be protected to the same level as required by the original jurisdiction.

Whenever we transfer personal data internationally, we take steps to ensure adequate protection:

• We will only transfer data to countries that are recognized as having an adequate level of data protection, or ensure appropriate safeguards are in place. For example, for transfers from India to another country, we will follow the Indian government’s guidelines (if any exist for permitted destinations). For transfers from the EU (if we ever handle EU data) to a third country, we may use Standard Contractual Clauses (SCCs) or rely on an adequacy decision or binding corporate rules to ensure GDPR- level protection.
• We include robust data protection clauses in our contracts with any foreign processors to bind them to protect your data. They must treat your personal data according to the standards of this Privacy Policy and applicable law, regardless of where it is processed.
• You consent to the possible transfer of your information outside your country by using our Services. We will always seek to minimize unnecessary cross-border data flows. If you have questions about where your data is stored or transferred, please contact us.

Currently, personal data of Indian users is generally retained in servers within India or in trusted facilities in jurisdictions with strong privacy laws. If the law requires data localization for certain sensitive information (for instance, financial data), we will comply and store such information only in India.

We will update this section if there are any significant changes in our cross-border data handling, especially in response to future regulations under the DPDP Act regarding international transfers.

Third-Party Links and Services

Our Platforms may contain links to websites, applications, or services that are not operated by OpenReach. For example, our Website might include a link to a client’s website, a social media page, or an article of interest. Additionally, our mobile apps might integrate Google Maps for location selection or redirect you to a bank’s portal for completing a KYC step. This Privacy Policy does not apply to personal data processed by those external websites or services.

If you click on a third-party link or otherwise leave our Platforms to interact with an external service, be aware that you are transferring to a platform with its own privacy practices. We do not control and are not responsible for the content, security, or privacy practices of any third-party websites or services. We encourage you to review the privacy policies of every site or app you visit when you leave our Services, to understand how they collect and use your information.

Examples to note:

• If our Website uses social media sharing plugins (like a LinkedIn or Facebook button), those platforms may collect data about your visit under their own policies.
• If you use OpenKYC and it leverages a government eKYC service (like UIDAI’s Aadhaar verification page), that process is governed by the respective authority’s terms and privacy rules.
• If you follow a link from our client portal to download a report on a third-party system or to use a partner’s tool, any data you provide directly to that third party is not covered by our Policy.

Nonetheless, if you believe a third party linked from our Services is misusing your personal data in relation to your interaction via us, please inform us. We take user feedback seriously and will consider removing or disabling links to third parties that are known to compromise user privacy or security.

Grievance Redressal and Contact Information

OpenReach has appointed a Grievance Officer to address any questions, concerns, or complaints you may have regarding your personal data or this Privacy Policy. In accordance with Indian law, we have published the Grievance Officer’s contact details below. If you have any issues – whether it is to report a problem, ask about our practices, or exercise your rights – please do not hesitate to reach out:

• Grievance Officer: [NIVEDITHA CHAVAN]
• Designation: Grievance Officer – Privacy Compliance
• Email: grievance_officer@openreach.co
• Telephone: [+91-8850217491] (available on working days during business hours)
• Postal Address: OpenReach DeepMarketing (OPC) Pvt. Ltd, Navi Mumbai

(Note: The above contact details are provided in accordance with Section 10 of the DPDP Act and Rule 5(9) of the IT Rules, which require the designation and publication of a Grievance Officer’s information. We will update this information if there are any changes in the contact or person designated.)

Redressal Process: When you contact our Grievance Officer with a privacy-related query or complaint, we will acknowledge your communication within a reasonable time (typically within 24-48 hours). We will then investigate and attempt to resolve the issue. If it is a request to exercise a data right, the Officer will guide you through any verification needed and fulfill your request or provide an appropriate response. For grievances, we aim to resolve them expeditiously, and in any case within the timeline prescribed by law (currently, the IT Rules suggest resolution within 1 month). You will receive a response outlining the resolution or next steps. If you are not satisfied with our response or if your grievance is not resolved within the stipulated time, you may escalate the matter. Under the DPDP Act, you can file a complaint with the Data Protection Board of India. Similarly, if you are in a jurisdiction outside India, you may contact your local data protection authority or regulator. For instance, EU residents can reach out to their nation’s supervisory authority. We hope it never comes to that, as we are committed to addressing your concerns in good faith.

Other Contact Information: For general inquiries not related to privacy (such as learning more about our services), you may contact us at the general contact provided on our Website (e.g., our sales email or customer service number). We are always here to help our users and clients.

Updates to this Privacy Policy

We may review and update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. If we make any material changes, we will notify users by posting the updated Policy on our Website (with a new “Last Updated” date) and, if appropriate, via our apps or by email notification. We encourage you to periodically review this page for the latest information on our privacy practices. Your continued use of our Services after the effective date of an updated Policy will signify your acceptance of the changes. However, if the changes involve new purposes of processing or require new consent under applicable law, we will obtain your consent where necessary.