Privacy Policy

EPKART TECHNOLOGY PRIVATE LIMITED ("EPKART", "we", "us" or "our") operates technology-enabled digital platforms and services focused on employee financial wellness, EMI management, repayment management and related digital services.

This Privacy Policy explains how EPKART may collect, use, store, disclose and protect personal data when you access or use the EPKART website, mobile application, Help Desk, EMI Protection-related services, everyday digital services, or other services made available through the EPKART platform.

By using an EPKART service, you should read this Privacy Policy together with the applicable Terms & Conditions and other service-specific information presented to you.

EPKART respects the privacy of its users and aims to process personal data only for lawful, specific and relevant purposes connected with the services being provided or enabled.

EPKART does not intend to collect personal data that is unnecessary for the relevant service.

The information requested from a user may differ depending on the EPKART service being used.

Depending on the EPKART service being used, the following categories of information may be processed. EPKART does not collect every category below in every case.

EPKART may process personal data for purposes including the following. EPKART does not use personal data for unrelated advertising, profiling, or selling user information.

• Creating and maintaining user accounts
• Providing access to EPKART services
• Verifying account or service information
• Processing EMI Protection-related requests
• Assessing applicable programme parameters
• Managing repayment-related information
• Providing repayment tracking functionality
• Providing everyday digital services
• Processing or facilitating applicable transactions
• Managing refunds and cancellations where applicable
• Providing offers or cashback where applicable
• Communicating service-related information
• Responding to support requests
• Maintaining security and preventing misuse
• Detecting suspicious, fraudulent or unauthorised activity
• Improving platform functionality and user experience
• Maintaining technical and operational records
• Complying with applicable legal and regulatory requirements
• Performing other purposes specifically communicated to the user at the time of collection

EPKART's EMI Protection proposition is subject to applicable programme parameters, individual assessment, employee and corporate relationships, employee history where relevant, verification and applicable terms.

Submitting information or an EMI Protection request does not by itself create any assurance of approval, protection, payment or availability.

Personal data provided in connection with an EMI Protection request may be processed only to the extent necessary for the applicable assessment, service process, repayment management, communication, verification, record keeping and other lawful purposes connected with the programme.

Where EPKART services are made available through an employer or corporate relationship, certain information may be received from or shared with the relevant organisation where permitted and necessary for the applicable service or programme.

Information shared with an employer or corporate organisation will depend on the applicable service, programme arrangement, user communication and applicable law.

Examples may include:

• Employee identification
• Employment-related information
• Programme participation information
• Information necessary for verification or administration

EPKART may use authorised third-party technology and service providers where necessary to operate or provide applicable services.

These may include providers supporting:

• Payment processing
• Recharge services
• Bill payment services
• DTH services
• Travel/flight services
• Technology infrastructure
• Cloud hosting
• Communication
• Authentication
• Security
• Analytics, where actually used

EPKART may also work with banks, NBFCs, payment service providers, merchants, technology providers and other entities where necessary for applicable services and subject to applicable law.

Third parties may process information according to their own applicable privacy policies and contractual obligations.

EPKART may disclose or share personal data only where reasonably necessary for the purposes set out below. EPKART does not sell personal data as a general business practice.

• Providing or enabling requested services
• Processing applicable transactions
• EMI Protection-related assessment or service processes
• Repayment management
• Corporate programme administration
• Technology and infrastructure services
• Fraud/security prevention
• Legal or regulatory compliance
• Protection of rights, property or safety
• Other purposes communicated to the user and permitted by applicable law

EPKART takes reasonable technical and organisational measures designed to protect personal data against unauthorised access, misuse, loss, alteration, disclosure or destruction.

Security measures may include access controls, authentication mechanisms, secure infrastructure, logging, monitoring and other safeguards appropriate to the nature of the information and services.

No digital system can be represented as completely risk-free.

EPKART retains personal data only for as long as reasonably necessary for the purpose for which it was collected, for providing the applicable service, for maintaining business and transaction records, for resolving disputes, for security purposes, or where retention is required or permitted by applicable law.

When personal data is no longer required for a lawful purpose, EPKART may delete, anonymise or otherwise dispose of it in accordance with applicable requirements and internal retention practices.

Subject to applicable law, users may have rights relating to their personal data, including the rights set out below.

• Access to information about personal data
• Correction of inaccurate or incomplete information
• Updating information
• Erasure where applicable
• Withdrawal of consent where processing is based on consent
• Grievance redressal
• Nomination where applicable under law

Withdrawal of consent does not necessarily affect processing already carried out lawfully before withdrawal, and certain information may need to be retained where required by law or for legitimate operational or legal purposes permitted by applicable law.

Where processing is based on consent, users may withdraw consent through the mechanism made available by EPKART or by contacting EPKART through the applicable support or privacy communication channel.

Withdrawal of consent may affect EPKART's ability to provide certain services where the relevant processing is necessary for those services.

The withdrawal process should be reasonably accessible and should not require a more difficult process than the applicable consent mechanism, where required by applicable law.

The EPKART website or app may use cookies, similar technologies or technical identifiers where required for functionality, security, preferences, analytics or other permitted purposes.

Where applicable, users may control certain cookie settings through their browser or the relevant platform settings.

EPKART's services are intended for adults and working employees and are not directed at children.

EPKART does not knowingly seek to collect personal data from children except where permitted and required under applicable law.

If we become aware that personal data of a child has been collected in a manner not permitted by applicable law, appropriate steps may be taken to address the situation.

EPKART may communicate with users through channels such as email, SMS, WhatsApp, in-app notifications, telephone and other service-related communication channels.

These communications may relate to account activity, service requests, transactions, repayment information, security, support, important programme information and other service-related matters.

Marketing communications, where used, are handled according to applicable consent and communication requirements. Promotional messages are not mandatory.

Where personal data is processed or transferred through service providers or infrastructure located outside India, EPKART will do so subject to applicable law and requirements.

In the event of a personal data breach or security incident, EPKART will take appropriate steps as required under applicable law, including applicable notification and mitigation requirements.

EPKART may update this Privacy Policy from time to time to reflect changes in its services, technology, legal requirements or data practices. The updated version will be published on the EPKART website or app with the revised "Last Updated" date.

Where required by applicable law, EPKART may provide additional notice or obtain consent for material changes.

For privacy questions, requests or grievances, users may contact EPKART through the communication channel below.

This Privacy Policy is intended to operate in accordance with applicable laws of India, including applicable provisions of the Digital Personal Data Protection Act, 2023 and rules/regulations made thereunder, as and when applicable to EPKART and the relevant processing activity.