Privacy Policy

1. Who We Are and Scope

cAzieo is a platform operated by DONEZO (OPC) PRIVATE LIMITED ("cAzieo", "we", "us" or "our"). This Privacy Policy explains how we collect, use, store, share and protect information when users, merchants, retailers and partners access our services.

Payment providers may process information separately under their own notices and legal obligations. We remain responsible for our own processing and do not transfer all responsibility to those providers.

2. Information We Collect

Depending on the services you use, we may collect and process different categories of information.

Account Information

• Name
• Mobile number
• Optional email address
• Account identifiers
• Profile details

Merchant and Retailer Information

• Business and owner details
• Business address
• Shop category
• Service location
• Authorised representative information
• Bank settlement details
• Documents required for verification

KYC and Verification Information

Where required for an enabled financial product, we or the authorised provider may collect applicable KYC information, including PAN, permitted identity documents and verification results.

Aadhaar information is requested only through a legally permitted process and for an identified purpose. Creating a basic profile does not by itself complete financial KYC.

Transaction Information

• Transaction amounts
• Transaction timestamps
• Reference numbers
• Masked account or card details
• Wallet identifiers
• Transaction status
• Settlement records
• Receipts
• Dispute information
• Support communications

Technical Information

• Device identifiers
• IP address
• Operating system
• Application version
• Security logs
• Device binding information

Location, Camera and Biometric Permissions

Location, camera and biometric permissions are requested only for functions that require them, such as retailer location verification, scanning payment codes or permitted authentication.

Where supported, device biometric authentication uses the operating system's authentication result rather than giving us access to the device's stored biometric template.

Any separate face verification must have its own notice explaining capture, purpose, provider and retention.

3. How We Use Information

We use relevant information to:

• Create and manage accounts.
• Verify identity and merchant eligibility.
• Authenticate access.
• Initiate and reconcile transactions.
• Maintain wallet and settlement records.
• Provide receipts and customer support.
• Investigate disputes.
• Detect fraud and misuse.
• Secure devices and accounts.
• Meet applicable legal, audit and regulatory requirements.

We send service messages such as OTPs, transaction alerts and security notices.

Promotional communications and optional personalised offers use separate choices where required. Refusing optional marketing does not prevent access to otherwise eligible services.

We do not use payment authentication data for advertising.

4. Notice, Consent and Choices

We provide notices identifying the information requested and its purpose. Where consent is required, it is obtained through a clear affirmative action.

Merely viewing this Privacy Policy does not constitute consent to every processing activity. Necessary processing may also occur on another basis permitted by applicable law, including legal obligations.

You may manage optional permissions through your device or account settings and request withdrawal of consent through our contact channel.

Withdrawal may prevent a service that depends on the affected information, but does not invalidate earlier lawful processing or require deletion of records we must retain.

5. Sharing and Payment Providers

We share information needed for a selected service with the relevant banking provider, acquiring institution, third-party aggregator or processor, payment gateway, authorised PPI issuer, card network or permitted identity verification provider.

Not every technology aggregator or gateway is itself a bank or licensed PPI issuer. The actual regulated provider and issuer will be identified in the relevant product journey and disclosures.

Contracted hosting, SMS, email, customer support and security providers receive only information needed for their functions and are subject to appropriate confidentiality, security and processing restrictions.

Merchants receive information necessary to fulfil a transaction or resolve a dispute; they are not entitled to unrestricted access to user records.

Information may be disclosed to competent authorities where lawfully required, to investigate fraud, or to protect legal rights.

A business reorganisation involving data will be subject to applicable legal requirements and appropriate notice.

We do not sell merchant or user personal information.

6. Indian Data Storage and Security

Merchant and user data maintained by cAzieo is stored on systems located in India.

Our Indian storage commitment includes applicable production records, backups and retained logs containing that data.

We require relevant service providers to support applicable Indian data localisation obligations.

Payment system data is handled in accordance with the RBI localisation requirements applicable to the relevant authorised payment system and its service arrangements.

We maintain reasonable technical and organisational safeguards appropriate to the information and risks involved.

• Controlled access
• Secure transmission
• Protection of stored information
• Security monitoring
• Incident management

No system can guarantee absolute security. A security incident will be investigated and affected persons and authorities notified where required by applicable law.

7. PCI Status and Sensitive Authentication Data

cAzieo is preparing its security controls and audit documentation for a PCI DSS assessment and validation process.

cAzieo is not currently PCI certified and does not claim completed, independently validated PCI DSS compliance.

Audit readiness and preparation do not constitute certification, a completed assessment or regulatory approval. A payment partner's validation does not automatically validate cAzieo's own environment.

Payment authentication must take place through the approved payment devices and provider flows.

Our platform must not retain card PINs, CVV or CVC codes, complete magnetic stripe data, or equivalent sensitive authentication data after authorisation, even in encrypted form.

Such secrets must not be entered in support requests or retained in application logs. Any permitted card data processing remains subject to the actual PCI scope and provider requirements.

For Aadhaar-enabled transactions, authentication is routed through the permitted provider process and registered device where required.

Raw fingerprint images and Aadhaar authentication biometric data must not be retained by cAzieo or merchants in platform databases or logs.

8. Retention and Deletion

We retain information only for the time needed for its stated purpose and applicable legal, financial, security and dispute requirements.

Transaction, KYC and settlement records may need to remain after account closure under obligations applicable to us or the relevant regulated provider.

We do not promise immediate deletion of such records.

Information that no longer has a lawful retention purpose is deleted or anonymised through our retention process.

Where temporary retention is necessary for a legal hold or unresolved dispute, access is restricted.

The applicable record categories and retention periods will be maintained in our internal retention schedule.

9. Your Privacy Requests

You may contact us to request information about the processing of your data, correction of inaccurate information, account closure, deletion of eligible records, withdrawal of consent or grievance resolution.

Statutory access, correction, erasure, grievance and nomination rights apply to the extent the relevant provisions of Indian data protection law are in force and applicable.

We may verify your identity using proportionate information before acting on a request.

10. Cookies, Children and External Services

Our website may use essential cookies or similar storage for sessions and security.

Any optional analytics or advertising tools must be disclosed with their purposes and required controls before use.

Third-party links and provider pages are governed by the respective provider's policy.

Our general account registration is intended for adults aged 18 or above. We do not knowingly permit independent registration by children.

Any issuer-supported product for a minor requires a separately approved guardian process and applicable child-data protections.

Contact us if a child has supplied information without that process.

11. Changes and Applicable Law

We may update this Policy to reflect changes in services, providers or legal requirements.

The current version and effective date will be displayed, and material changes will be communicated where required.

Additional consent will be obtained where required rather than assumed from continued use.

This Policy is applied consistently with Indian law, including applicable provisions of the Information Technology Act and rules, the Digital Personal Data Protection Act and rules as brought into force, and relevant payment and identity requirements.

12. Contact and Grievances

Operator: DONEZO (OPC) PRIVATE LIMITED

Address:
D No 18/4, G K M Layout,
Opposite to Globus Center,
Saravanampatti,
Coimbatore 641035,
Tamil Nadu, India

Website: www.cazieo.com

Support and Privacy Requests: cazieo.in@gmail.com
Mobile: +91-9787711229

Designated Grievance Officer: Duraisamy

Grievance Email: cazieo.in@gmail.com

Grievance Telephone: +91-9787711229

Escalation: Address your email to the Grievance Officer and include your complaint reference and relevant transaction details.

We will acknowledge and address grievances within the applicable statutory timelines.

Where the Information Technology sensitive personal data rules apply, grievances will be redressed within one month of receipt.

Payment complaints also follow the relevant regulated provider's mandatory resolution and escalation requirements.