Data Retention Policy

This Data Retention Policy ("Policy") explains how long NedPay (nedpay.in) retains your personal and transaction data, when it is deleted or anonymised, and how to request deletion. It supplements our Privacy Policy and Terms and Conditions.

We follow the principle of minimum necessary retention under the Digital Personal Data Protection Act, 2023 (DPDP Act) — we keep data only as long as needed to provide services or as long as Indian law requires — and then securely delete, anonymise or mask it.

1. Indian Laws That Decide Our Retention Periods

DPDP Act, 2023 with Draft DPDP Rules: retain personal data only for the specified purpose or legal requirement; delete it when consent is withdrawn and no legal duty to retain remains.
Prevention of Money Laundering Act, 2002 (PMLA) with Maintenance of Records Rules, 2005: preserve transaction records for 5 years from the transaction date, and client due-diligence / KYC records for 5 years after the business relationship ends.
RBI Master Direction on KYC (2016, as amended): preserve KYC and transaction records for at least 5 years after account closure.
Companies Act, 2013 (Section 128) and Income-tax Act, 1961: preserve books of account, invoices and financial records for 8 years from the relevant financial year.
Central GST Act, 2017 (Section 36): preserve accounts and tax records for 72 months (6 years) from the relevant annual return due date.
Consumer Protection Act, 2019 and RBI complaint / TAT framework: preserve complaint and dispute records until final resolution plus limitation period (generally 2 years, retained by us up to 5 years for audit).
Information Technology Act, 2000 and CERT-In directions (2022): preserve system, network and security logs (generally 180 days; we retain up to 12 months for fraud prevention).

Where two laws prescribe different periods for the same record, we apply the longer period. Figures below therefore exceed bare-minimum PMLA / RBI periods where company, tax or GST law requires it.

2. Retention Schedule — How Long We Keep Each Category

Data category (examples)	Retention period	Legal / business basis
Account & identity data: name, email, mobile, hashed password, role, approval status	Life of account + 8 years after closure	Companies Act, Income-tax; PMLA / RBI minimum 5 years
KYC records: PAN, Aadhaar reference / masked copy, GSTIN, address proof, verification results	5 years after closure, extended to 8 years where company / tax law applies; Aadhaar stored only as masked / tokenised reference per UIDAI norms	PMLA Rules, RBI KYC Direction; Aadhaar Act / UIDAI regulations
Transaction & financial records: bill payments, recharges, wage settlements, e-commerce settlements, charges, commissions, GST invoices	10 years from transaction (minimum 8 years)	Companies Act 8 yrs + PMLA 5 yrs + Income-tax 8 yrs + GST 72 months; 10-year practice for audit safety
Disputes, refunds & chargebacks: tickets, refund references, bank correspondence	5 years after final resolution	Consumer Protection Act limitation + RBI complaint handling + audit
Security & technical logs: login history, OTP / 2FA logs, device IDs, IP whitelist, browser / session logs	Up to 12 months (security logs minimum 180 days)	CERT-In directions; fraud prevention and DPDP minimisation
Support & contact-form data: enquiries, call / email records	3 years after resolution (5 years if linked to a dispute)	Consumer Protection Act; service improvement
Marketing consents / cookies: consent records, non-essential cookies	Until consent withdrawn + 1 year proof-of-consent log	DPDP Act consent accounting

3. How We Store and Protect Retained Data

Passwords stored only in hashed form; Aadhaar never stored as plain full number — only masked / reference / verification outcome.
Encryption in transit, role-based access, device validation, 2FA and IP controls for staff access, and segregation of production and backup data.
Backups follow the same retention schedule; expired backups are overwritten on rotation and not restored except for disaster recovery.

4. Deletion, Anonymisation and Legal Hold

On expiry of the period above, data is securely deleted, anonymised or irreversibly masked (including from active systems within 90 days of expiry; backups on next rotation cycle).
Anonymised or aggregated statistics (e.g. transaction volumes) that cannot identify you may be kept longer for analytics and compliance reporting.
Legal hold: if data is needed for an ongoing investigation, dispute, tax assessment, audit, court / regulator order or fraud inquiry, deletion is suspended until the hold is released, and you will be informed where legally permitted.
Mandatory records (KYC, transaction, tax) cannot be deleted early while a legal retention duty applies — even if you close your account or withdraw consent.

5. Account Closure and Deletion Requests

You may request account closure or deletion of non-mandatory data by emailing info@nedpay.in from your registered email with your registered mobile number and ID proof.
We verify identity, confirm there are no pending dues, disputes or investigations, close the account, delete or mask data that has no retention duty, and confirm completion — normally within 30 days (sooner where the DPDP Rules require).
Data under legal retention is blocked from routine use (no marketing or analytics) and kept only for compliance until its expiry.
Withdrawal of consent for essential KYC / transaction data will require account closure, since regulated payment services cannot be provided without it.

6. Changes and Contact

We may update this Policy when our services or Indian legal requirements change. Material changes will be posted at https://www.nedpay.in/data_retention_policy with a revised date; continued use of NedPay constitutes acceptance.

Email (Grievance Officer): info@nedpay.in
Phone: 9807593999
Address: No 6/50, R.N Puram, Tirupur, Karukkampalayam, Avanashi, Coimbatore - 641654