PRIVACY POLICY

This Privacy Policy applies to Shop Rightepay Corporation Limited (hereinafter referred to as "we," "us," or "our"), a company incorporated under the Companies Act, 1956/2013, bearing CIN U45400WB2011PLC161876, with its registered office at Right Pay Shop, Netaji Street, Uttarpara, Gopalpur, Durgapur, West Bengal — 713212.

This policy governs how we collect, use, store, share and protect personal data obtained through our website (rightpayshop.com), the Rightpay Express mobile application (available on Google Play), our physical retail stores, franchise operations, and all related services (collectively, "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to any part of this policy, please discontinue using our Services immediately.

We collect personal data that you voluntarily provide to us, as well as data collected automatically when you use our Services. The categories of data we collect include:

2.1 Identity & Contact Data

• Full name, date of birth, gender
• Email address, mobile number
• Delivery address and billing address
• Government-issued identification (where required for franchise applications or compliance)

2.2 Transactional Data

• Order history, items purchased, quantities and amounts
• Payment method (we do not store full card numbers — payment tokenisation is handled by PCI-DSS compliant processors)
• Transaction IDs, receipts and invoices

2.3 Location Data

• Approximate or precise GPS location (when you enable location access on our app) for delivery address auto-fill and nearest store detection
• Delivery address coordinates for route optimisation

2.4 Technical & Usage Data

• IP address, device type, operating system, browser type and version
• App usage patterns, clickstream data, session duration and pages visited
• Error logs and crash reports

2.5 Franchise Application Data

• Business background, investment capacity, proposed location details
• Financial information shared voluntarily during the application process

2.6 Communications Data

• Messages, enquiries or feedback submitted through our website, app or email
• Records of customer support interactions

Under the Digital Personal Data Protection Act, 2023, we process your personal data only on one or more of the following lawful bases:

• Consent: You have given clear, informed and specific consent for processing your data for a defined purpose. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contract Performance: Processing is necessary to fulfil a contract to which you are a party, or to take pre-contractual steps at your request.
• Legal Obligation: Processing is necessary for compliance with applicable Indian laws, regulations, court orders or government directives.
• Legitimate Interest: Processing is necessary for our legitimate business interests (e.g., fraud prevention, service improvement, business analytics), provided those interests do not override your fundamental rights and freedoms.
• Vital Interest: Processing is necessary to protect your vital interests or those of another natural person in exceptional circumstances.

We do not sell, rent or trade your personal data to third parties. We may share your data only in the following circumstances:

5.1 Service Providers

We engage vetted third-party service providers to support our operations, including payment processors (UPI partners, payment gateways), SMS and push notification providers, cloud hosting services, and analytics platforms. These providers are contractually bound to process your data only for the specified purpose and in accordance with our instructions.

5.2 Delivery Partners & Franchise Operators

To fulfil your orders, we share your name, delivery address and contact number with our in-house rider network or authorised FOFO franchise store operators. Franchise partners are bound by confidentiality obligations and data protection commitments as part of their franchise agreement.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same level of protection set out in this policy. We will notify you before your data becomes subject to a different privacy policy.

5.4 Legal Disclosures

We may disclose your personal data when required by applicable law, court order, government directive, or to protect the rights, property or safety of our company, employees, customers or the public.

Our primary operations are based in India and data is predominantly processed and stored on servers located within India. Where we engage cloud service providers that may process data outside India, we ensure that appropriate safeguards are in place, including contractual clauses, standard data protection agreements or adequacy determinations as may be notified by the Government of India under the DPDP Act, 2023.

We will not transfer personal data to a jurisdiction that has been specifically restricted or prohibited by the Central Government of India.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. Our measures include:

• Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your device and our servers
• Encrypted storage for sensitive personal data fields
• Role-based access control limiting data access to authorised personnel only
• Regular security assessments, vulnerability scans and penetration testing
• Payment tokenisation: we do not store full payment card numbers — all payment data is handled by PCI-DSS compliant processors
• Incident response and breach notification procedures

Despite our best efforts, no method of electronic transmission or storage is 100% secure. In the unlikely event of a data breach affecting your rights and freedoms, we will notify you and the relevant authority as required by applicable law.

Under the Digital Personal Data Protection Act, 2023 and applicable rules, you have the following rights in respect of your personal data:

To exercise any of these rights, please contact our Data Protection Officer at support@rightpayshop.com. We will respond to your request within 30 days.

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyse site traffic and personalise content.

Types of Cookies We Use

• Strictly Necessary: Essential for the website to function. Cannot be disabled. (e.g., session cookies, security tokens)
• Performance & Analytics: Help us understand how visitors use our site so we can improve it. (e.g., page visit counts, error logs)
• Functional: Remember your preferences to provide enhanced features. (e.g., language, location)
• Marketing: Used to track visitors and deliver relevant advertising. Only activated with your explicit consent.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our Services. For mobile app tracking, you can adjust permissions in your device settings.

Our Services are intended for individuals who are 18 years of age or older. We do not knowingly collect personal data from children under 18. In accordance with the DPDP Act, 2023, where a child's data is processed, verifiable parental consent shall be obtained prior to such processing.

If you believe we have inadvertently collected data from a minor without appropriate consent, please contact us immediately at support@rightpayshop.com and we will promptly delete such data.

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. Retention periods are as follows:

Upon expiry of the applicable retention period, your personal data will be securely deleted, destroyed or irreversibly anonymised.

We may update this Privacy Policy periodically to reflect changes in our practices, Services, or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a prominent notice on our website or mobile application
• Send a notification to your registered email address where the changes are material and affect your rights

Your continued use of our Services after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.