Skip to content
GSX
Legal

Privacy Policy

How GSX collects, uses and protects personal data, and the rights you have under India’s Digital Personal Data Protection Act, 2023.

Last updated: [DATE]Effective: [DATE]

In short: we collect only what we need to provide and secure our services and meet our legal obligations. We don’t sell your data, we store it in India, and you can exercise your rights through our Contact page.

01Who we are

GSX Solutions Private Limited (“GSX”, “we”, “us”) is a company registered in India (Reg. No. 427024) with its registered office at DLF Towers, Delhi 110015. This policy explains how we handle personal data when you use our website, dashboard, APIs and services.

For personal data we collect for our own purposes, GSX is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). When we process personal data on behalf of our business clients — for example, their customers’ payment details — we act as a Data Processor under our agreement with that client, and the client’s own privacy policy also applies.

02What we collect

Depending on how you interact with us, we may collect:

  • Identity and contact details — name, email, phone number, business details and job title.
  • Verification data — KYC and KYB documents and information we must collect to meet our legal obligations.
  • Transaction data — payment amounts, references, account or UPI identifiers, and status.
  • Card data — handled only within our PCI DSS Level 1 certified environment and stored as tokens.
  • Technical data — IP address, device and browser information, and logs of how our services are used.
  • Communications — messages you send us and records of support requests.

03How we use it

We use personal data only for specified, lawful purposes, including to:

  • provide, operate and support our services;
  • verify identities and meet our obligations as a reporting entity registered with FIU-IND, including anti-money-laundering checks and reporting;
  • detect, prevent and investigate fraud and security incidents;
  • comply with applicable laws, regulatory directions and lawful requests;
  • improve our products and services; and
  • send you product updates or marketing, where you have agreed to receive them.

We process personal data on the basis of your consent, or for legitimate uses permitted under the DPDP Act, such as complying with the law. Where we rely on consent, you can withdraw it at any time; this does not affect processing that took place before withdrawal.

04Who we share it with

We do not sell personal data. We share it only where necessary, with:

  • banks, acquirers, card networks and payment system operators needed to process transactions;
  • service providers who process data on our behalf under contract, such as hosting, verification and communication providers;
  • regulators, FIU-IND, law-enforcement and other authorities where required by law; and
  • professional advisers, or a buyer or successor in the event of a corporate transaction, under appropriate confidentiality obligations.

05Where your data is stored

We store and process personal data in India. Payment data is stored in line with applicable regulatory requirements. [CONFIRM ANY PROCESSING BY SERVICE PROVIDERS OUTSIDE INDIA AND THE SAFEGUARDS USED.]

06How long we keep it

We keep personal data only for as long as needed for the purposes above or as required by law. KYC and transaction records are retained for [RETENTION PERIOD] as required under applicable anti-money-laundering law. When data is no longer needed, we erase it securely and, where the law requires, notify you before doing so.

07How we protect it

We use encryption in transit and at rest, card tokenisation, hardware-backed key management, strict access controls and continuous monitoring. Our controls are independently assessed under PCI DSS Level 1 and SOC 2. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as required by law.

08Your rights

Under the DPDP Act, you have the right to:

  • access a summary of the personal data we hold about you and how it is processed;
  • correct, complete or update your personal data;
  • request erasure of your personal data, subject to our legal retention obligations;
  • withdraw consent you have given us;
  • nominate another person to exercise your rights in the event of death or incapacity; and
  • have your grievances addressed by us.

To exercise any of these rights, reach us through our Contact page. We will respond within [X] days. If you are a customer of one of our business clients, we may refer your request to that client.

09Children

Our services are intended for businesses and adults. We do not knowingly process personal data of anyone under 18 without verifiable consent from a parent or lawful guardian.

10Cookies

We use cookies and similar technologies to run our website and understand how it is used.

11Contact & grievances

For questions or complaints about how we handle personal data, contact our Data Protection Officer / Grievance Officer:

[NAME], Data Protection Officer
GSX Solutions Private Limited, DLF Towers, Delhi 110015

If you are not satisfied with our response, you may approach the Data Protection Board of India.

12Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new “last updated” date and, where the change is significant, notify you directly.