Privacy Policy

EternaX ("EternaX", "we", "our" or "us") is committed to protecting the privacy, confidentiality and security of information that we collect, receive, generate, use, store, disclose or otherwise process in connection with our website, software platforms, application programming interfaces (APIs), products, services and business operations.

EternaX provides technology solutions designed to support financial institutions, banks, non-banking financial companies (NBFCs), payment service providers, merchants, fintech companies, businesses and other institutional customers. Depending on the services contracted by a customer, our technology may support financial reconciliation, payment processing workflows, settlement management, dispute management, merchant technology, fraud risk management, reporting, integrations and related operational activities.

These services may involve information relating to customer representatives, authorised users, merchant personnel, end customers, transaction participants, counterparties and other individuals whose information is supplied to or processed through our systems.

We recognise that information processed in financial technology environments may be confidential, commercially sensitive or subject to specific contractual, regulatory and security requirements. We therefore seek to process personal data in a manner that is transparent, purpose-oriented, proportionate to the relevant service and consistent with applicable law.

This Privacy Policy explains:

• The categories of information that we may collect or receive.

• The purposes for which information may be processed.

• How our role differs when we act for our own business purposes and when we provide technology services to institutional customers.

• The circumstances in which information may be shared with third parties.

• How we approach information security, retention and deletion.

• The choices and rights that may be available to individuals under applicable law.

• How individuals may contact EternaX regarding privacy-related matters.

This Policy should be read together with applicable service agreements, terms and conditions, order forms, data processing agreements, security schedules and other contractual documents governing the relevant relationship.

This Privacy Policy applies to personal data processed in connection with:

• The EternaX website and other digital properties operated by EternaX.

• Enquiries, demonstrations, product trials, sales discussions and business communications.

• Customer onboarding, account administration and authorised-user management.

• EternaX Sync and reconciliation-related services.

• Payment technology, payment orchestration and payment workflow services.

• Settlement Management services.

• Dispute Management services.

• UPI-related technology and integrations, where applicable to a contracted service.

• Merchant Technology services.

• Fraud Risk Management (FRM) technology and related risk workflows.

• APIs, integration tools, dashboards, reporting facilities and technical support.

• Employment, recruitment, vendor, partner and other business relationships, where applicable.

• Security monitoring, fraud prevention, service reliability, compliance and legal obligations.

The precise information processed depends on the product, configuration, integration, contractual arrangement and activities undertaken by the relevant customer.

For the purposes of this Policy, the following terms have the meanings set out below, unless the context requires otherwise.

"Applicable Law" means laws, regulations, rules, directions and binding requirements applicable to EternaX, the relevant customer, the relevant processing activity or the individual concerned.

"Authorised User" means an individual who is permitted by a customer or EternaX to access an account, platform, dashboard, API or other service.

"Customer" means a bank, NBFC, financial institution, merchant, payment service provider, fintech company, business or other entity that uses or contracts for EternaX's products or services.

"Customer Data" means information provided by or on behalf of a Customer, or generated through the Customer's use of the services, including personal data where applicable.

"Data Fiduciary" has the meaning assigned to that term under the Digital Personal Data Protection Act, 2023, where applicable.

"Data Principal" has the meaning assigned to that term under the Digital Personal Data Protection Act, 2023, where applicable.

"Data Processor" means a person or entity that processes personal data on behalf of a Data Fiduciary, as defined or recognised under applicable law.

"Personal Data" means data about an individual who is identifiable by or in relation to such data, or any corresponding concept under the applicable data-protection law.

"Processing" includes operations performed on information, such as collection, recording, organisation, storage, use, retrieval, consultation, disclosure, transmission, combination, restriction, erasure or destruction.

"Services" means the website, platforms, software, APIs, integrations, support facilities and other products or services provided by EternaX.

"Third Party" means an entity other than the individual, EternaX and the relevant Customer, including a service provider, technology partner, financial institution, integration partner or public authority.

Terms not specifically defined in this Policy shall be interpreted consistently with the applicable agreement and relevant law.

EternaX seeks to collect or process information relevant to a legitimate, disclosed and applicable business or service purpose. The information actually processed will vary according to the relationship and service involved.

EternaX may obtain information from the following sources, depending on the relevant relationship:

• Directly from individuals: When they submit a form, communicate with EternaX, register for a service or interact with the website.

• From institutional Customers: Through onboarding forms, uploaded files, system integrations, APIs, data feeds and service workflows.

• From authorised representatives: When a Customer administrator, employer, vendor or other representative creates an account or supplies information on another person's behalf.

• From integration partners: Where information is made available through an approved bank, payment network, service provider, merchant system or other integration.

• From technical systems: Through application logs, access records, monitoring tools, security systems and diagnostic processes.

• From public or permitted business sources: Where relevant to corporate verification, professional engagement, security or other lawful business purposes.

• From service providers: Where a third-party service supports authentication, communications, hosting, analytics, customer support or other authorised operations.

Where a Customer supplies personal data to EternaX, the Customer is responsible for ensuring that it is authorised to provide that information and that the required notices, permissions, consents or other legal grounds have been established, where applicable.

EternaX may process information for the following purposes, subject to the relevant service, role, contract and applicable law.

EternaX will process personal data only where it has an appropriate basis under applicable law and, where relevant, the applicable contract or documented Customer instructions.

Depending on the circumstances, the basis may include:

• Consent or another legally recognised permission.

• Performance of a contract or steps required before entering into a contract, where recognised by applicable law.

• Compliance with a legal obligation.

• Processing permitted for a legally recognised legitimate or other statutory purpose.

• Processing carried out by a Data Processor on behalf of a Data Fiduciary in accordance with applicable law and the relevant agreement.

Where consent is required, the relevant party will seek to obtain it in the manner required by law. Where a Customer is responsible for obtaining consent or providing a privacy notice, EternaX may rely on the Customer's contractual representation and instructions, subject to applicable law and any information reasonably necessary to assess the processing arrangement.

Consent should not be assumed merely because an individual uses a website, because information appears in a transaction file, or because a Customer has supplied the information to EternaX.

Where an individual withdraws consent, the relevant party will assess the request and its effect in accordance with applicable law, including whether another lawful basis or retention obligation applies.

The EternaX website may use cookies, local storage or similar technologies, depending on its implementation.

These technologies may support:

• Essential website functionality.

• Session management and security.

• User preferences.

• Website performance and diagnostics.

• Usage analytics.

• Marketing or campaign measurement, where implemented and permitted.

EternaX does not treat information supplied for a specific service as unrestricted information that may be disclosed for any purpose. Sharing will be assessed according to the relevant processing role, contractual arrangement, operational necessity and applicable law.

Different EternaX products may process different categories of information. The following descriptions identify potential processing activities and should be confirmed against the final product architecture.

EternaX seeks to process only information reasonably required for the relevant purpose, service or legal obligation.

Customers should submit information that is accurate, relevant and appropriately limited. Where possible, identifiers should be masked, fields excluded or data aggregated before transfer if the full information is not necessary for the service.

EternaX may request clarification, correction, masking or resubmission of information where a data quality issue materially affects the service or creates a security or privacy concern.

Where EternaX acts as a processor, the Customer will generally be responsible for determining the accuracy and lawfulness of source data, subject to any responsibilities assigned to EternaX by law or contract.

EternaX retains information only for as long as reasonably necessary for the purpose for which it was collected or received, subject to contractual commitments, applicable law, legitimate operational requirements and any valid preservation obligation.

Retention periods may differ by information category and product.

EternaX recognises the importance of protecting information against unauthorised access, alteration, disclosure, destruction, loss or misuse.

Subject to the nature of the service, risk assessment, technical feasibility and contractual commitments, EternaX seeks to maintain appropriate administrative, technical and organisational safeguards.

These may include:

• Role-based access control and least-privilege permissions.

• Authentication and access-management controls.

• Multi-factor authentication where implemented and appropriate.

• Encryption in transit and, where implemented, at rest.

• Secure handling of API credentials and secrets.

• Audit logging and monitoring of relevant activity.

• Network and infrastructure security controls.

• Vulnerability management and security testing.

• Secure software-development and change-management practices.

• Backup and recovery arrangements.

• Incident-response procedures.

• Personnel confidentiality obligations and security awareness.

• Vendor assessment and access restrictions.

• Separation of environments and controlled deployment processes, where implemented.

The specific controls available for a product may differ according to its architecture, hosting model, deployment configuration and contractual scope.

EternaX does not represent that any system or transmission method is completely secure. Security measures reduce risk but cannot eliminate every possible threat.

EternaX maintains or will establish incident-management procedures appropriate to its services and risk profile.

If EternaX becomes aware of a security incident affecting personal data within its control, it will assess the incident, take reasonable containment and remediation steps, preserve relevant evidence and determine whether notification or other action is required under applicable law and contract.

Where EternaX processes personal data on behalf of a Customer, it will notify the Customer in accordance with the applicable agreement and the legally required timeline. The notice should contain information reasonably available at the time and may be supplemented as the investigation progresses.

Where notification to individuals, regulators or other authorities is required, the responsible party will make the notification in accordance with applicable law and the relevant contractual allocation of responsibilities.

The handling of an incident may include:

• Identifying and assessing the affected systems and information.

• Containing the incident and restricting unauthorised access.

• Investigating the likely cause, scope and impact.

• Preserving relevant logs and evidence.

• Coordinating with the affected Customer and relevant service providers.

• Implementing remediation and recovery measures.

• Evaluating notification, reporting and documentation requirements.

• Reviewing lessons learned and corrective actions.

The timing and content of any notice will depend on the facts, the applicable legal requirements and the information available during the investigation. This Policy does not establish a substitute for a legally required incident-response procedure or a contractual incident-notification schedule.

EternaX may use hosting, infrastructure, software or support providers whose systems operate in different locations, depending on the service architecture and contractual arrangement.

Where personal data is transferred, accessed or otherwise processed across borders, EternaX will assess applicable legal restrictions, regulatory directions, contractual requirements and Customer commitments.

For services subject to specific data-localisation requirements, the relevant deployment and data flows must be configured to meet those requirements. EternaX does not make a universal representation that all information is stored exclusively in India unless that statement is confirmed for the particular service and environment.

Customers requiring a specific hosting region, data-residency arrangement, access restriction or cross-border transfer control should confirm the requirement with EternaX before onboarding and record the agreed position in the relevant contract or security schedule.

EternaX's website or platform may contain links to third-party websites, tools or services, or may integrate with third-party systems.

Those third parties may have their own privacy policies, contractual terms, security controls and data-processing practices. EternaX does not control an independent third party's privacy practices merely because its service is linked to or integrated with EternaX.

Before providing personal data directly to a third party, individuals and Customers should review the applicable notice and terms.

Where a third party processes information on behalf of EternaX or a Customer as part of an authorised service, the parties should establish appropriate contractual, confidentiality, security and processing arrangements.

Depending on the applicable law, the nature of the information and the role of each party, individuals may have rights concerning their personal data.

These may include rights to:

• Obtain information about relevant processing.

• Request correction of inaccurate or incomplete information.

• Request completion or updating of information where provided by law.

• Request erasure or deletion where applicable.

• Withdraw consent where processing is based on consent and withdrawal is legally available.

• Raise a privacy-related concern.

• Use a legally recognised complaint or redress mechanism.

• Exercise other rights granted by applicable law.

The availability and scope of a right depend on the applicable legal framework, any relevant exemptions, the type of information and the party responsible for the processing.

EternaX's enterprise financial technology services are generally designed for institutional customers and authorised business users rather than for children to register directly.

EternaX does not intentionally seek to collect children's personal data for general business marketing. If a particular service involves children's information or is likely to be used by children, the relevant processing must be separately assessed against applicable law, including any requirements relating to parental consent, age assurance, tracking, behavioural monitoring or other safeguards.

Where a Customer supplies information relating to a child through a transaction, dispute or other operational workflow, the Customer should ensure that the information is necessary and that the required legal basis and safeguards are in place.

If EternaX becomes aware that personal data has been collected in a manner that is inconsistent with applicable requirements, it will assess appropriate steps, which may include restricting access, seeking clarification, deleting information where permitted or coordinating with the responsible Customer.

Certain EternaX services may use configurable rules, matching logic, statistical techniques or automated workflows to classify records, identify discrepancies, generate alerts or support fraud and risk analysis.

Examples may include transaction matching, exception categorisation, threshold-based alerts, duplicate detection, workflow routing and risk indicators.

These outputs are intended to support operational activities within the configured service. They may be affected by the accuracy, completeness and timeliness of source data and by the configuration selected by the Customer.

Unless expressly agreed in a product-specific arrangement, EternaX does not represent that an automated output is a final legal, credit, fraud or eligibility determination. Customers should apply appropriate human review and decision-making controls wherever required by law, regulation, policy or the nature of the decision.

If a particular product uses automated processing that produces legal or similarly significant effects for individuals, the relevant processing must be assessed separately for applicable transparency, review, consent, fairness and other legal requirements.

EternaX recognises that Customers may submit confidential business information, transaction records, settlement information, dispute evidence and other commercially sensitive material.

EternaX will handle such information in accordance with the applicable agreement, confidentiality obligations, access controls and applicable law.

Information should be made available internally only to personnel or authorised service providers who require access for their assigned responsibilities. Where information is disclosed to a third party, the disclosure should be limited to the permitted purpose and subject to applicable restrictions.

Customers remain responsible for ensuring that information submitted to EternaX is appropriately classified and that any special confidentiality or regulatory restrictions are communicated and agreed before processing where necessary.

Nothing in this Policy authorises EternaX to disregard a valid confidentiality obligation, applicable banking secrecy requirement or other legal restriction.

If EternaX undergoes a merger, acquisition, restructuring, financing, sale of assets or similar transaction, relevant information may be reviewed or transferred as reasonably necessary for the transaction, subject to applicable law and appropriate confidentiality protections.

Where the transaction materially changes the identity of the entity responsible for processing or the purposes for which personal data is used, EternaX will assess whether notice, consent, contractual amendments or other action is required.

Any successor or acquiring entity that receives personal data must handle it in accordance with applicable law and the obligations that continue to apply to the data.

EternaX may maintain records and cooperate with audits, assessments or lawful regulatory requests to the extent required by applicable law, contractual commitments or the nature of the service.

Where an institutional Customer is subject to regulatory, audit or operational requirements, the parties should document relevant responsibilities, access arrangements, evidence requirements, retention obligations and permitted disclosures in the applicable agreement.

EternaX may provide information reasonably necessary to demonstrate compliance with the obligations applicable to its role, subject to confidentiality, security, third-party rights and legal restrictions.

Nothing in this Policy should be interpreted as a representation that EternaX is itself a regulated bank, NBFC, payment system operator or other regulated financial institution unless that status has been independently established and expressly disclosed.

Customers are responsible for ensuring that information supplied to EternaX is lawfully collected, relevant to the service, accurate to the extent required and provided with any notices, permissions or other legal grounds required by applicable law.

Customers should not submit information that is unnecessary for the service, unlawfully obtained, misleading, malicious or subject to restrictions that have not been disclosed and agreed.

Where appropriate, Customers should:

• Mask or remove unnecessary identifiers.

• Exclude authentication secrets and payment credentials.

• Use approved file-transfer methods and APIs.

• Restrict source-system access.

• Validate data before transfer.

• Notify EternaX of known inaccuracies or unauthorised disclosures.

• Ensure that their own privacy notices cover the relevant processing.

• Maintain appropriate controls over their users and integration partners.

EternaX may take reasonable steps to investigate or restrict processing where a data feed appears to contain unauthorised, excessive or unsafe information, subject to the relevant agreement and legal requirements.

Certain records may need to be preserved after a customer relationship ends or after an individual requests deletion. Examples may include records required by law, records subject to a valid legal hold, security incident evidence, contractual records necessary to establish or defend claims, and records required for the resolution of a dispute.

Any such retention should be limited to the applicable requirement and supported by appropriate access restrictions. Retained information should not be used for unrelated commercial purposes merely because it remains in storage.

Where the relevant law permits deletion or anonymisation after the retention purpose expires, EternaX should follow the applicable retention and disposal process.

EternaX seeks to incorporate privacy considerations into the design, configuration and operation of its services.

Depending on the service and risk, this may involve:

• Identifying the purpose and data categories before launch.

• Limiting collection to necessary fields.

• Restricting access based on role and responsibility.

• Separating Customer environments where appropriate.

• Reviewing third-party dependencies.

• Documenting data flows and integrations.

• Defining retention and deletion rules.

• Assessing security and privacy risks.

• Providing appropriate notices and contractual terms.

• Reviewing material changes to products and processing.

• Training relevant personnel on confidentiality and secure handling.

The implementation of these controls may differ by product and deployment. EternaX should maintain internal records showing which controls are in place for each service and should not publish a control as implemented until it has been verified.

EternaX primarily provides business-to-business technology services, but its website or services may be accessed from different jurisdictions.

The laws applicable to a particular processing activity may depend on the location of the individual, the Customer, the service, the processing operation and other legal factors.

Where another jurisdiction's mandatory privacy requirements apply, EternaX will assess those requirements and determine whether additional notices, contractual provisions, transfer safeguards or other measures are necessary.

This Policy is not intended to create a representation that every privacy law worldwide applies to every EternaX service or that every service is designed for every jurisdiction.

EternaX may update this Privacy Policy from time to time to reflect changes in its products, data practices, technology, contractual arrangements or applicable law.

The revised Policy will be published through the relevant website or otherwise communicated where appropriate. The "Last Updated" date will be revised when a material update is published.

Where required by applicable law, EternaX will provide additional notice, seek renewed consent or take other action before implementing a material change.

A revision to this Policy does not automatically amend a separate contract. Any contractual amendment must be made in accordance with the applicable agreement.

Individuals and Customers are encouraged to review the Policy periodically to understand how it applies to their interactions with EternaX.

Questions, concerns or requests relating to this Privacy Policy or EternaX's own processing of personal data may be submitted through the following channel:

• Privacy Email: [Insert Official Privacy Email Address]

• Postal Address: A 2, 8, Africa Ave, Block A 2, Safdarjung Enclave, New Delhi, Delhi 110029

• Website: https://eternax.in

When contacting EternaX, please provide a concise description of the matter and enough information to identify the relevant service or interaction. Do not include passwords, API secrets, full payment credentials or unnecessary sensitive information in the initial communication.

Where the matter concerns data processed through a bank, NBFC, merchant or other institutional Customer, EternaX may need to coordinate with that Customer or direct the request to the appropriate party, subject to applicable law.

EternaX will assess and handle privacy-related communications in accordance with the relevant legal requirements, contractual responsibilities and available information.

If any provision of this Policy is found to be invalid, unenforceable or inconsistent with mandatory applicable law, that provision will be interpreted or limited to the extent necessary to give effect to the applicable law. The remaining provisions will continue to apply to the extent legally permissible.

Nothing in this Policy is intended to exclude, restrict or waive a statutory right or obligation that cannot lawfully be excluded, restricted or waived.

This Privacy Policy should be read together with the relevant EternaX terms and conditions, master service agreement, order form, service-level agreement, data processing agreement, information-security schedule, product documentation and other applicable contractual documents.

Those documents may provide additional details concerning:

• The parties' respective data-protection roles.

• Customer instructions and permitted processing.

• Security requirements and incident notifications.

• Subprocessors and third-party integrations.

• Data location and cross-border access.

• Retention, return, export and deletion.

• Audit rights and regulatory cooperation.

• Product-specific responsibilities and restrictions.

Where the parties have entered into a valid agreement that governs a specific processing activity, that agreement will be read together with this Policy, subject always to mandatory applicable law.

This Privacy Policy describes the intended framework for EternaX's handling of personal data. It does not guarantee that every listed product, technical control, integration or processing activity is available in every deployment.

EternaX's actual obligations and practices depend on its legal entity, the service supplied, the Customer's instructions, the information processed, the relevant contract and applicable law.

Before this Policy is published, EternaX should verify the accuracy of all statements concerning collection, sharing, hosting, security, retention, cookies, rights handling and incident response. Any statement that does not reflect an implemented practice should be amended or removed.