Privacy Policy

Introduction

Effective Date: [●]

Last Updated: [●]

This Privacy Policy (“Policy”) explains how GlocalPe collects, uses, processes, shares, stores and protects personal information through:

• the GlocalPe website;
• merchant and business onboarding;
• GlocalPe platforms and dashboards;
• APIs and integrations;
• payment and collection flows;
• customer support;
• compliance and verification processes;
• business communications;
• other services that expressly refer to this Policy.

This Policy should be read together with the applicable GlocalPe Terms & Conditions, Merchant / Business Terms, Cookie Policy, KYC / KYB Policy, AML / CFT Policy, Grievance Redressal Policy and other applicable service-specific documents.

1. WHO THIS POLICY APPLIES TO

This Policy may apply to:

• merchants and businesses using GlocalPe;
• prospective merchants and businesses;
• authorised representatives of businesses;
• beneficial owners and directors;
• authorised users of merchant accounts;
• customers or payers interacting with a GlocalPe-powered payment flow;
• persons receiving or sending information through GlocalPe services;
• website visitors;
• business partners;
• service providers;
• individuals communicating with GlocalPe;
• job applicants, where applicable.

Different categories of individuals may have different relationships with GlocalPe and therefore different data-processing arrangements may apply.

2. OUR ROLE IN PROCESSING PERSONAL INFORMATION

Depending on the service and the circumstances, GlocalPe may act as:

• a Data Fiduciary or equivalent controller where GlocalPe determines the purposes and means of processing;
• a Data Processor or equivalent service provider where GlocalPe processes information on behalf of a merchant or business;
• an independent controller/fiduciary for specific processing required for legal, regulatory, security, fraud-prevention or operational purposes.

The applicable role depends on:

• the service being provided;
• the contractual relationship;
• applicable law;
• the purpose of processing;
• the nature of the information.

A merchant's own privacy obligations toward its customers remain its responsibility where the merchant independently determines the purposes of processing.

3. INFORMATION WE COLLECT

Depending on the services used and the relationship with you, we may collect different categories of information.

3.1 Identity Information

This may include:

• name;
• date of birth, where required;
• nationality;
• government-issued identification information;
• KYC information;
• photographs or identification documents;
• signature or verification information.

3.2 Contact Information

This may include:

• email address;
• mobile number;
• business address;
• residential address where required;
• mailing address;
• other contact information.

3.3 Business and Professional Information

For merchants and businesses, this may include:

• business name;
• legal entity information;
• business address;
• registration information;
• nature of business;
• industry;
• website or application information;
• authorised representative information;
• director information;
• beneficial ownership information;
• business contact details.

3.4 KYC / KYB Information

Where required, we may collect information necessary for:

• Know Your Customer;
• Know Your Business;
• Customer Due Diligence;
• beneficial ownership verification;
• identity verification;
• sanctions screening;
• regulatory screening;
• risk assessment.

This may include documents and information required under applicable law or by our financial and regulatory partners.

3.5 Transaction Information

Depending on the service, we may process:

• transaction amount;
• currency;
• transaction date and time;
• transaction reference;
• payment status;
• settlement status;
• payer information;
• beneficiary information;
• merchant information;
• payment method;
• country or jurisdiction;
• purpose or description of transaction;
• refund information;
• dispute information;
• other transaction-related information.

3.6 Financial Information

Where necessary to provide our services, we may process information such as:

• bank account details;
• account holder information;
• IFSC or equivalent bank identifiers;
• settlement account information;
• payment instrument information;
• foreign exchange information;
• transaction-related financial information.

We seek to limit collection of financial information to what is reasonably necessary for the relevant service, compliance requirement or legitimate operational purpose.

3.7 Device and Technical Information

We may collect information such as:

• IP address;
• device type;
• operating system;
• browser;
• device identifiers;
• application information;
• network information;
• session information;
• login information;
• timestamps;
• technical logs.

This information may be used for security, fraud prevention, authentication, analytics and service operations.

3.8 Location Information

Depending on the service and applicable permissions, we may process approximate or other location-related information where necessary for:

• fraud prevention;
• security;
• regulatory requirements;
• transaction risk assessment;
• service functionality.

We do not seek precise location information unless it is necessary for a specific service and permitted by applicable law.

3.9 Communications

We may process information contained in:

• emails;
• support tickets;
• telephone communications;
• chat interactions;
• onboarding communications;
• other correspondence with GlocalPe.

4. HOW WE COLLECT INFORMATION

We may collect information:

• directly from you;
• from your business or employer;
• through GlocalPe onboarding;
• through GlocalPe payment flows;
• through APIs;
• through merchant integrations;
• from financial institutions and payment partners;
• from KYC/KYB providers;
• from fraud and risk-management providers;
• from sanctions-screening providers;
• from public or government sources where permitted;
• automatically through Website and Platform technologies;
• from other authorised sources.

5. WHY WE PROCESS PERSONAL INFORMATION

GlocalPe may process personal information for purposes including:

Providing Services

• onboarding businesses;
• enabling cross-border payments;
• facilitating international collections;
• supporting foreign exchange-related services;
• processing transactions;
• supporting settlement;
• managing merchant accounts;
• providing APIs and technology services.

Verification and Compliance

• KYC;
• KYB;
• customer due diligence;
• beneficial ownership verification;
• sanctions screening;
• regulatory reporting;
• AML/CFT compliance;
• transaction monitoring.

Fraud and Risk Management

• detecting suspicious transactions;
• preventing fraud;
• assessing transaction risk;
• preventing account abuse;
• protecting users and partners;
• investigating suspected financial crime.

Security

• securing accounts;
• protecting systems;
• detecting unauthorised access;
• monitoring security events;
• preventing cyberattacks.

Customer Support

• responding to enquiries;
• resolving disputes;
• investigating transactions;
• handling complaints;
• providing technical support.

Business Operations

• reconciliation;
• accounting;
• auditing;
• reporting;
• service analytics;
• operational management;
• improving our Platform.

Legal and Regulatory Requirements

• complying with applicable laws;
• complying with regulatory requirements;
• responding to lawful requests;
• maintaining required records;
• supporting investigations;
• enforcing legal rights.

6. LEGAL BASES / LAWFUL GROUNDS

Depending on the applicable legal framework and circumstances, GlocalPe may process personal information based on:

• consent;
• performance of a contract;
• steps taken at your request before entering into a contract;
• compliance with legal or regulatory obligations;
• legitimate and lawful purposes;
• fraud prevention and security;
• protection of legal rights;
• other lawful grounds available under applicable law.

Where consent is required, GlocalPe will obtain consent through an appropriate mechanism.

7. CROSS-BORDER PAYMENTS

GlocalPe facilitates or supports cross-border payment and foreign-exchange-related services.

As a result, transaction information may need to be processed by:

• banks;
• authorised dealers;
• payment networks;
• payment partners;
• correspondent institutions;
• financial institutions;
• regulated service providers;
• technology and infrastructure providers.

Such processing may involve jurisdictions outside India depending on the transaction, currency, payment route and applicable regulatory requirements.

8. FINANCIAL AND REGULATED PARTNERS

Depending on the applicable service, GlocalPe may work with:

• banks;
• authorised dealer banks;
• payment institutions;
• payment aggregators;
• payment processors;
• foreign-exchange providers;
• KYC/KYB providers;
• fraud-prevention providers;
• other regulated or authorised entities.

These parties may process personal information independently or on behalf of GlocalPe depending on the nature of their relationship and applicable law.

9. PAYMENT SYSTEM DATA

Where applicable regulatory requirements impose data storage or localisation obligations on payment-system data, GlocalPe will handle such information in accordance with the applicable requirements.

Certain cross-border transactions may require limited transmission or access outside India for the purpose of routing or completing an international transaction.

Such processing will be structured in accordance with applicable regulatory and data-protection requirements.

10. INTERNATIONAL DATA TRANSFERS

GlocalPe may use service providers, financial partners, technology infrastructure or payment networks located in jurisdictions outside India.

Personal information may therefore be:

• transferred;
• stored;
• accessed;
• processed

outside India where necessary for the provision of services, transaction processing, fraud prevention, security, compliance or other lawful purposes.

Where applicable, GlocalPe will implement safeguards required by applicable law.

International transfers may also be subject to applicable regulatory requirements concerning financial or payment data.

11. DATA SHARING

GlocalPe may share personal information, where necessary and permitted, with:

• banks;
• authorised dealer banks;
• payment service providers;
• payment networks;
• financial institutions;
• merchants;
• business customers;
• KYC/KYB providers;
• fraud-prevention providers;
• sanctions-screening providers;
• technology providers;
• cloud and infrastructure providers;
• professional advisers;
• auditors;
• insurers;
• regulators;
• government authorities;
• law-enforcement agencies;
• other service providers and partners necessary to provide the services.

12. SHARING WITH MERCHANTS AND BUSINESS CUSTOMERS

Where GlocalPe processes information in connection with a merchant or business customer's payment flow, certain transaction or payment information may be shared with that merchant or business as necessary to:

• complete a transaction;
• confirm payment;
• provide goods or services;
• process refunds;
• handle disputes;
• comply with legal obligations.

The merchant may have its own independent privacy obligations.

You should review the merchant's privacy notice for information about processing that it performs independently of GlocalPe.

13. KYC / KYB AND VERIFICATION PROVIDERS

GlocalPe may use specialised providers for:

• identity verification;
• business verification;
• document verification;
• beneficial ownership verification;
• sanctions screening;
• fraud screening;
• risk assessment.

Information may be shared with these providers only to the extent reasonably necessary for the applicable purpose and subject to applicable law.

14. AML / CFT AND FINANCIAL CRIME PREVENTION

GlocalPe may process personal information to:

• detect money laundering;
• prevent terrorist financing;
• identify suspicious transactions;
• comply with sanctions requirements;
• conduct transaction monitoring;
• perform enhanced due diligence;
• comply with applicable financial-crime laws.

Certain information may be retained or disclosed where required by applicable law even where you request deletion.

15. FRAUD PREVENTION

We may use information including:

• transaction information;
• device information;
• IP information;
• behavioural information;
• identity information;
• location-related information;
• historical transaction information;

to identify suspicious activity and prevent fraud.

Fraud-prevention decisions may involve automated tools, risk models or third-party services.

Where required by applicable law, appropriate mechanisms will be provided for exercising applicable rights.

16. AUTOMATED RISK ASSESSMENT

Certain transactions or accounts may be subject to automated or technology-assisted risk assessment.

This may be used to:

• identify potentially fraudulent transactions;
• detect unusual behaviour;
• support compliance screening;
• determine whether additional verification is required.

Automated tools may generate risk indicators or alerts that are reviewed or acted upon in accordance with applicable procedures and law.

17. DATA RETENTION

GlocalPe retains personal information only for as long as reasonably necessary for the purposes for which it is processed, or longer where required or permitted by:

• applicable law;
• regulatory requirements;
• AML/CFT requirements;
• tax requirements;
• accounting requirements;
• payment-network rules;
• dispute resolution;
• fraud prevention;
• security requirements;
• legal proceedings.

Financial and transaction records may therefore need to be retained for prescribed periods even after an account or business relationship ends.

18. DELETION

Where legally available, you may request deletion of personal information.

However, GlocalPe may be required to retain certain information because of:

• regulatory obligations;
• KYC requirements;
• AML/CFT requirements;
• tax obligations;
• transaction records;
• fraud prevention;
• legal claims;
• regulatory investigations.

Where retention is legally required, the relevant information will be retained only for the applicable period and handled in accordance with applicable requirements.

19. DATA SECURITY

GlocalPe takes reasonable technical and organisational measures designed to protect personal information.

Depending on the nature of the information and service, measures may include:

• encryption;
• access controls;
• authentication;
• monitoring;
• logging;
• vulnerability management;
• secure development practices;
• incident response;
• backup and recovery;
• employee and vendor controls.

No internet-based system or electronic transmission can be guaranteed to be completely secure.

20. SECURITY INCIDENTS

GlocalPe maintains processes to identify, assess, contain, investigate and respond to security incidents.

Where an incident involving personal information triggers notification requirements under applicable law or regulation, GlocalPe will take the required steps.

21. COOKIES AND SIMILAR TECHNOLOGIES

GlocalPe may use:

• cookies;
• pixels;
• SDKs;
• local storage;
• device identifiers;
• analytics technologies;
• similar technologies.

These may be used for:

• authentication;
• security;
• fraud prevention;
• analytics;
• Website functionality;
• performance;
• preferences;
• communications where permitted.

Please refer to the GlocalPe Cookie Policy for additional information.

22. BUSINESS USERS AND MERCHANT DATA

Where you represent or operate a business using GlocalPe, we may process information about:

• the business;
• directors;
• beneficial owners;
• authorised signatories;
• employees;
• representatives;
• account administrators.

Business users are responsible for ensuring that information they provide to GlocalPe is accurate and that they have the appropriate authority to provide information concerning other individuals.

23. END-CUSTOMER DATA

Where you make a payment or interact with a business using GlocalPe, GlocalPe may process information necessary to:

• authenticate or facilitate the transaction;
• prevent fraud;
• process refunds;
• manage disputes;
• maintain security;
• comply with legal and regulatory requirements.

Where GlocalPe processes information solely on behalf of the merchant, the merchant may remain responsible for determining the purposes of that processing.

24. CHILDREN

GlocalPe's business and payment services are generally not directed toward children.

We do not knowingly collect personal information from children in violation of applicable law.

Where a service is subject to age or eligibility restrictions, those restrictions apply regardless of this Policy.

25. MARKETING AND COMMUNICATIONS

Where permitted by law, GlocalPe may use contact information to communicate with you regarding:

• services;
• account activity;
• security;
• support;
• service updates;
• relevant business communications.

Where consent is required for promotional communications, GlocalPe will obtain appropriate consent.

You may opt out of optional promotional communications through the available mechanism.

Service, security, compliance and transaction-related communications may continue where necessary.

26. THIRD-PARTY WEBSITES AND SERVICES

GlocalPe may link to or integrate with third-party websites, applications and services.

Third parties may have their own:

• privacy policies;
• terms;
• security practices;
• data-processing practices.

GlocalPe is not responsible for independent processing performed by third parties outside its control.

27. CORPORATE TRANSACTIONS

Personal information may be disclosed or transferred in connection with:

• mergers;
• acquisitions;
• investments;
• financing;
• restructuring;
• sale or transfer of assets;
• corporate reorganisations;
• other legitimate business transactions.

Any such processing will be subject to applicable law and appropriate safeguards.

28. LEGAL AND REGULATORY DISCLOSURES

GlocalPe may disclose personal information where necessary or permitted to:

• regulators;
• government authorities;
• law-enforcement agencies;
• courts;
• tax authorities;
• financial intelligence or other competent authorities;
• payment networks;
• authorised financial institutions;

where required or permitted by applicable law.

29. YOUR PRIVACY RIGHTS

Subject to applicable law, you may have rights relating to your personal information, which may include:

• requesting information about processing;
• requesting access to personal information;
• requesting correction of inaccurate information;
• requesting deletion where legally available;
• withdrawing consent where processing is based on consent;
• raising a grievance;
• exercising other rights available under applicable law.

The scope and availability of these rights may depend on:

• your relationship with GlocalPe;
• the nature of the processing;
• applicable law;
• whether GlocalPe acts as a Data Fiduciary or Data Processor.

30. EXERCISING YOUR RIGHTS

Privacy requests may be submitted to:

Privacy Contact: [●]

Email: [●]

Please provide sufficient information to allow us to identify the relevant relationship or request.

We may need to verify your identity before processing certain requests.

31. DATA PROTECTION OFFICER

Where required under applicable law, GlocalPe may designate a Data Protection Officer or equivalent responsible person.

Name: [●]

Designation: [●]

Email: [●]

Contact: [●]

32. GRIEVANCE REDRESSAL

If you have a question, concern or complaint concerning the processing of your personal information, you may contact:

Grievance Officer: [●]

Email: [●]

Privacy Contact: [●]

GlocalPe will review and respond to grievances in accordance with applicable law and its applicable grievance procedures.

33. MERCHANT PRIVACY RESPONSIBILITIES

Where a merchant independently determines the purposes and means of processing customer information, the merchant remains responsible for its own privacy obligations.

Merchants using GlocalPe should:

• provide appropriate privacy notices to their customers;
• collect information lawfully;
• provide appropriate disclosures;
• obtain consent where required;
• respond to applicable customer requests;
• use GlocalPe services in accordance with applicable law and contract.

34. INTERNATIONAL CUSTOMERS

If you access or use GlocalPe services from outside India, your personal information may be processed in India and other jurisdictions as necessary to provide the relevant service.

The laws applicable to processing may differ between jurisdictions.

GlocalPe will process personal information in accordance with applicable legal and regulatory requirements.

35. REGULATORY DATA LOCALISATION

Where applicable laws or regulatory directions require particular categories of payment or financial data to be stored in India or otherwise impose localisation requirements, GlocalPe will comply with those requirements.

Cross-border transmission may occur where permitted and necessary for the processing or routing of international transactions.

36. ACCURACY OF INFORMATION

You are responsible for providing accurate and current information where you directly provide information to GlocalPe.

Incorrect or incomplete information may affect:

• onboarding;
• KYC/KYB;
• transaction processing;
• settlement;
• fraud screening;
• regulatory compliance.

37. CHANGES TO THIS PRIVACY POLICY

GlocalPe may update this Policy from time to time to reflect:

• changes in services;
• changes in technology;
• changes in processing activities;
• changes in financial partners;
• changes in regulatory requirements;
• changes in applicable law.

Material changes may be communicated through appropriate channels where required.

The latest version will be published on the GlocalPe Website with the revised “Last Updated” date.

38. RELATED POLICIES

This Policy should be read together with applicable GlocalPe policies and documents, including:

• Terms & Conditions;
• Merchant / Business Terms;
• Cookie Policy;
• KYC / KYB Policy;
• AML / CFT Policy;
• Prohibited / Restricted Activities Policy;
• Security & Responsible Disclosure Policy;
• Grievance Redressal Policy;
• other product-specific disclosures.

39. GOVERNING LAW

This Policy is governed by the laws of India, subject to applicable mandatory requirements concerning individuals located in other jurisdictions.

Nothing in this Policy limits any statutory or regulatory right or remedy that cannot lawfully be limited.

40. CONTACT US

GlocalPe [FULL LEGAL ENTITY NAME]

Privacy Contact: [●]

Data Protection Officer: [●]

Grievance Officer: [●]

Security Contact: [●]

Email: [●]

Telephone: [●]

Registered Office: [●]

Website: [●]

Policy Version: [●]

Effective Date: [●]

Last Updated: [●]