Privacy Policy

This Privacy Policy explains how ESOFTKING INFOTECH (GSTIN 19CVNPM7263B1Z9), operator of DioPe ("we", "us"), collects, uses, shares and protects your personal data. It is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act") as it comes into force. For the purposes of the DPDP Act, we are the Data Fiduciary and you are the Data Principal.

1. Data we collect

We do not collect your contacts, SMS inbox, call logs, photos (except images you choose to upload) or biometrics.

2. Why we use your data (purpose & lawful basis)

• To create and secure your account (OTP verification, PIN login, device binding, fraud prevention)
• To process recharges, bill payments, top-ups, fund transfers, commissions and settlements
• To meet legal duties: KYC, record keeping, tax (GST, TDS), and requests from law-enforcement or regulatory authorities
• For customer support and grievance handling
• To send service messages and, if you allow notifications, offers and announcements. You can turn off notifications in your phone settings.
• To improve the Platform using aggregated, non-identifying statistics

We process personal data on your consent, given when you register and use the Platform, and for the "legitimate uses" allowed under Section 7 of the DPDP Act, including compliance with law and performing the service you ask for.

3. Who we share it with

We never sell your personal data. We share only what is needed with:

• Recharge and bill-payment aggregators and operators: the customer number, operator, amount and, where needed, agent pincode or location, to complete transactions
• SMS gateway providers: your mobile number, to deliver OTPs
• Operator and plan lookup providers: the mobile number entered, to detect operator, circle and plans
• Google Firebase: your device token, to deliver push notifications
• Banks and payment systems: to verify top-ups and pay settlements
• Your upline (Distributor or Master Distributor): your name, shop, contact, status, Wallet balance and transaction summary, so they can manage their network
• Government, courts and regulators: when required by law, court order, or a lawful request under the IT Act, 2000, PMLA, 2002, tax laws or other applicable law

Our service providers may process data only on our instructions and must protect it. Data is stored on servers located in or accessible from India, in line with applicable law.

4. How we protect it

We follow reasonable security practices under Rule 8 of the SPDI Rules, including:

• HTTPS/TLS encryption for all traffic
• encryption at rest for Aadhaar and bank account numbers
• hashed PINs and OTPs
• rate limiting and automatic lockouts
• device-bound sessions
• role-based admin access with two-factor authentication and audit logs
• IP whitelisting with our partners

No system is completely secure. If a personal data breach occurs, we will tell affected users and the Data Protection Board of India / CERT-In as required by law.

5. How long we keep it

We keep account and transaction records while your account is active and for at least 5 years after the account closes or the transaction date, as required by the Prevention of Money-Laundering Act, 2002 and its Rules, and for the periods required by GST and income-tax laws (generally 6–8 years). Data no longer needed is deleted or anonymised. OTPs expire within minutes.

6. Your rights

Subject to applicable law, you may:

• access a summary of your personal data and how it is processed
• correct or update inaccurate data (most profile fields can be edited through support)
• withdraw consent or ask for erasure. This will close your account, and records that the law requires us to keep are retained for the required period.
• nominate another person to exercise your rights if you die or become incapacitated
• raise a grievance with our Grievance Officer, and after that, approach the Data Protection Board of India

To use these rights, write to the Grievance Officer from your registered mobile or email. We may verify your identity first.

7. Children

The Platform is for business users aged 18 or over. We do not knowingly collect data from children. If we learn that a child has registered, we will close the account.

8. Cookies

Our website and admin panel use only essential, security-related cookies (session and anti-forgery). We use no advertising or third-party tracking cookies.

9. Changes

We may update this policy. The updated version will be posted here with a new date, and material changes will be notified in the app.

10. Grievance Officer

As required by Rule 5(9) of the SPDI Rules and Rule 3(2) of the IT (Intermediary Guidelines) Rules, 2021, our Grievance Officer is Akshay Marjit (details below). Complaints are acknowledged within 24 hours and resolved within 15 days of receipt. See Grievance Redressal.

Contact