Privacy Policy

GET-PAID – A SaaS PRODUCT OF CONTRACT BAZAAR

Lex Mores Tech Private Limited (brand name: “Contract Bazaar”)

Effective Date: 19.08.2026

Last Updated: 19.08.2026

INTRODUCTION
1. This Privacy Policy (“Privacy Policy”) explains how Lex Mores Tech Private Limited, operating under the brand name “Contract Bazaar” (“Company”, “we”, “us” or “our”), having its registered office at Block 1, Dynamic House, Block I, Sector 41, Noida, Uttar Pradesh 201303, collects, receives, uses, stores, processes, discloses and protects Personal Data in connection with its SaaS product “Get-Paid” (“Get-Paid” or “Platform”), including the mobile application and/or website through which Get-Paid is made available.
2. Get-Paid is intended primarily for Micro and Small Enterprises, including Manufacturers and Service Providers covered under the applicable provisions of the Micro, Small and Medium Enterprises Development Act, 2006 (“MSME Act”) (“Users”), and enables such Users to provide information relating to their business, clients, invoices and payment obligations for the purpose of facilitating documentation, payment-related reminders, payment timelines and related services through the Platform.
3. This Privacy Policy applies to Personal Data processed by the Company in connection with Get-Paid, including Personal Data relating to:
  1. Manufacturers and Service Providers using Get-Paid;
  2. proprietors, partners, directors, employees, representatives and authorised persons of such Users; and
  3. clients, customers, representatives or other individuals whose Personal Data is provided through Get-Paid by a User (“Client Data Subjects”).
4. This Privacy Policy shall comply with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) and other applicable data protection laws, as amended or replaced from time to time.
5. This Privacy Policy is to be read together with the Company’s Terms & Conditions and Refund and Cancellation Policy. The notice required under Section 5 of the DPDP Act is set out separately at Clause 8 and is provided to the Data Principal independently of these documents.
DEFINITIONS: For the purposes of this Privacy Policy:
1. “Personal Data” shall mean any data about an individual who is identifiable by or in relation to such data, that is collected, received, shared, submitted or otherwise processed by or through the Platform in connection with the services subscribed to by the User, and shall have the meaning assigned to it under the DPDP Act.
2. “Client Data” shall mean Personal Data and other information relating to a Client of the User, including the identity, contact, business, invoice, payment and communication details of the Client and of the individuals associated with the Client, which is submitted, uploaded or otherwise provided by the User through the Platform.
3. “Data Principal” shall have the meaning assigned to it under the DPDP Act and shall generally refer to the individual to whom the Personal Data relates.
4. “Data Fiduciary” shall have the meaning assigned to it under the DPDP Act.
5. “Data Processor” shall have the meaning assigned to it under the DPDP Act and shall include a person or entity processing Personal Data on behalf of a Data Fiduciary.
6. “Data Protection Board” means the Data Protection Board of India established under the DPDP Act.
7. “Processing” shall have the meaning assigned to it under applicable law and shall include collection, storage, use, disclosure, transmission, alteration, retrieval or deletion of Personal Data.
APPLICABILITY OF THE DPDP ACT AND ALLOCATION OF ROLES
1. The Company shall process Personal Data in accordance with the DPDP Act, the DPDP Rules and the regulations, notifications and directions issued thereunder, to the extent applicable to the relevant processing activity.
2. Where the Company acts as a Data Fiduciary. In relation to Personal Data of Users and of the proprietors, partners, directors, employees and authorised representatives of Users – including account, authentication, subscription, billing, support and usage information – the Company determines the purpose and means of processing and acts as a Data Fiduciary.
3. Where the Company acts as a Data Processor. In relation to Client Data submitted by a User, the User determines the purpose and means of processing and acts as the Data Fiduciary, and the Company processes such Client Data as a Data Processor on the User’s documented instructions, which instructions are constituted by the Terms & Conditions and the User’s use of the Platform.
4. In its capacity as a Data Processor, the Company shall process Client Data only for the purpose of providing the Platform, shall implement the security safeguards described in Clause 18, shall impose equivalent obligations on any sub-processor engaged by it, shall notify the User without undue delay of any personal data breach affecting Client Data, and shall delete or return Client Data on expiry or termination in accordance with Clause 20.
5. Where a User provides Personal Data of its clients or other individuals to the Company, the User shall be responsible for ensuring that it has the necessary authority, notice, consent or other lawful basis to provide such Personal Data to the Company.
6. Nothing in this Privacy Policy shall restrict any right available to a Data Principal under applicable law.
PERSONAL DATA COLLECTED: Depending upon the manner in which Get-Paid is used, the Company may collect and process the following categories of Personal Data.
1. User Information, including:
  1. name;
  2. business/enterprise name;
  3. business constitution and relevant business details;
  4. registered and/or business address;
  5. mobile number;
  6. WhatsApp number;
  7. email address;
  8. details of proprietors, partners, directors, employees or authorised representatives;
  9. MSME/Udyam registration details, where provided;
  10. GST and other business registration details, where relevant;
  11. account and login information; and
  12. information provided in communications with the Company.
2. Client Information. Where a User provides information relating to its clients, the Company may process:
  1. name of the client;
  2. name and details of proprietor, partner, director, authorised representative or other relevant individual;
  3. business and contact details;
  4. mobile and WhatsApp number;
  5. email address;
  6. billing and communication details;
  7. invoice number and invoice date;
  8. invoice amount;
  9. payment due date;
  10. payment status and outstanding amount;
  11. payment history and related information;
  12. information appearing in documents uploaded or generated through Get-Paid;
  13. information required for electronic signing/e-signing; and
  14. other Personal Data reasonably necessary for providing the relevant Platform functionality.
3. Subscription, Payment and Billing Information, including:
  1. the Subscription plan selected and the free trial and subscription history;
  2. transaction, order and payment reference identifiers;
  3. the reference number, maximum amount and validity period of any recurring payment instruction or e-mandate;
  4. tokenised payment method identifiers made available by the payment service provider (the Company does not store complete card numbers);
  5. invoices, receipts and tax records issued to the User; and
  6. refund, cancellation and chargeback records.
4. Technical and Usage Information, collected automatically, including:
  1. IP address;
  2. device type;
  3. operating system;
  4. browser and application information;
  5. application version;
  6. access logs;
  7. date and time of access;
  8. device identifiers, where applicable;
  9. crash reports and diagnostic information; and
  10. other technical information reasonably necessary for security, maintenance and operation of the Platform.
5. Communication Information. The Company may process information contained in communications with the Company, including customer support requests, complaints, feedback and other correspondence, in order to provide the services associated with the Platform.
SOURCES OF PERSONAL DATA
1. The Company may collect Personal Data:
  1. directly from the User;
  2. from information submitted by the User concerning its clients or other individuals;
  3. through the use of Get-Paid;
  4. from electronic signing/e-sign service providers;
  5. from payment, communication, authentication, hosting and other technology service providers; and
  6. from other lawful sources, where permitted under applicable law.
2. Where Personal Data relating to a Client Data Subject is provided by a User, the Company may rely on the User to ensure that the information has been lawfully obtained and that the User has the necessary authority to provide such information to the Company.
PURPOSES OF PROCESSING PERSONAL DATA: The Company may process Personal Data for the following purposes:
1. creating and administering User accounts;
2. providing and operating Get-Paid, including during a free trial;
3. generating and managing payment-related documentation;
4. incorporating payment timelines and related information into documents;
5. facilitating payment-related reminders and communications;
6. facilitating electronic signing/e-signing of documents;
7. processing subscription fees, renewals, cancellations and refunds, and sending pre-debit and post-debit notifications;
8. maintaining records of invoices, payment information, documents and communications;
9. authenticating Users and securing accounts;
10. providing customer support and responding to queries and grievances;
11. detecting, preventing and investigating fraud, misuse, unauthorised access and security incidents;
12. maintaining and improving the functionality, performance and security of Get-Paid;
13. conducting analytics using aggregated or anonymised information;
14. complying with applicable laws, regulations, governmental directions and legal processes;
15. establishing, exercising or defending the Company’s legal rights;
16. maintaining appropriate business and technical records; and
17. such other purposes as may be communicated to the relevant Data Principal and permitted under applicable law.
LAWFUL BASIS FOR PROCESSING
1. The Company shall process Personal Data only for lawful purposes and on a basis permitted under the DPDP Act.
2. Processing based on consent. The Company relies on the consent of the Data Principal for processing relating to account creation and administration, payment reminders and communications, electronic signing, optional product communications, and non-essential cookies and analytics.
3. Processing based on legitimate uses. The Company relies on the legitimate uses recognised under Section 7 of the DPDP Act where processing is necessary for compliance with law, for responding to a medical or safety emergency, for the performance of a legal obligation to disclose information, or for such other legitimate use as is specified under the DPDP Act.
4. Consent obtained by the Company shall be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the Personal Data necessary for the specified purpose.
5. The Company shall maintain records of consent, including the date and time of consent, the version of the notice presented, the purpose of processing and the manner in which consent was obtained.
6. The Company may accept, verify or manage consent through a Consent Manager registered with the Data Protection Board, where such facility is used by the Data Principal.
NOTICE TO DATA PRINCIPALS
1. Before or at the time of seeking consent, the Company shall provide the Data Principal with a standalone notice, in clear and plain language and independent of any other document, setting out:
  1. an itemised description of the Personal Data sought to be collected;
  2. the specific purpose for which such Personal Data is to be processed;
  3. the manner in which the Data Principal may withdraw consent, with the same ease with which it was given;
  4. the manner in which the Data Principal may exercise the rights described in Clause 21; and
  5. the manner in which the Data Principal may make a complaint to the Data Protection Board of India.
2. The notice shall be made available in English and in any language specified in the Eighth Schedule to the Constitution of India, at the option of the Data Principal.
3. Where processing was commenced on the basis of consent obtained before the commencement of the applicable provisions of the DPDP Act, the Company shall provide the notice required under applicable law as soon as reasonably practicable.
WITHDRAWAL OF CONSENT
1. A Data Principal may withdraw consent at any time, through the facility made available on the Platform or by contacting the Data Protection Officer named in Clause 26.
2. Withdrawing consent shall be as easy as giving consent, and shall not require the Data Principal to provide a reason.
3. Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal.
4. Upon withdrawal of consent, the Company shall, within a reasonable time, cease processing the relevant Personal Data and shall cause any Data Processor engaged by it to do the same, unless retention or continued processing is required or permitted under applicable law.
5. The Data Principal acknowledges that withdrawal of consent may result in the loss of access to certain Platform features or information where such Personal Data is necessary for the relevant service, and may result in the discontinuation of the service.
USER RESPONSIBILITY IN RELATION TO CLIENT DATA
1. A User shall provide only such Client Data as is reasonably necessary for using the relevant functionality of Get-Paid.
2. The User shall ensure that Client Data provided to the Company is accurate, complete and lawfully obtained.
3. The User shall, where required under applicable law, inform its clients or other relevant individuals that their Personal Data may be processed through Get-Paid.
4. The User shall obtain any consent or other lawful authorisation required for providing Client Data to the Company, including any consent required for sending commercial communications to a Client.
5. The Company shall not knowingly require a User to provide unnecessary Personal Data of its clients.
DATA MINIMISATION AND PURPOSE LIMITATION
1. The Company shall collect and process only such Personal Data as is reasonably necessary for the purposes for which it is processed.
2. Personal Data shall not knowingly be used for purposes unrelated to the purpose for which it was collected, except where such further processing is permitted under applicable law or is based on an appropriate lawful basis.
3. The Company shall not intentionally seek sensitive or excessive Personal Data unless such information is reasonably necessary for a specific service or is otherwise permitted under applicable law.
DOCUMENTS, INVOICES AND PAYMENT INFORMATION
1. Get-Paid may process documents and information submitted or generated through the Platform, including invoices, payment details, payment due dates, payment status, contractual/payment terms and related information.
2. Such information may contain Personal Data relating to Users, clients or other individuals.
3. The Company shall process such information for providing the relevant Platform services, maintaining records, providing support, securing the Platform, complying with applicable law and other purposes specified in this Privacy Policy.
PAYMENT REMINDERS AND COMMUNICATIONS
1. Where the relevant functionality is used, Get-Paid may facilitate payment-related reminders and communications through email, WhatsApp, SMS, mobile notifications or other communication channels.
2. For this purpose, the Company may process the relevant mobile number, WhatsApp number, email address, communication history, delivery information and other information necessary to facilitate such communications.
3. Communications to a Client are sent on the instructions of, and on behalf of, the User. The User shall ensure that the contact information provided is accurate and that the Company is authorised to use such information for the relevant communication.
4. Each communication sent to a Client shall include a means by which the recipient may object to or opt out of further communications. The Company shall give effect to such a request and shall inform the relevant User.
5. The Company may retain records relating to communications initiated through Get-Paid, including the date, time, recipient and delivery/status information, where available, for service administration, audit, security, dispute resolution and compliance purposes.
ELECTRONIC SIGNING AND E-SIGN INFORMATION
1. Get-Paid may facilitate electronic signing or e-signing of documents through the Platform.
2. For this purpose, the Company may process information necessary to identify and authenticate the relevant signatory and to facilitate and record the electronic execution of documents.
3. Where an external e-sign or electronic signature service provider is used, relevant Personal Data may be shared with such provider to the extent necessary to provide the service.
4. The processing of such information shall be subject to this Privacy Policy and, where applicable, the privacy terms of the relevant third-party service provider.
USE OF WHATSAPP AND THIRD-PARTY COMMUNICATION SERVICES
1. Where a WhatsApp number is provided, the Company may use such number for service-related communications, payment reminders, notifications, document-related communications, authentication and other purposes connected with Get-Paid.
2. Communications facilitated through WhatsApp or another third-party communication platform may also be subject to the privacy policy and terms of that third-party platform.
3. The Company shall not be responsible for the independent processing of Personal Data carried out by such third-party communication platforms.
SHARING AND DISCLOSURE OF PERSONAL DATA
1. The Company shall not sell or commercially trade Personal Data of Users or Client Data submitted through Get-Paid.
2. The Company may disclose or provide access to Personal Data to:
  1. hosting, cloud storage and infrastructure providers;
  2. electronic signing/e-sign providers;
  3. communication and messaging service providers;
  4. payment and subscription service providers;
  5. authentication and security service providers;
  6. analytics and technical service providers;
  7. professional advisers, auditors and consultants;
  8. governmental, regulatory, judicial or law enforcement authorities where required or permitted by law; and
  9. entities involved in a merger, acquisition, restructuring, sale or transfer of the Company’s business or assets, subject to applicable law.
3. Where third parties process Personal Data on behalf of the Company, such processing shall be undertaken under a valid contract imposing obligations of confidentiality, security, purpose limitation, breach notification and deletion or return of Personal Data, in accordance with the DPDP Act.
TRANSFER OF PERSONAL DATA OUTSIDE INDIA
1. Certain service providers engaged by the Company, including hosting, cloud, messaging, e-sign, analytics and support providers, may store or process Personal Data outside India.
2. The Company may transfer Personal Data outside India in accordance with Section 16 of the DPDP Act, provided that no such transfer shall be made to any country or territory in respect of which the Central Government has issued a restriction.
3. Where a transfer is made, the Company shall impose contractual obligations on the recipient requiring security safeguards and confidentiality no less protective than those set out in this Privacy Policy.
4. Any sector-specific requirement relating to the localisation of data within India shall continue to apply and shall prevail over this Clause.
DATA SECURITY
1. The Company shall implement reasonable security safeguards to protect Personal Data against unauthorised access, disclosure, alteration, loss, destruction or misuse, and to prevent a personal data breach.
2. Such measures shall include:
  1. encryption, obfuscation, masking or the use of virtual tokens, as appropriate to the data concerned;
  2. access controls and role-based restriction of access to the computer resources used to process Personal Data;
  3. authentication mechanisms;
  4. logging, monitoring and review of access, and retention of such logs and personal data for a period of not less than one (1) year, unless a longer period is required under applicable law, for the purpose of detecting and investigating unauthorised access;
  5. measures for continued processing in the event of a compromise, including data backups;
  6. secure infrastructure and periodic security testing; and
  7. incident response and recovery measures.
3. The Company shall impose reasonable security safeguards by contract on any Data Processor engaged by it.
4. Access to Personal Data shall be limited to persons and service providers who require such access for legitimate purposes.
5. No electronic transmission or storage system can be guaranteed to be completely secure. Accordingly, while the Company shall take reasonable measures to protect Personal Data, absolute security cannot be guaranteed.
PERSONAL DATA BREACHES
1. The Company shall maintain procedures for identifying, assessing, responding to and mitigating personal data breaches and security incidents.
2. On becoming aware of a personal data breach, the Company shall intimate each affected Data Principal without delay, in clear and plain language, describing the nature, extent and timing of the breach, its likely consequences, the measures taken to mitigate risk, the safeguards the Data Principal may take, and the contact details of the person able to respond to queries.
3. The Company shall also intimate the Data Protection Board without delay, and shall furnish to the Board, within seventy-two (72) hours of becoming aware of the breach or such longer period as the Board may allow, the detailed particulars prescribed under the DPDP Rules, including the events leading to the breach, the circumstances, the remedial measures taken and the intimations given to affected Data Principals.
4. Nothing in this Clause shall affect any separate obligation of the Company to report a cyber security incident to the Indian Computer Emergency Response Team (CERT-In) within the timelines prescribed under the Information Technology Act, 2000 and directions issued thereunder.
5. The Company shall take reasonable steps to contain, investigate and remediate a personal data breach and prevent its recurrence.
RETENTION AND ERASURE OF PERSONAL DATA
1. The Company shall retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected or processed, or for such period as may be required or permitted under applicable law.
2. Following expiry or termination of a User’s Get-Paid subscription, or expiry of a free trial which does not convert into a paid subscription, or closure or prolonged inactivity of an Account, the Company shall retain the relevant Personal Data for a period of one (1) year, unless a longer period is required or permitted under applicable law.
3. Notwithstanding Clause 20.2, records relating to invoices, payments, communications sent to Clients, subscription transactions and tax compliance shall be retained for a period of three (3) years, being a period aligned with the limitation period applicable to contractual claims under the Limitation Act, 1963, and with the Company’s obligations under applicable tax law.
4. The Company may retain Personal Data beyond such period where necessary for:
  1. compliance with a legal or regulatory obligation;
  2. establishment, exercise or defence of legal claims;
  3. prevention, detection or investigation of fraud or security incidents; or
  4. any other purpose for which continued retention is permitted under applicable law.
5. Personal Data shall be erased where the Data Principal withdraws consent, or where the specified purpose is no longer being served and retention is not necessary for a legal purpose.
6. The Company shall give the relevant Data Principal not less than forty-eight (48) hours’ advance notice before Personal Data is erased on account of the expiry of a retention period, so as to enable the Data Principal to log in to its account or otherwise contact the Company in order to re-initiate the specified purpose.
7. Upon expiry of the applicable retention period, the Company shall delete or anonymise the relevant Personal Data, subject to applicable law.
8. Backup copies may remain in routine backup or disaster recovery systems for a limited period and shall be deleted or overwritten in accordance with the Company’s applicable backup cycle.
RIGHTS OF DATA PRINCIPALS
1. Subject to applicable law, a Data Principal has the following rights in respect of Personal Data processed by the Company as a Data Fiduciary:
  1. Right to access information – to obtain a summary of the Personal Data being processed, the processing activities undertaken, and the identities of other Data Fiduciaries and Data Processors with whom the Personal Data has been shared;
  2. Right to correction, completion and updating – to have inaccurate or misleading Personal Data corrected, incomplete Personal Data completed, and Personal Data updated;
  3. Right to erasure – to have Personal Data erased, unless retention is necessary for the specified purpose or for compliance with applicable law;
  4. Right of grievance redressal – to a readily available means of registering a grievance with the Company; and
  5. Right to nominate – to nominate another individual who shall, in the event of the Data Principal’s death or incapacity, exercise the rights of the Data Principal under the DPDP Act.
2. A request may be made through the Platform or by contacting the Data Protection Officer named in Clause 26.
3. The Company shall respond to a request within a reasonable period and in any event within ninety (90) days of receipt, or such shorter period as may be prescribed.
4. The Company may require reasonable identity and authority verification before acting upon a request.
5. Where a request concerns Personal Data relating to a Client Data Subject, the Company shall, in its capacity as Data Processor, forward the request to the relevant User and assist the User in responding to it. The Company may require the request to be made by the relevant Data Principal or by a person demonstrating appropriate authority.
6. Erasure of Personal Data may result in the loss of access to certain Platform features or information where such Personal Data is necessary for the relevant service.
DUTIES OF DATA PRINCIPALS: A Data Principal shall comply with applicable law when exercising rights under the DPDP Act, and in particular shall not impersonate another person, suppress material information, register a false or frivolous grievance or complaint, or furnish false particulars in exercising the right to correction or erasure.
ACCOUNT AND ACCESS SECURITY
1. Users shall be responsible for maintaining the confidentiality of their account credentials and for taking reasonable steps to prevent unauthorised access to their accounts.
2. Users shall promptly notify the Company of any suspected unauthorised access, loss of credentials or compromise of their account.
3. The Company may temporarily restrict access to an account where reasonably necessary to protect Personal Data, investigate unauthorised activity or maintain the security of Get-Paid.
COOKIES AND SIMILAR TECHNOLOGIES
1. The website and/or mobile application may use cookies, local storage, software development kits, analytics tools and similar technologies, which fall into the following categories:
  1. Strictly necessary – required to maintain user sessions, enable authentication and secure the Platform. These cannot be disabled.
  2. Functional – used to remember preferences and improve usability.
  3. Analytics – used to understand usage patterns, diagnose technical issues and improve the Platform.
2. The Company shall obtain consent through a cookie banner or equivalent mechanism before placing non-essential cookies or similar technologies, and the Data Principal may withdraw or modify that consent at any time through the same mechanism.
CHILDREN’S PERSONAL DATA
1. Get-Paid is intended for businesses and business users and is not directed towards children. Access to the Platform is restricted to individuals aged eighteen (18) years and above.
2. The Company does not knowingly collect Personal Data of children. Where processing of a child’s Personal Data is undertaken, it shall be undertaken only after obtaining verifiable consent of the parent or lawful guardian, in the manner prescribed under the DPDP Act and the DPDP Rules.
3. The Company shall not undertake any tracking or behavioural monitoring of children, or any targeted advertising directed at children, and shall not undertake processing likely to cause a detrimental effect on the well-being of a child.
4. The same protections shall apply to persons with disabilities who have a lawful guardian, whose Personal Data shall be processed only with the consent of that guardian.
5. If the Company becomes aware that Personal Data of a child has been collected in contravention of applicable law, it shall take reasonable steps to delete such information.
GRIEVANCE REDRESSAL AND DATA PROTECTION CONTACT
1. The Company has designated the following person to answer questions concerning the processing of Personal Data and to receive grievances under this Privacy Policy:
  1. Name: Vasudha Bhat
  2. Designation: Grievance Officer/General Manager
  3. Email: INFO@YOUGETPAID.CO.IN
  4. Telephone: +919560244438
2. A grievance shall be acknowledged within forty-eight (48) hours of receipt and shall be redressed within ninety (90) days of receipt, or such shorter period as may be prescribed under applicable law.
3. The Company shall maintain a record of grievances received and the action taken in respect of each.
4. Where a Data Principal is not satisfied with the response of the Company, or where the Company fails to respond within the applicable period, the Data Principal may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act and the DPDP Rules.
AGGREGATED AND ANONYMISED DATA
1. The Company may create aggregated, statistical or anonymised information from Personal Data processed through Get-Paid, provided that such information does not identify or reasonably permit identification of an individual.
2. Such information may be used for analytics, product development, service improvement, security, research, business intelligence and other legitimate business purposes.
AUTOMATED PROCESSING
1. Certain features of Get-Paid involve automated processing, including document generation, workflow management, scheduling of reminders, notifications, and the classification or organisation of information.
2. The Company does not take any decision based solely on automated processing which produces legal effects concerning a Data Principal or which similarly significantly affects a Data Principal.
3. Automated processing shall be undertaken only for purposes connected with the operation of Get-Paid or otherwise permitted under applicable law.
THIRD-PARTY SERVICES AND LINKS
1. Get-Paid may contain integrations with or links to third-party services, including payment providers, electronic signature providers, messaging platforms, authentication services and other technology providers.
2. Such third parties may process Personal Data in accordance with their own privacy policies and terms.
3. The Company shall not be responsible for the independent privacy practices of third parties where such third parties determine their own purposes and means of processing.
CHANGES TO THIS PRIVACY POLICY
1. The Company may modify or update this Privacy Policy from time to time to reflect changes in Get-Paid, applicable law, technology, business practices or regulatory requirements.
2. Where required under applicable law, material changes shall be communicated through the Platform, website, registered email address or other appropriate means.
3. The updated Privacy Policy shall become effective from the date specified in the revised Privacy Policy.
GOVERNING LAW AND JURISDICTION
1. This Privacy Policy shall be governed by and interpreted in accordance with the laws of India, and the courts having jurisdiction over Noida, Uttar Pradesh, India shall have exclusive jurisdiction, subject to any dispute resolution mechanism agreed under the Terms & Conditions.
2. Nothing in this Privacy Policy shall exclude, restrict or limit any mandatory right, remedy or protection available to a Data Principal under applicable data protection law, including the right to make a complaint to the Data Protection Board of India.

CONSENT

The following confirmations are obtained separately and are not bundled with acceptance of any other document. Each is optional except where marked as necessary for the provision of the service.

[ ] I confirm that I have read and understood this Privacy Policy and the notice provided to me. (Acknowledgement)

[ ] I consent to the processing of my Personal Data for the purpose of creating and administering my account and providing Get-Paid. (Necessary for the service)

[ ] I consent to the Company sending payment reminders and related communications to the Clients whose details I submit. (Necessary for the reminder functionality)

[ ] I confirm that, where I provide Personal Data of my clients or other individuals through Get-Paid, I am authorised to provide such information to the Company and shall comply with applicable data protection requirements. (Warranty)

[ ] I consent to receiving product updates, offers and marketing communications from the Company. (Optional)

I understand that I may withdraw any consent given above at any time, with the same ease with which it was given, in the manner described in Clause 9.