1. Introduction

HiWi Forex Transaction Services Private Limited, a company incorporated under the Companies Act, 2013, with its registered office at 802, B Wing, 8th Floor, Naman Midtown, Senapati Bapat Marg, Dadar West, Mumbai – 400028, India (“HiWiPay”, “Company”, “we”, “our” or “us”), operates the HiWiPay platform and related services, including the website at www.hiwipay.com, the Student Portal, the EduCon Portal, and the Remitter Portal (collectively, the “Platform”).

This Privacy Policy (“Policy”) describes: (i) what Personal Data we collect, use, disclose, process, store, transfer, share, and safeguard; (ii) the manner and purpose for which we do so; (iii) the rights of Data Principals in relation to their Personal Data and how they may exercise those rights; and (iv) how Data Principals may raise complaints and grievances.

This Policy applies to Customers and Authorised Users of the Platform (collectively, “you” or “your(s)”) and to any Personal Data shared with us in connection with our Platform.

By accessing, registering on, or using the Platform or Services, you acknowledge that you have read, understood, and agreed to be bound by this Policy and the applicable Terms and Conditions. If you do not agree, please discontinue use of the Platform. Your continued use following updates to this Policy constitutes acceptance of the revised Policy. This Policy is accessible at all times from within the Platform and at www.hiwipay.com

2. Scope and Applicability

This Policy applies to all Personal Data (defined hereinafter) collected or processed by HiWiPay in connection with:

• the HiWiPay Platform and all portals, applications, and APIs connected thereto;
• Services provided to Customers and other authorised users;
• interactions with HiWiPay through the Platform, email, telephone, in-person, or any other communication channel; and
• Personal Data received from third parties in connection with the provision of Services.

This Policy does not apply to: (i) publicly accessible informational or marketing websites not requiring login; or (ii) data that has been irreversibly anonymised or aggregated such that it cannot reasonably identify any individual.

3. Definitions

Unless otherwise defined, the following terms carry the meanings set out below:

“Authorised User” means any individual authorised by a Customer to access and use the Platform or Services on behalf of the Customer.

“Consent” has the meaning assigned to it under the DPDP Act, meaning a free, specific, informed, unconditional, and unambiguous indication of agreement by a Data Principal through a clear affirmative action to the processing of her Personal Data for a specified purpose.

“Customer” means any individual, sole proprietor, partnership, company, or other entity that has registered for, subscribed to, or otherwise engaged the Services.

“Data Fiduciary” has the meaning assigned to it under the DPDP Act – any person who alone or in conjunction with other persons determines the purpose and means of processing of Personal Data.

“Data Principal” has the meaning assigned to it under the DPDP Act – the individual to whom the Personal Data relates.

“Data Processor” has the meaning assigned to it under the DPDP Act – any person who processes Personal Data on behalf of a Data Fiduciary.

“DPDP Act” means the Digital Personal Data Protection Act, 2023, and all rules, regulations, and guidelines issued thereunder, as amended from time to time.

“FEMA” means the Foreign Exchange Management Act, 1999 and rules and regulations made thereunder.

“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.

“Platform” means the HiWiPay website, portals (Student, EduCon, Remitter), mobile applications, APIs, and all related services and interfaces.

“PMLA” means the Prevention of Money Laundering Act, 2002, and rules and regulations made thereunder.

“RBI” means the Reserve Bank of India.

“Services” means the services provided by HiWiPay including cross-border remittance facilitation, forex transaction processing, partner integrations, payment processing, onboarding, education-remittance solutions, and related financial services.

“Sensitive Personal Data or Information” / “SPDI” means sensitive personal data or information as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011, including financial information (bank account, payment instrument details), passwords, and such other information classified as sensitive under applicable law.

4. Role of HiWiPay as Data Fiduciary

HiWiPay acts as the Data Fiduciary in respect of all Personal Data collected and processed in connection with the Platform. As a Data Fiduciary, HiWiPay determines the purposes and means of processing Personal Data and bears primary responsibility for compliance with the DPDP Act and applicable data protection laws.

Where HiWiPay engages third-party service providers to process Personal Data on its behalf (for example, cloud infrastructure providers or KYC verification vendors), such providers act as Data Processors under written agreements that impose data protection obligations no less protective than those set out in this Policy and the DPDP Act.

In connection with court-mandated identity verification processes or regulatory integrations, HiWiPay may receive or share Personal Data with government authorities or designated entities (such as UIDAI, NSDL, or RBI-authorised bodies) as required by law. In such cases, HiWiPay acts in accordance with applicable legal frameworks.

5. Personal Data We Collect
   

5.1. Data Provided Directly by You
When you register, transact, seek support, or otherwise interact with the Platform or Services, we may collect:
• identity and contact information, such as your full name, date of birth, gender, email address, mobile number, and residential / correspondence address;
• identity documents and KYC data, including PAN card, Aadhaar (Virtual ID / masked number only, unless otherwise required by law), passport, driving licence, or other government-issued identification, together with photographs where required;
• financial information, including bank account numbers, IFSC codes, IBAN/SWIFT/BIC details, payment instrument details, beneficiary details (name, account, bank, country), and transaction-specific data such as purpose code, amount, and currency;
• business or institutional information, such as institution name, registration number, authorised signatory details, and beneficial ownership information (for certain services on the Platform);
• communications with us, including enquiries, correspondence, support tickets, and any information provided through calls, email, or in-platform chat; and
• consent records and preference settings, including records of consent given, withdrawn, or modified.

5.2. Data Collected Automatically
When you access or use the Platform, we automatically collect certain technical and usage data, including:

• log data: IP address, browser type, operating system, device identifiers, date and time of access, session identifiers, and referring URLs;
• usage data: interactions with features, dashboards, APIs, and workflows within the Platform;
• device information: device type, operating system version, configuration settings, and language preferences;
• approximate geolocation derived from IP address or device settings;
• transaction metadata: request logs, API activity, timestamps, error logs, and integration-level data from partner connections; and
• cookies and similar technologies: as described in Section 10 of this Policy.

5.3. Data Received from Third Parties
We may also receive Personal Data from authorised third-party sources in connection with the provision of Services, including:

• KYC verification partners and government databases (e.g., UIDAI for Aadhaar authentication, NSDL for PAN verification), where you have consented or where required by law;
• correspondent banks, payment gateways, and financial intermediaries involved in transaction processing;
• educational institutions and EduCon partners, in connection with student remittance transactions; and
• sanctions screening databases and fraud prevention vendors, in connection with AML/CFT compliance obligations.

HiWiPay does not seek to collect or process SPDI unless it is strictly necessary for KYC, compliance with financial regulations, or other purposes expressly disclosed to you. You should not submit SPDI beyond what is required for the Services.

6. Purposes of Collection and Processing

We collect and process Personal Data only for lawful purposes directly connected with providing and operating the Platform. These include:

• verifying your identity and completing KYC as required under applicable law, including RBI guidelines and PMLA;
• processing your remittance and forex transactions and communicating their status;
• detecting and preventing fraud, money laundering, and misuse of the Platform;
• meeting our regulatory reporting and record-keeping obligations under FEMA, PMLA, and RBI directions;
• responding to your support requests and resolving grievances;
• sending you service-related communications and transaction alerts;
• sending marketing communications, only where you have opted in and only until you opt out;
• improving Platform performance and security through anonymised analytics; and
• establishing, exercising, or defending legal claims.

We do not process your Personal Data for any purpose beyond what is described in this Policy, and we do not sell your Personal Data to third parties.

7. Consent and Lawful Basis for Processing

Where HiWiPay relies on consent as the legal basis for processing Personal Data:

• Consent will be obtained prior to such processing, through a clear and affirmative action by the Data Principal;
• Consent will be specific to the purpose for which it is sought and will be accompanied by a notice in plain language;
• Consent shall be freely given and not bundled with unrelated conditions;
• You have the right to withdraw consent at any time, without detriment to services not dependent on such consent. Withdrawal of consent does not affect the lawfulness of processing undertaken prior to withdrawal; and
• Where consent is required and not given (or is withdrawn), HiWiPay will not process the relevant Personal Data, which may limit the Services available to you.

Where processing is based on legal obligation (e.g., KYC under PMLA and RBI guidelines, transaction reporting under FEMA), consent is not separately required, and you will be notified of such processing through this Policy and any applicable service-specific notice.

8. Disclosure of Personal Data

HiWiPay does not disclose, sell, or otherwise make Personal Data available except as described in this Policy and only where such disclosure is lawful, necessary, and proportionate. We may disclose Personal Data to the following categories of recipients:

8.1. Regulatory Authorities and Government Bodies
We may share certain Personal Data, including KYC information and transaction records, with regulatory authorities including:

• the Reserve Bank of India (RBI);
• the Financial Intelligence Unit – India (FIU-IND);
• income tax and other taxation authorities;
• enforcement agencies under FEMA, PMLA, or other applicable laws; and
• courts, tribunals, or other judicial / quasi-judicial bodies where required by law or court order.

8.2. Third-Party Service Providers and Sub-Processors
We share Personal Data with trusted third-party service providers only to the extent necessary to deliver the Services. These include cloud hosting providers (currently Microsoft Azure), payment gateways and correspondent banks, KYC and identity verification agencies (including UIDAI and NSDL), AML and sanctions screening vendors, customer support tools, and legal, audit, and compliance advisors.

All such providers are bound by contractual obligations requiring appropriate data protection and security measures. For queries specific to how any third-party provider handles your data, please refer to their respective privacy policies and terms.

8.3. Financial and Correspondent Partners
In order to facilitate cross-border remittances and forex transactions, Personal Data (including beneficiary details) is shared with correspondent banks, payment gateways, and settlement partners. Such sharing is necessary for the performance of the transaction requested by you and is subject to applicable financial privacy and banking secrecy obligations.

8.4. Affiliates
We may share Personal Data with our affiliates for purposes including Service delivery, technical support, security monitoring, compliance, and internal administration, subject to this Policy.

8.5. Business Transfers
In connection with any merger, acquisition, reorganisation, sale of assets, or similar corporate transaction, Personal Data may be disclosed to prospective or actual counterparties and their advisors, subject to appropriate confidentiality and data protection safeguards. We will notify you as required by applicable law in such circumstances.

8.6. Legal and Professional Advisors
We may share Personal Data with our legal, tax, audit, or insurance advisors where necessary to obtain professional advice or to protect our legal rights, subject to confidentiality obligations.

8.7. Aggregated and Anonymised Data
We may disclose aggregated, anonymised, or de-identified data that cannot reasonably identify any individual for analytics, research, benchmarking, or business improvement purposes.

9. Cross-Border Transfer of Personal Data

HiWiPay’s primary data infrastructure is hosted on Microsoft Azure servers. Processing of Personal Data may occur in India and, in connection with international remittance transactions and correspondent banking relationships, in other jurisdictions.

Where Personal Data is transferred outside India, HiWiPay will ensure that such transfers comply with the DPDP Act and applicable RBI guidelines, including:

• transferring data only to countries or entities that provide a level of data protection comparable to that under the DPDP Act, or as notified by the Central Government;
• entering into contractual arrangements that impose data protection obligations on overseas recipients; and
• implementing technical safeguards, including encryption in transit and at rest and access controls.

Where cross-border transfer is necessary for the performance of a transaction you have instructed (e.g., remittance to an overseas beneficiary), such transfer is authorised by your use of the relevant Service.

10. Cookies and Similar Technologies

The Platform uses cookies and similar technologies to operate, secure, and improve functionality and user experience. Cookies are small text files placed on your device when you access the Platform.

10.1. Categories of Cookies
• Strictly Necessary Cookies: essential for the operation, authentication, and security of the Platform. These cannot be disabled without affecting core functionality.
• Functional Cookies: remember your preferences and settings to improve usability.
• Analytics Cookies: collect information on how the Platform is used to help us understand performance and improve features. These are only placed with your consent.
• Marketing / Targeting Cookies: used to deliver relevant communications where you have consented. We do not use such cookies for third-party behavioural advertising.

10.2. Consent and Control
Where required by law, a cookie consent banner will be presented when you first access the Platform. You may accept or decline non-essential cookies at that point, or change your preferences at any time through the Platform’s cookie settings or your browser settings. Declining certain cookies may limit Platform functionality.

11. Data Retention

HiWiPay retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law, whichever is longer. Key retention principles are as follows:

• KYC and identity documents: retained for a minimum of 5 years after the cessation of the business relationship.
• Transaction records: retained for a minimum of 5 years from the date of transaction completion, as required by FEMA and PMLA.
• Customer account data: retained for the duration of the account and for a period of 5 years thereafter.
• Communications and support records: retained for a minimum of 3 years or as required by applicable law.
• Consent records: retained for the duration of the consent and for a minimum of 3 years following withdrawal or expiry.
• Log and technical data: typically retained for a period of 12 months, unless required for longer for security, audit, or legal purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with the data disposal procedures described in Section 12 below.

12. Disposal and Destruction of Personal Data

HiWiPay maintains documented data disposal procedures to ensure that Personal Data is securely destroyed at the end of its retention period:

• Physical records containing Personal Data are shredded using cross-cut shredders or otherwise destroyed so that the information cannot be reconstructed.
• Electronic records are securely erased using certified data erasure software or physical destruction of storage media, ensuring that data cannot be practically read or reconstructed. Simple deletion of files is not sufficient and is not used as a disposal method.
• Cloud-hosted data is deleted in accordance with the data deletion procedures specified in our agreements with cloud service providers.
• Records of disposal are maintained for audit purposes.

Retention periods are assessed on a case-by-case basis considering legal obligations and business necessity. Where records are subject to regulatory archiving requirements, they will be transferred to a secure archive and access-restricted until the end of the required archival period.

13. Security of Personal Data

HiWiPay implements reasonable technical and organisational security measures to protect your Personal Data against unauthorised access, misuse, loss, or destruction. All data is stored on secure cloud servers.

No system is entirely risk-free. If you become aware of any security concern relating to your account or our Platform, please notify us immediately at the contact details in Section 17.

In the event of a Personal Data breach likely to cause harm, HiWiPay will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act.

14. Children and Minors

The Platform and Services are not directed at children under the age of 18 years (or such other minimum age as may be specified under applicable law from time to time). HiWiPay does not knowingly collect Personal Data from children. In connection with student remittance services, where a student is a minor, the Services shall be accessed and used by a parent or legal guardian on the student’s behalf.

If we become aware that we have inadvertently collected Personal Data from a child without appropriate verification of parental consent, we will take prompt steps to delete such data. If you believe that a child has provided Personal Data to us without appropriate consent, please contact us at the details in Section 17.

15. Rights of Data Principals

Under the DPDP Act and other applicable laws, you have the following rights in relation to your Personal Data. To exercise any of these rights, please contact our Grievance Officer as specified in Section 17.

15.1. Right to Access Information
You have the right to obtain: (a) confirmation as to whether your Personal Data is being processed; (b) a summary of the Personal Data being processed; (c) the identities of all Data Fiduciaries and Data Processors with whom your Personal Data has been shared; and (d) any other information as may be prescribed.

15.2. Right to Correction and Erasure
You have the right to: (a) correction of inaccurate or misleading Personal Data; (b) completion of incomplete Personal Data; (c) updating of Personal Data that is no longer current; and (d) erasure of Personal Data that is no longer necessary for the purpose for which it was processed, subject to any legal retention obligations.

15.3. Right to Grievance Redressal
You have the right to have grievances addressed by HiWiPay in accordance with the escalation matrix set out in Section 16.

15.4. Right to Nominate
You have the right to nominate any individual who shall, in the event of your death or incapacity, exercise your rights in relation to your Personal Data in accordance with the DPDP Act and applicable rules.

15.5. Right to Withdraw Consent
Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal. You may withdraw consent through the Platform’s consent management settings or by contacting us as described in Section 17.

We will respond to rights requests within the timelines prescribed under the DPDP Act and applicable rules.

Please note that certain rights may be subject to legal exceptions, including where processing is required for compliance with legal obligations, prevention of crime, or protection of legal claims.

16. Grievance Redressal
    

HiWiPay is committed to resolving data protection concerns promptly and fairly. The following escalation matrix applies:

Level 1 – Initial Contact 

Register your complaint or grievance directly with our customer support team:

• E-mail: exim@hiwipay.com 
• Telephone: +91 7670998508

Your grievance will be acknowledged within 48 hours and resolved within 72 working hours of receipt. If you are not satisfied with the outcome, you may escalate to Level 2.

Level 2 – Grievance Officer

If your grievance is not resolved at Level 1, or if you are not satisfied with the resolution, you may escalate to our designated Grievance Officer:

• E-mail: Dewang@hiwipay.com
• Name: Dewang Neralla
• Address: 802, B Wing, 8th Floor, Naman Midtown, Senapati Bapat Marg, Dadar West, Mumbai – 400028, India

The Grievance Officer will review the matter and communicate a final decision within 30 days of receipt of the escalation. The Grievance Officer is responsible for ensuring compliance with the DPDP Act and this Policy.

17. Contact Us
    

For any questions, concerns, or requests relating to this Policy or the processing of your Personal Data, please contact:

HiWi Forex Transaction Services Private Limited
Grievance Officer / Data Protection Contact
• E-mail: exim@hiwipay.com 
• Telephone: +91 7670998508
Address: 802, B Wing, 8th Floor, Naman Midtown, Senapati Bapat Marg, Dadar West, Mumbai – 400028, India
Website: www.hiwipay.com

18. Updates to this Policy
    

HiWiPay may update this Policy from time to time to reflect changes in our Services, business practices, applicable laws, or regulatory requirements. We will notify you of material changes through:

• a notice on the Platform or a pop-up prompt upon your next login;
• an email notification to the email address registered with us; and / or
• any other method required by applicable law.

Last updated: 1st October 2026