BuyNxt Privacy Policy

---

1. Purpose

This Privacy Policy explains how BuyNxt Pvt. Ltd. ("BuyNxt", "we", "us" or "our") collects, uses, stores, shares, protects and otherwise processes personal data in connection with the BuyNxt website, Green Receipt platform, merchant dashboard, APIs, integrations, support services and related products and services (collectively, the "Services").

This Policy is intended primarily for merchants, merchant personnel, authorised platform users, prospective customers, business contacts and website visitors. Individuals receiving a digital receipt or other merchant communication through Green Receipt should refer to the separate Green Receipt Consumer Privacy Notice.

This Policy is designed to support applicable requirements under the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 ("DPDP"), and, where applicable, the EU General Data Protection Regulation ("GDPR").

2. Scope

• Personal data processed by BuyNxt in its capacity as a Data Fiduciary/Controller or Data Processor/Processor.

• Employees, contractors and authorised third-party service providers handling personal data on behalf of BuyNxt.

• Merchants, merchant personnel, platform users, website visitors, business contacts and other users of BuyNxt / Green Receipt Services.

• Merchant end-customer data processed by BuyNxt on behalf of a merchant, POS provider, fintech partner or enterprise customer.

3. Our Role in Processing Personal Data

BuyNxt may act in different legal capacities depending on the processing activity. Where BuyNxt determines the purpose and means of processing for its own account administration, website, security, billing, support, compliance or business operations, BuyNxt may act as a Data Fiduciary under DPDP and/or Controller under GDPR, as applicable.

Where a merchant, POS provider, fintech partner or enterprise customer determines the purpose of processing its end-customer data and instructs BuyNxt to process that data to provide Green Receipt or related Services, BuyNxt generally acts as a Data Processor under DPDP and/or Processor under GDPR, subject to the relevant contract or Data Processing Addendum. The merchant or partner remains responsible for its own obligations as the relevant Data Fiduciary/Controller.

A merchant may also process or use customer information independently of Green Receipt, including through its own WhatsApp Business account or other channels. Such independent processing is controlled by the merchant and is not governed by Green Receipt privacy or communication preferences unless the processing is facilitated through the Green Receipt Service.

4. Key Definitions

Term Meaning

Personal Data Any data about an individual who is identifiable by or in relation to such data; where GDPR applies, information relating to an identified or identifiable natural person.

Data Fiduciary / Controller The organisation that determines the purpose and means of processing personal data.

Data Processor / Processor An organisation that processes personal data on behalf of a Data Fiduciary/Controller.

Processing Collection, storage, use, disclosure, transmission, organisation, alteration, erasure or other operation performed on personal data.

Consent Where relied upon, a freely given, specific, informed and unambiguous affirmative indication of agreement, subject to applicable law.

5. Personal Data We Collect

Category Examples

Account & contact data Name, work email, phone number, job title, organisation and account identifiers.

Merchant/business data Business/store name, address, GST/business information, merchant/POS identifiers, subscription and account information.

WhatsApp/Meta integration data Business phone number, WABA/WhatsApp identifiers, Business Manager/Page identifiers, configuration and authorisation metadata required for integrations.

Billing & commercial data Plan, invoices, payment status, transaction references and commercial account records.

Platform & usage data Login records, IP address, browser/device information, access times, feature usage, API events, application logs and diagnostic information.

Support data Support tickets, call/message records, issue details, screenshots/files and information submitted to resolve a request.

Security & audit data Authentication events, access/change logs, incident records, vulnerability/security events and audit evidence.

Merchant end-customer data Depending on the service: mobile/WhatsApp number, name where supplied, invoice/receipt and purchase details, message-delivery metadata, consent/preference records and CRM/engagement data.

6. How We Collect Personal Data

• Directly from you when you register, subscribe, configure an integration, contact us, request support or communicate with our team.

• From your organisation or an authorised administrator.

• Through POS, fintech, enterprise or technology partners where an integrated Green Receipt service is used.

• Automatically through logs, cookies and similar technologies, subject to applicable law and our Cookie Policy.

• From third-party platforms you choose to connect, including Meta/WhatsApp.

• For merchant end-customer data, from the merchant/POS/partner system under the merchant's customer relationship and processing instructions.

7. Purposes and Legal Bases

Purpose What this includes Typical basis / role

Provide and operate Services Account creation, receipt delivery, integrations, dashboards, APIs and service functionality. Contract/requested service; permitted legitimate use; consent where required.

Account, billing & administration Subscriptions, invoicing, commercial relationship and authorised users. Contract; legal obligation; legitimate interests where applicable.

Support & service communications Issue resolution, service notices and troubleshooting. Contract/requested service; legitimate interests/permitted use.

Security, fraud prevention & audit Authentication, monitoring, incident response, abuse prevention and audit. Legal/security obligations; legitimate interests where applicable.

Product improvement & analytics Performance, reliability and feature analytics using appropriately minimised data. Legitimate interests or consent where required.

Marketing to merchants/business contacts Information about BuyNxt products, services and events where permitted. Consent or other lawful basis; opt-out available.

Compliance & legal claims Law, regulatory requests, contracts and legal claims. Legal obligation / permitted legitimate use.

Merchant end-customer processing Green Receipt and related functions under merchant/partner instructions. Processor role under contract/DPA; merchant/partner determines applicable basis.

8. Green Receipt End-Customer Data

Green Receipt is a B2B2C technology service. A merchant may collect a customer's mobile number at the billing counter for the specified purpose of sending a digital receipt or related transaction communication on WhatsApp. The merchant may send the receipt using a shared service number or its own WhatsApp Business number, depending on the configuration.

Where BuyNxt processes such data solely to provide the merchant-requested service, BuyNxt does not treat provision of a phone number for receipt delivery as automatic permission for BuyNxt promotional marketing. Promotional or optional communications facilitated through Green Receipt must be handled under an appropriate legal basis and applicable messaging-platform requirements.

9. Marketing and Communication Preferences

Service, security, billing and transactional communications may be sent where necessary to operate the Services or fulfil a requested transaction. BuyNxt marketing communications are treated separately and may be opted out of using the mechanism provided or by contacting us.

For merchant end-customers, Green Receipt may record an affirmative marketing preference on behalf of a merchant where that feature is used. Green Receipt preferences apply to processing and communications facilitated through Green Receipt; they may not control communications independently initiated by a merchant through its own WhatsApp Business account or other channels.

10. Sharing and Disclosure

• Authorised cloud, hosting, security, monitoring, support, communications and other service providers/sub-processors.

• Meta/WhatsApp and other platforms where the relevant integration is enabled.

• POS, fintech and enterprise partners where necessary to provide an integrated service.

• Professional advisers, auditors, insurers and certification bodies under appropriate confidentiality obligations.

• Government, regulatory, law-enforcement or judicial authorities where required or permitted by law.

• A successor or relevant counterparty in a merger, acquisition, financing, restructuring or sale, subject to appropriate safeguards.

BuyNxt does not sell personal data to third parties for their independent advertising purposes.

11. International and Cross-Border Processing

The Services may involve providers or platforms that process data in more than one country. BuyNxt will apply applicable cross-border transfer requirements. For GDPR-covered transfers outside the EEA, appropriate transfer mechanisms may include an adequacy decision, Standard Contractual Clauses or another lawful mechanism. For DPDP-covered data, BuyNxt will comply with applicable Central Government restrictions or requirements.

12. Data Retention and Deletion

BuyNxt retains personal data only for as long as reasonably necessary for the specified purpose, merchant/partner instructions, contractual requirements, legal/regulatory obligations, security, dispute resolution or legal claims. Data is deleted or anonymised when the applicable purpose and retention requirement end, subject to controlled backup lifecycles.

Data category Retention approach

Merchant account data For the account relationship and a defined post-termination period required for support, legal, contractual and audit purposes.

Receipt / transaction data For the merchant/partner-agreed operational period and longer only where law, contract, dispute or audit requirements require it.

WhatsApp/message delivery metadata For a defined operational, support and audit period with data minimisation.

Marketing preferences / opt-out records For as long as needed to honour the preference and demonstrate compliance.

Support records For a defined period appropriate to support, dispute and audit requirements.

Security / access / audit logs For a defined risk-based security and compliance period.

Backups Removed through controlled backup rotation after the applicable active-data retention period.

13. Security of Personal Data

BuyNxt uses administrative, organisational and technical safeguards designed to protect confidentiality, integrity and availability, including role-based access, least privilege, multi-factor authentication, encryption, secure development/change controls, logging/monitoring, vulnerability management, backups, incident response, employee confidentiality/security awareness and vendor risk management.

BuyNxt is implementing an Information Security Management System aligned with ISO/IEC 27001:2022. This statement does not represent ISO certification unless and until BuyNxt has obtained certification for the relevant scope.

14. Privacy and Data Protection Rights

Subject to applicable law, you may have rights to obtain information about processing, access personal data, request correction/completion/update, request erasure, withdraw consent, raise a grievance/complaint and, under DPDP, exercise nomination rights. Where GDPR applies, additional rights may include restriction, objection and data portability.

Where BuyNxt acts solely as Processor, we may refer a request to the relevant merchant/Controller or assist that organisation in responding. Identity verification may be required.

15. Children

The BuyNxt merchant platform is intended for business users and is not directed to children. Where a merchant uses the Services in a context involving children's personal data, the merchant is responsible for identifying and satisfying applicable legal requirements, including parental consent where required.

16. Cookies and Similar Technologies

Our website and platform may use necessary cookies and, where enabled, analytics or other cookies/similar technologies. Where consent is required, non-essential technologies should be activated only in accordance with the applicable consent mechanism. Please see our Cookie Policy for details of technologies actually in use.

17. Personal Data Breaches and Incident Management

BuyNxt maintains processes to identify, assess, contain, investigate and remediate information-security and personal-data incidents. Where notification is required by applicable law or contract, BuyNxt will notify the relevant Data Fiduciary/Controller, regulator and/or affected individuals as applicable within the required timeframe.

18. Sub-processors and Vendors

BuyNxt may appoint service providers/sub-processors to support the Services and applies risk-based due diligence and appropriate contractual/security requirements. Enterprise customers may request or receive a current sub-processor list in accordance with their agreement.

19. Changes to this Policy

We may update this Policy to reflect changes in law, regulation, technology, products or processing practices. We will publish the updated version and effective date and, where required, provide additional notice or obtain fresh consent for a materially different purpose.

20. Contact, Grievance and Complaints

BuyNxt Pvt. Ltd.

513, Kailash Building, KG Marg, Connaught Place, New Delhi - 110001, India

Privacy / Grievance Email: ethics@buynxt.in

Grievance Officer / DPO (if applicable): Prabhat Ummat

If your request relates to data processed by BuyNxt on behalf of a merchant, please identify the merchant/store and transaction where possible so the request can be routed appropriately.

21. Policy Review

This Policy is reviewed annually or following a significant change in applicable law, regulatory guidance, product architecture or company operations.