Privacy Policy

This Privacy Policy is issued by Slenpay Private Limited (“Slenpay”, “Data Fiduciary”, “we”) and explains how digital personal data is collected, used, stored, shared, and protected in connection with the Website and the Platform. It is framed in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 as they come into force, the Information Technology Act, 2000, and other applicable Indian law. This Policy is also the notice contemplated under Section 5 of the DPDP Act.

1. Data Fiduciary

Particular Detail
Legal name Slenpay Private Limited
CIN U74999TG2022PTC159698
Registered office Plot No. 149, Flat No. 405, H Block, Aakruthi Township, Boduppal, Hyderabad, Telangana – 500092
Website https://slenpay.co.in
Privacy contact privacy@slenpay.co.in
Grievance Officer Kumar
Designation Grievance Officer
Email ID grievance@slenpay.co.in
Mobile Number +91 93818 30014

2. Scope

This Policy applies to personal data processed through slenpay.co.in, any official Agent interface, customer-support channels, and cookies on the Website. It applies to visitors, Customers whose data is entered on the Platform by a Registered Agent, and Agents in respect of their own account data. It does not apply to a Supplier’s or Agent’s own offline records that never reach Slenpay servers.

3. Categories of Personal Data

  • Identity and contact: name, date of birth, gender, mobile number, email, postal address, and emergency contact where a travel product requires it.
  • Official identifiers, only when a service requires them: PAN, Aadhaar number or Virtual ID / offline Aadhaar XML, passport details for international travel, and other official ID used for KYC. Virtual ID or offline XML will be preferred over storing Aadhaar numbers wherever feasible.
  • Travel data: passenger names, age bands, itinerary, PNR, and preferences the Customer or Agent chooses to save.
  • Insurance-payment data: insurer name, policy number, proposer name, premium amount, due date, and payment status. Health records should not be sent unless a specific product expressly requests them.
  • Lending-facilitation data: employment type, income band, bank details required by a lender, and documents uploaded for a partner lender. Credit decisions are made by the lender, who is an independent Data Fiduciary for underwriting.
  • Agent account data: KYC pack, shop address (Agent Venue), GSTIN, bank account used for Wallet load and commission payout, device identifiers, staff sub-user names, Wallet ledger, and issue logs.
  • Technical data: IP address, device type, browser, referring URL, pages viewed, and cookie identifiers.
  • Support data: emails, tickets, and call recordings where notice is given.

4. Sources

  • Directly from the individual, including Website forms and support messages.
  • From a Registered Agent who types Customer data into the Platform to issue a service.
  • Automatically, through cookies and server logs.
  • From Suppliers, KYC vendors, banks, and payout partners, limited to status and verification results.

5. Purposes

  • Operating the Website and Agent interface.
  • Issuing and servicing tickets, premium postings, and application referrals requested through Agents.
  • Agent onboarding, Wallet loading, commission payout, fraud prevention, and AML / KYC.
  • Customer support and grievance handling.
  • Transactional communications.
  • Limited marketing, only with separate consent or as otherwise permitted by law.
  • Analytics in aggregated or otherwise appropriately safeguarded form.
  • Compliance with law, regulators, courts, and tax authorities, and the establishment or defence of legal claims.

6. Legal Basis

Processing is based on consent and, where the DPDP Act so permits, on legitimate uses under Section 7, including processing necessary for a specified purpose for which data was voluntarily provided, and compliance with law.

Consent for optional processing may be withdrawn by writing to privacy@slenpay.co.in. Withdrawal does not affect processing already completed or data Slenpay must retain by law. Some services cannot be provided without certain data.

7. Sharing

Slenpay does not sell personal data. Data is shared only as follows:

  • Travel Suppliers and fulfilment partners: to ticket, modify, or cancel an issued booking.
  • Insurers and billers: to post a premium or bill payment.
  • Banks, NBFCs, and lending partners: to process an application the Customer submitted or consented to.
  • Payment partners and banks: to load an Agent Wallet, pay commission, or reconcile.
  • KYC / AML vendors, cloud hosts, and SMS, email, or WhatsApp processors: under contract as Data Processors.
  • The issuing Registered Agent: who already holds the Customer data collected at the point of sale.
  • Professional advisers and auditors: under confidentiality.
  • Government, courts, regulators, and law enforcement: where required or permitted by law.
  • A successor in a merger or sale of business: subject to confidentiality and notice where legally required.

8. Roles in the Agent Model

Slenpay is Data Fiduciary for Agent account data and for Customer data once it is submitted on Slenpay servers. The Registered Agent is an independent Data Fiduciary (or, in limited cases, a processor) for data the Agent collects offline and does not send to Slenpay.

An Agent shall not use passenger data harvested from the Platform to spam, sell leads, or build an unrelated database.

9. Cross-Border Transfers

Primary hosting is intended to be in India. If any processing occurs outside India, personal data will be transferred only in a manner not then restricted by the Central Government under the DPDP Act, with contractual and technical safeguards.

10. Retention

  • Tax and Companies Act records: generally eight years from the end of the relevant financial year.
  • Booking, Wallet, and payment records: typically eight years or such longer period as tax, PMLA, or dispute rules require.
  • KYC records: as prescribed under the Prevention of Money-Laundering Act, 2002 and partner instructions.
  • Grievance records: at least three years from closure, or longer if a proceeding is pending.
  • Server logs: typically 180 days unless needed for a security investigation.

When retention expires, data will be erased or irreversibly anonymised unless a legal hold applies.

11. Security

Slenpay implements reasonable security safeguards appropriate to the nature of the data, including encryption in transit, access control, vendor due diligence, logging of privileged access, and staff confidentiality undertakings.

No method of transmission or storage is completely secure. In the event of a personal data breach required to be notified under the DPDP Act, the Rules, or CERT-In directions, Slenpay will notify affected persons and the competent authority as required.

12. Children

The Website and Platform are not directed at children under 18. If Slenpay learns that such data was collected without verifiable parental consent as required under the DPDP Act, it will be deleted except where retention is legally required.

13. Rights of Data Principals

Subject to the DPDP Act and verification of identity, a Data Principal may:

  • obtain information about personal data being processed and the processing activities, in the manner prescribed;
  • request correction of inaccurate data, completion of incomplete data, and erasure when the data is no longer necessary for the specified purpose and retention is not legally required;
  • withdraw consent with comparable ease;
  • use the grievance process in the Grievance Redressal Policy;
  • nominate an individual to exercise rights in the event of death or incapacity, by writing to privacy@slenpay.co.in with the subject “Nomination”.

Requests should be sent to privacy@slenpay.co.in from a verifiable address with the subject “DPDP Rights Request”. Slenpay will respond within the period prescribed under the DPDP Rules and, during transition, will aim to respond within 30 days. Manifestly unfounded or repetitive requests may be refused with reasons.

14. Automated Decisions

Slenpay does not take automated decisions that legally bind a Customer in respect of credit or insurance underwriting. Lending and insurance partners may use their own models.

15. Changes

Updates will be posted on the Website with a revised Last Updated date. Where a change is material, additional notice will be provided and, if required, fresh consent taken.

Last updated: September, 2026