Privacy Policy

Admin Operational Directive: Data Privacy & Compliance
Internal Use Only: Oncash Buyback Portal
Effective Date: January 09, 2026

1. Access Authorization & Protocol

All administrative staff are granted access to user data strictly on a 'Need-to-Know' basis. Unauthorized extraction or bulk downloading of user databases is prohibited.

• Credential Security: Multi-factor authentication (MFA) is mandatory for all admin accounts.
• Audit Trails: Every interaction with user sensitive data (PII) is logged for security auditing purposes.

2. Operational Data Handling

When processing buyback requests, admins must adhere to the following:

• Verification: Cross-reference device IMEI/Serial numbers with fraud databases before approving high-value transactions.
• Vendor Dissemination: Only release the minimum data required for physical collection (Name, Phone, Address) to the assigned logistics partner.
• Communication: Use only approved, system-generated templates for all user communications to ensure consistency and compliance.

3. DPDP Act (2023) Enforcement

Admins are the primary point of enforcement for user data rights. Requests received through official channels must be prioritized:

• Request Escalation: Immediately flag any "Right to be Forgotten" (Erasure) requests to the Data Protection Lead.
• Data Portability: Ensure data exports for users are provided in a secure, machine-readable format.
• Regulatory Reporting: Any confirmed data breach or unauthorized exposure must be reported to the Compliance Officer within 2 hours.

4. Prohibited Conduct

Admins are strictly forbidden from:

• Sharing or selling user contact details to third-party marketing entities.
• Accessing user records for non-work-related inquiries.
• Modifying transaction history or records without a documented business justification.

5. Contact for Compliance Oversight

Direct all privacy, security, or compliance-related inquiries to the Data Protection Officer (DPO) at: dpo@oncash.in