Privacy Policy

PAN Card Agency ("we", "our", "us") respects your privacy and is committed to protecting the personal information you share with us.

This Privacy Policy applies to information collected through our website and services. By using our platform, you consent to the practices described in this policy.

We collect the following categories of information:

We use the information we collect only for legitimate purposes connected to providing our services:

Registered users submit PAN applications on behalf of their own customers. This means personal data of third parties passes through our platform.

Your obligations as a registered user

• You must obtain clear consent from your customer before collecting or submitting their personal data or documents.
• You must inform your customer how their data will be used.
• You must not retain, copy, or misuse customer documents for any purpose other than the requested service.
• You must handle customer data in compliance with applicable Indian data protection laws.

We share your information only in the following limited circumstances:

• PSA / API partners — registration and service data is transmitted to the PSA service provider to create and manage your PSA ID.
• Payment gateway — your mobile number and transaction amount are shared with our payment partner to process wallet recharges.
• Hosting & infrastructure providers — data is stored on servers operated by our hosting provider.
• Legal authorities — where disclosure is required by law, court order, or a valid request from a government authority.
• Fraud investigation — where necessary to investigate suspected fraud or misuse of our platform.

All third parties we work with are expected to handle your data securely and only for the purpose for which it was shared.

All payments on our platform are processed through a third-party payment gateway.

• We never see or store your card details, CVV, UPI PIN, or banking passwords.
• We do not have the ability to initiate a charge on your account without your action.

We do store transaction metadata — order ID, amount, status, UTR number, and timestamp — which is necessary for wallet reconciliation, refunds, and support.

We take reasonable technical and organisational measures to protect your information:

• Passwords are stored using one-way cryptographic hashing — they are never stored in readable form.
• Data is transmitted over encrypted HTTPS connections.
• Database queries use prepared statements to prevent injection attacks.
• Forms are protected against cross-site request forgery.
• Login attempts are rate-limited and logged with IP address.
• Wallet operations use atomic database transactions to prevent tampering or duplication.

We retain your information for as long as your account remains active, and thereafter for as long as required to:

• Comply with legal, tax, and regulatory obligations.
• Resolve disputes and enforce our agreements.
• Maintain accurate financial and transaction records.

Transaction and activity logs are generally retained for a minimum period as required under applicable law. When data is no longer needed, it is deleted or anonymised.

We use cookies and similar technologies for essential functions only:

• Session cookies — to keep you logged in and maintain your session securely.
• Security tokens — to protect forms against cross-site request forgery.

We do not use cookies for advertising, cross-site tracking, or behavioural profiling. You may block cookies in your browser settings, but doing so will prevent you from logging in and using the platform.

Subject to applicable law, you have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate information. Editable fields can be changed from your profile page; locked fields (name, PAN, mobile, email) require a support request as they are linked to your PSA registration.
• Deletion — request closure of your account and deletion of data we are not legally required to retain.
• Withdraw consent — stop using our services and request account closure at any time.
• Grievance — raise any privacy concern with us using the contact details below.

Our services are intended for use by adults aged 18 and above. We do not knowingly collect personal information from minors for the purpose of creating an account.

Where a minor's PAN application is submitted through our platform by a registered user, it is the user's responsibility to obtain proper consent from the minor's parent or legal guardian in accordance with applicable law.

In the unlikely event of a data breach that affects your personal information, we will:

• Take immediate steps to contain and investigate the breach.
• Notify affected users without undue delay through email or an in-account notice.
• Report the incident to the relevant authorities where required by law.
• Advise you on steps you should take to protect yourself.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements.

Any changes become effective immediately upon publication on this website. Where changes are significant, we will make reasonable efforts to notify registered users. We recommend reviewing this page periodically.

For any privacy-related question, data request, or grievance, please contact us using the details below.