Affiliate Privacy Notice

Last Updated: August 6, 2026
Effective From: August 6, 2026
Support: affiliate@karosimple.in

1. Purpose of This Notice

This Affiliate Privacy Notice explains how Karo Simple collects, uses, stores, and protects your personal data when you register for and participate in our Affiliate & Referral Program. This notice is separate from and in addition to our main platform Privacy Policy, because participation in the Program requires us to collect more sensitive information than a standard customer account.

This notice is issued in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian data protection laws.

Karo Simple may update this notice from time to time as our practices, legal obligations, or the Program itself evolve. Any material change will be communicated to you by email or dashboard notification, and the "Last Updated" date above will reflect the most recent revision.

2. What Data We Collect

When you register as an affiliate partner, we collect:

• Full name, email address, and phone number
• Password (stored in encrypted form)
• PAN (Permanent Account Number)
• One government-issued photo identification: Voter ID, Passport, or Driving License (we do not collect Aadhaar)
• A selfie photograph, where applicable, for identity verification
• Bank account details: account holder name, account number, IFSC code, bank name, and optionally your UPI ID
• Your referral activity: click data, IP address (stored in hashed/anonymized form), referral link usage, conversion history
• Your earnings history, payout history, and TDS deduction records

3. Why We Collect This Data

We collect and process this data for the following purposes:

• To verify your identity and eligibility to participate in the Program
• To process commission and reward payments to your bank account
• To calculate and deduct Tax Deducted at Source (TDS) as required by Indian tax law, and to issue Form 16A
• To track referral activity and accurately attribute commissions
• To detect and prevent fraud, self-referral abuse, and policy violations
• To communicate with you about your account, earnings, and Program updates
• To comply with our legal and regulatory obligations

4. Legal Basis for Processing

We process your personal data on the basis of your explicit, informed consent, provided at the time of registration. Financial and identity data (PAN, bank details, government ID) is treated as sensitive personal data and is collected only with a separate, specific consent checkbox distinct from general Program registration.

You may withdraw your consent at any time by closing your affiliate account, subject to Section 8 below regarding data retention for legal and financial record-keeping purposes.

5. How We Protect Your Data

• Bank account numbers are encrypted (AES-256) before being stored in our database and are decrypted only in-memory during authorized payout processing or admin audit.
• PAN numbers are stored securely and are displayed to you and to authorized administrators only in masked form (showing the last 4 characters) wherever practical.
• Access to sensitive affiliate data within our systems is restricted to authorized personnel only, and all administrative actions involving your data are logged for audit purposes.
• IP addresses used for click tracking are stored in hashed (non-reversible) form and are never stored as raw, identifiable IP addresses.

6. Who Can Access Your Data

• Internal Karo Simple personnel — limited to authorized super administrators, for the purposes of Program administration, payout processing, fraud review, and tax compliance.
• Payment processing partners — your bank account details are shared with our payment gateway/payout processing partner solely to execute the transfer of your earned commission.
• Government and tax authorities — as required by law, including for TDS filing and reporting purposes.
• We do not sell your personal data to any third party. We do not share your data with advertisers or use it for any marketing purpose outside of the Program itself, without your separate explicit consent.

7. Your Rights

Under the DPDP Act, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or outdated information
• Withdraw consent for further data processing (subject to legal retention requirements)
• Request erasure of your personal data upon closing your affiliate account, subject to Section 8
• Raise a grievance regarding how your data has been handled

To exercise any of these rights, contact us at affiliate@karosimple.in. We will respond to your request within a reasonable timeframe as required by applicable law.

8. Data Retention

• We retain your account and transaction data for as long as your affiliate account remains active.
• Upon account closure, we will erase or anonymize your personal data within a reasonable period, except for financial records (including PAN, payout history, and TDS records) which we are legally required to retain for a minimum period as mandated under Indian tax and financial regulations, even after account closure.
• Click and tracking data older than 12 months may be periodically purged or anonymized as part of routine data hygiene.

9. Data Breach Notification

In the unlikely event of a data breach affecting your personal data, Karo Simple will notify you and, where required, the relevant regulatory authority, in accordance with the timelines and requirements prescribed under the DPDP Act.

10. Children's Data

This Program is not intended for individuals under the age of 18. We do not knowingly collect data from minors as part of this Program.

11. Changes to This Notice

We may revise this notice periodically. Continued participation in the Program after a revision constitutes acknowledgment of the updated notice. Material changes affecting how your sensitive data is used will be communicated to you directly.

12. Contact Us

For any questions, concerns, or requests regarding your personal data under this notice, please contact: