KYC & Business Verification Policy

Version 0.1-draft · Effective 9 November 2026

Draft — pending legal review. Draft prepared for legal review. Confirm entity details, the Grievance Officer, governing-law clauses and every retention period with a qualified lawyer and your GST adviser before publishing. Confirm which documents are strictly necessary (data minimisation under the DPDP Act).

Why we verify businesses

We verify every organisation before activating paid licences to prevent fraud and misuse, to issue correct GST invoices and to meet our legal obligations.

What we collect

Legal business name, business type and registered address.
PAN of the business or proprietor.
GSTIN, or, if the business has no GSTIN, its Udyam (MSME) registration number.
A copy of the PAN card and the GST registration or Udyam certificate.

We do not ask for Aadhaar numbers, bank statements or personal financial documents.

How documents are stored

Documents are uploaded over an encrypted connection into private storage. They have no public link. Only authorised OperateOne verification staff can open them, using time-limited access, and every view and decision is recorded in our audit log.

How we check

We check the format and check digit of the GSTIN, that the PAN inside the GSTIN matches the PAN provided, and that the state matches the address. A reviewer compares the uploaded documents with the details provided.

Outcomes

You will be told whether your verification is approved, rejected or needs resubmission, with a reason. You can resubmit corrected details at any time.

Retention and deletion

KYC documents are kept while your account is active and for the period required by law afterwards, then deleted. See the Data Retention Policy.

Consent

We ask for your consent when you submit KYC details. You can withdraw it by contacting us; paid licences cannot continue without verification.