UROPAY - PRIVACY POLICY

This privacy policy ("Policy") outlines UroPay's ("UroPay", "us", "we", "our") practices in relation to the storage, use, processing and disclosure of information that you share with us when you visit, access and use the Uropay website: https://www.uropay.me/ or mobile application ("Website", "UroPay App", "Platform", or "Service").

By using the Platform and by providing your Information, you:

• Consent to the collection, use, sharing and disclosure of your Personal Information on the terms and conditions and in the manner contained in this Policy; and
• Agree that this Policy will form a binding legal agreement of between you and us.

If you do not agree to this Policy, please do not use our Website. Your continued use of this Website following the posting of changes to this Policy, as and when notified to you, will be deemed your acceptance of those changes.

1. What We Collect

The Service is designed with data minimization principles. UroPay collects and stores only the essential information that is required to provide the Service. This approach reduces privacy risks by limiting the amount of data processed.

Depending on your interaction with us (meaning, if you are just browsing our website, or if you have signed up on the Platform, etc.), we may collect two types of information from you, i.e. 'Personal Information' and 'Non-Personal Information'.

The term "Personal Information" means information that you provide to us which personally identifies you to be contacted or identified, such as your name, phone number, email address and any other data that is tied to such information including the heads outlined below.

An indicative list of the information being collected from you is set out below:

A. Data Provided Directly by You

• Name and UPI ID/VPA.
• Contact details: phone number, email address, support messages.
• Documents voluntarily uploaded for KYC or regulatory purposes (if required).

B. Data Collected Automatically

• Device information: device type, IP address, browser/user agent.
• Transaction metadata: amounts, timestamps, payer UPI handle, transaction reference numbers.
• Analytics and logs for performance and service improvement.

C. Data Accessed on Device (SMS)

• With explicit consent, UroPay reads incoming SMS messages on your registered phone to detect UPI credit notifications.
• Only SMS content necessary to confirm payment (transaction ID, amount, payer VPA, timestamp) is accessed. No SMS are stored in the database. SMS messages are processed in real-time and are not retained.
• Unrelated SMS messages are not read. Consent can be revoked by you at any time by uninstalling the UroPay App, deleting your account from the Platform and/or discontinuing use of the Services.

Non-Personal Information is the information that does not identify you. This type of information may include things like the Uniform Resource Locator ("URL") of the website you visited before coming to our Website, the URL of the website you visit after leaving our Website, the type of browser you are using and your Internet Protocol ("IP") address.

We use Non-Personal Information to troubleshoot, administer this website/App, analyze trends, gather demographic information, comply with applicable law and cooperate with law enforcement activities.

2. Purpose and Usage of Information

We process Personal Information for the following purposes:

• Internal record keeping.
• Enable payment acceptance, confirm receipts, manage billing/subscription, and provide customer support.
• Detect and prevent misuse or fraud.
• To improve our Services.
• We may periodically send promotional emails which we think you may find interesting using the email address which you have provided. We may use the information to customise the website according to your interests.

3. Sharing of Personal Information

We will not sell, trade, distribute or lease your Personal Information to third parties unless we have your permission or if required to do so by law or in the good faith belief that such disclosure is reasonably necessary to respond to court orders or other legal process. We may share your Personal Information with:

• Banks and payment service providers for transaction settlement, if required.
• Third-party service providers, such as Google and Microsoft, who provide hosting, analytics, email, or SMS services under contract, are required to maintain reasonable security measures to protect customer data. You should review their respective privacy policies and data processing terms to understand the specific safeguards and obligations in place.
• Regulatory authorities or law enforcement as required by law.

4. Data Storage and Retention

• All information is securely stored in a database that is not accessible by internet. This isolation provides an additional layer of security to protect your transaction data.
• Account information: retained while account is active and for a reasonable period thereafter
• Data is retained only as long as necessary to fulfil the purpose, comply with law or resolve disputes.

5. Security

We are committed to ensuring that your information is secure. UroPay implements reasonable technical, physical, and administrative safeguards, including encryption, access controls and audits. While, we strive for high security, no internet transmission is completely secure.

6. Cookies and Tracking

Our Website uses cookies and similar technologies for essential site functionality, analytics and optional features. You can manage your cookie preferences through your browser settings.

7. Links to Other Websites

Our Website or the Platform may contain links that lead to third party websites or platforms ("Third Party Sites") which may collect your data. You acknowledge that this Policy does not cover the collection and use of information by Third Party Sites and that UroPay shall not be responsible for the privacy policies, practices or content of such Third Party Sites.

8. Modifications

We may update this Policy to reflect changes in law, technology or services, from time to time. UroPay reserves the right to change this Policy at any time The updated Policy will be published on our Website with the revised effective date. The users registered on the Platform shall be notified of the changes or modifications, if any, done on this Policy via their registered email by UroPay. This Policy is effective from 01st July 2025.

9. Grievance Officer

If you have any grievance with respect to the Platform, please feel free to reach out to the grievance officer, the name and contact details have been provided below:

Name: Gaurav Chandra

Email: gaurav@uropay.me