UtilPe Privacy Policy

1. Introduction

This Privacy Policy explains how InstilX Technology Private Limited, a company incorporated under the laws of India with CIN U62099MH2024PTC417654 and registered office at VO-824, WeWork Vaswani Chambers, 1st Floor, 264-265, Dr Annie Besant Rd, Municipal Colony, Worli Shivaji Nagar, Mumbai, Maharashtra, 400030, India (referred to as "InstilX", "we", "us" or "our") collects, uses, stores, shares and protects personal information in connection with our BBPS Agent Institution platform branded as UtilPe (the "Platform" or "Service").

UtilPe is onboarded to the Bharat Bill Payment System (BBPS) as a BBPS Agent Institution (AI) with the National Payments Corporation of India (NPCI), operating via Axis Bank Limited as our Customer Operating Unit ("COU"). We are integrated with the BBPS ecosystem through our BBPS Technology Service Provider (TSP), BrokenTusk Technologies Private Limited (Setu).

Our Platform enables approved BBPS Agents onboarded under us (collectively, "Agents") to provide bill payment services to their end customers using APIs and an online dashboard. UtilPe is not a consumer digital wallet; we only maintain a BBPS transaction balance for Agents, which is strictly used to process BBPS transactions.

By accessing or using the Website https://utilpe.com or any related applications, APIs or dashboards (collectively, the "Website"), you acknowledge that you have read and understood this Privacy Policy and agree to the practices described here.

2. Scope and Relationship of Parties

This Privacy Policy applies to personal information processed in connection with:

• Visitors to the Website ("Website Visitors");
• Prospective and onboarded Agents and their authorised users (including their staff) who access UtilPe dashboards or APIs;
• End customers of Agents whose bill payment transactions are processed via the BBPS ecosystem through UtilPe; and
• Any other individuals who contact us or interact with us.

For most BBPS transactions, InstilX acts as a service provider / data processor to Agents and operates within the BBPS framework governed by NPCI, Axis Bank (COU), Setu (TSP), billers and banks. Agents are generally responsible for providing privacy notices and obtaining any necessary consents from their end customers.

We endeavour to comply with applicable Indian laws, including the Information Technology Act, 2000 and rules thereunder, and the Digital Personal Data Protection Act, 2023 (when and as notified), to the extent applicable to our operations.

3. Definitions

For the purposes of this Privacy Policy, unless the context requires otherwise:

• "Agent" means a merchant, distributor, retailer or other entity onboarded under UtilPe as a BBPS Agent to provide bill payment services to its customers.
• "End Customer" means a person whose bill or payment request is processed through the BBPS system via an Agent using UtilPe.
• "BBPS Balance" means the pre-funded balance maintained by InstilX in our internal systems for each Agent, strictly for processing BBPS transactions via UtilPe. It is not a public wallet or stored-value facility for consumers.
• "COU" means Customer Operating Unit in the BBPS framework, which for UtilPe is currently Axis Bank Limited.
• "TSP" means Technology Service Provider for BBPS connectivity, which for UtilPe is BrokenTusk Technologies Private Limited (Setu).
• "Personal Data" or "personal information" means any information that can identify an individual, either directly or when combined with other information.

4. Information We Collect

4.1 Information you provide to us

When you interact with us or use UtilPe, we may collect the following information that you provide directly:

• Agent onboarding information: contact person name, business name, business address, email address, phone number(s), role/designation, login credentials and any other details submitted via our forms, APIs or during manual onboarding.
• KYC and regulatory information: PAN, GST, business registration documents, shop and establishment certificates, bank account details, cancelled cheque, and officially valid documents as may be required by NPCI, Axis Bank (COU), Setu (TSP) or applicable regulations.
• Support and communication data: information shared when you contact us via email, phone, in-app chat, grievance forms or other channels, including support conversations and complaint records.
• API and technical contacts: developer or technical contact details provided for API access, sandbox use and production credentials management.

4.2 Information related to BBPS transactions

In the course of processing BBPS transactions on behalf of Agents, we may receive or process information relating to Agents and End Customers, such as:

• Biller category and details, customer account/consumer number, bill number, bill period, bill amount, due date and bill status;
• Customer name, mobile number, email address (if provided by the Agent);
• Payment amount, transaction ID(s), NPCI/BBPS reference IDs, UTRs, timestamps, status codes, reversal/adjustment data and related metadata;
• Complaint IDs, complaint category, resolution notes and other BBPS complaint-management data.

Payment instrument details (such as card numbers or CVV) are generally handled by banks, payment gateways or PA partners in the BBPS/UPI ecosystem. We do not store complete card numbers or CVV details on UtilPe.

4.3 BBPS Balance and financial records for Agents

For each Agent, we maintain internal records relating to BBPS Balance and settlement, including:

• Ledger entries for BBPS Balance top-ups, debits towards BBPS transactions, adjustments and reversals;
• Details of payments made by the Agent to InstilX (such as transaction reference, mode, date, amount) for crediting BBPS Balance;
• Invoices, credit notes, debit notes and reconciliation reports generated or shared with Agents.

4.4 Log, device and usage information

When you visit the Website or use our dashboard/API, we may automatically collect certain technical data, including:

• IP address, approximate location, date and time of access;
• Device information, browser type and version, operating system, screen resolution, preferred language;
• HTTP request information, referrer URL, pages viewed, buttons clicked, response times and other usage analytics;
• Log data relating to API calls such as endpoint, headers, status codes and error traces for debugging and security purposes.

4.5 Cookies and similar technologies

We may use cookies, web beacons and similar technologies to maintain sessions, remember your preferences, secure your account and analyse usage of the Website. You can control cookies through your browser settings, but disabling certain cookies may limit functionality of the Platform.

5. How We Use Your Information

We use the information described above for the following purposes:

• To provide and operate UtilPe, including onboarding Agents, creating and managing user accounts, authenticating logins and enabling access to the dashboard and APIs.
• To process BBPS transactions as a BBPS Agent Institution via NPCI, Axis Bank (COU) and Setu (TSP), including bill fetch, payment, confirmation, reversals, complaint management and reconciliation.
• To maintain and display the BBPS Balance for each Agent and to debit it for BBPS transactions. The BBPS Balance is a pre-funded, non-interest-bearing balance strictly for BBPS services and not a wallet for the general public.
• To handle payments from Agents in order to credit BBPS Balance, raise and share invoices, reconcile accounts and maintain internal financial records.
• To communicate with you regarding onboarding, product updates, outages, security alerts, support responses and other operational messages.
• To provide customer support and dispute resolution, including responding to queries, BBPS complaints and grievances.
• To improve and secure our Platform by monitoring usage, performing analytics, debugging issues, testing new features, preventing fraud and enforcing our terms.
• To comply with legal and regulatory obligations, including obligations under NPCI BBPS guidelines, Axis Bank (COU) arrangements, Setu (TSP) contracts, taxation, law enforcement requests and other applicable laws.
• For limited marketing and business development, such as sending product updates or offers to Agents and prospects, in accordance with applicable laws and with the ability to opt out of such communications.

Clarification on BBPS Balance and refunds

Amounts deposited by an Agent with InstilX for the purpose of BBPS transactions are recorded as the Agent's BBPS Balance in UtilPe. This balance:

• is strictly to be used for eligible BBPS transactions available on the Platform;
• is not available for peer-to-peer transfers, cash withdrawal or general payments outside BBPS;
• is generally non-refundable and is expected to be utilized against BBPS transactions, except where a refund is required by applicable law, by the BBPS framework, or is expressly agreed by InstilX in writing.

6. Legal Basis and Consent

We process personal information on one or more of the following legal bases, to the extent applicable under Indian law:

• Consent: where you have given consent for one or more specific purposes (for example, where required for marketing communications or certain data processing activities).
• Performance of a contract: where processing is necessary to enter into or perform our agreement with you (for example, to provide UtilPe to Agents).
• Legal and regulatory obligations: where processing is required to comply with obligations under law (including NPCI/RBI/BBPS-related obligations, KYC requirements, tax laws and law-enforcement requests).
• Legitimate uses/Business necessity: for purposes such as preventing fraud, ensuring network and information security, improving our services and protecting our legal rights, while taking appropriate measures to protect your privacy.

7. How We Share Your Information

We do not sell your personal information. We may share information in the following circumstances:

• NPCI, Axis Bank (COU) and Setu (TSP): information necessary to process BBPS transactions, onboard Agents, perform KYC, manage complaints and comply with BBPS framework requirements.
• Banks, payment aggregators and billers: to the extent required to process payments, settlements, reversals and disputes within the BBPS/ecosystem.
• Service providers and vendors: third parties that provide infrastructure, hosting, cloud services, SMS/Email gateways, analytics, logging, security tools, customer support, KYC/AML services or other technical/operational support.
• Professional advisers: auditors, accountants, lawyers and consultants who provide professional services and are subject to confidentiality obligations.
• Legal and regulatory authorities: when required by law, regulation, court order or law-enforcement request, or when we believe disclosure is necessary to protect our rights or the rights, property or safety of others.
• Business transfers: in connection with a merger, acquisition, restructuring, sale of assets or similar corporate transaction involving InstilX, subject to appropriate confidentiality protections.

Where we share personal information with third parties, we aim to do so on a need-to-know basis and, where appropriate, under contractual arrangements that require them to handle information in accordance with applicable data protection requirements.

8. Data Storage and International Transfers

We may store and process personal information on servers located in India and/or in other countries where our service providers operate. These locations may have different data protection laws than your jurisdiction.

Where information is transferred outside India, we take reasonable steps to ensure that such transfers comply with applicable law and that your information is protected with appropriate safeguards, such as contractual protections and security controls.

9. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by:

• NPCI/BBPS and banking regulations;
• applicable laws on record-keeping, taxation, and audits;
• contractual obligations with NPCI, Axis Bank (COU), Setu (TSP) and our Agents; and
• legitimate business needs such as dispute resolution.

When information is no longer required, we will take reasonable steps to delete, anonymise or securely store it in accordance with applicable law and our internal policies.

10. Security of Your Information

We implement reasonable technical and organisational measures designed to protect personal information from unauthorised access, use, disclosure, alteration or destruction. These measures may include:

• access controls and authentication mechanisms;
• encryption of data in transit where appropriate;
• segregation of roles and least-privilege access policies;
• logging and monitoring of critical systems;
• secure software development and change-management practices;
• periodic internal reviews and audits.

However, no system can be completely secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for promptly notifying us of any suspected unauthorised use of your account.

11. Your Rights and Choices

Subject to applicable law, you may have the following rights in relation to your personal information:

• the right to access the personal information we hold about you;
• the right to request correction or updating of inaccurate or incomplete information;
• the right to request deletion or anonymisation of your information where it is no longer necessary for the purposes for which it was collected, subject to legal or contractual retention requirements;
• the right to withdraw consent for processing that is based on consent (without affecting prior processing), where withdrawal is not inconsistent with legal or contractual obligations; and
• the right to register a complaint with us and, where applicable, with relevant data protection or regulatory authorities.

If you are an End Customer of an Agent, we may refer your request to the relevant Agent where they act as the primary data fiduciary/controller for your information, but we will assist them as reasonably required.

To exercise your rights, please contact us using the details in the Contact and Grievance Officer section below. We may need to verify your identity before processing your request.

12. Children's Privacy

UtilPe is intended for use by businesses and Agents. We do not knowingly collect personal information directly from children under the age prescribed by applicable law. Any personal information of minors processed in the BBPS ecosystem is typically provided by Agents in the course of bill payments. If you believe that a child's information has been provided to us inappropriately, please contact us so that we can take appropriate steps.

13. Third-Party Sites and Services

Our Website and Platform may contain links to or integrations with third-party websites, applications, services or tools, including those of NPCI, Axis Bank, Setu (TSP), banks, billers and other vendors. We do not control and are not responsible for the privacy practices of such third parties.

We encourage you to review the privacy policies of all such third parties before providing any personal information to them or using their services.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or other factors. When we do so, we will revise the "Last updated" date at the top of this page and, where appropriate, provide additional notice (such as a banner on the Website or an email to registered Agents).

Your continued use of the Website or Platform after any changes take effect will constitute your acknowledgement of the updated Privacy Policy.

18. Contact Information

If you have any questions about these Terms or the Platform, please contact:

16. Trademarks and Third-Party Logos

"NPCI", "BBPS" and related logos are registered trademarks of the National Payments Corporation of India. "Axis Bank" and the Axis Bank logo are trademarks of Axis Bank Limited. "Setu" is a brand of BrokenTusk Technologies Private Limited. All other third-party names, logos and brands appearing on the Website or Platform are the property of their respective owners, and their use does not imply endorsement or affiliation, unless expressly stated.