Skip to main content
UPI Banking
Legal

Privacy Policy

What we collect, why we collect it, and the rights you have over it.

Last updated: Not yet published

Draft - not yet reviewed by counsel

This document is a professionally structured baseline. It has not been reviewed or approved by qualified legal counsel, and every value shown as a [PLACEHOLDER] must be supplied by the business before the site goes live. Do not rely on this document in its current form.

1. Who this policy covers

This Privacy Policy explains how UPI BANKING GLOBAL LLC collects, uses and protects personal data in connection with the UPI Banking website and the payment service described on it.

It covers visitors to the website and people who contact us or apply to become merchants. Where we process personal data about your customers on your behalf, the terms of that processing are set out in your merchant agreement rather than in this policy.

2. What we collect

We collect only what we need for the purposes set out below.

  • Information you give us. Your name, business email address, business name, business website, country of operation, business type, expected payment volume and the content of your message when you submit an application or contact form.
  • Onboarding information. Additional business and verification information requested during onboarding, where applicable. This is requested through a secure channel - never through the website forms.
  • Technical information. Information sent automatically by your browser when you use the website, such as IP address, user agent and request timestamps, used for security, abuse prevention and rate limiting.

We do not ask for, and you should never submit, passwords, payment-card numbers, bank credentials, identity-document numbers or other sensitive financial or identity data through the website forms.

3. Cookies and analytics

The website does not set advertising or cross-site tracking cookies, and it does not load third-party analytics or advertising scripts.

If bot protection is enabled, a challenge provided by Cloudflare may be loaded on pages containing a form. It is used solely to distinguish automated traffic from real visitors.

If we introduce analytics in future, this policy will be updated before it is enabled, and any consent required by applicable law will be obtained.

4. How we use personal data

  • to respond to your enquiry and to assess a merchant application;
  • to complete onboarding, verification and any checks required of us;
  • to provide, operate and support the Service;
  • to prevent, detect and investigate fraud, abuse and security incidents; and
  • to comply with legal and regulatory obligations that apply to us.

5. Legal bases

Where data-protection law requires a legal basis for processing, we rely on: performance of a contract with you or steps taken at your request before entering into one; compliance with a legal obligation; and our legitimate interests in operating, securing and improving the Service, balanced against your rights.

The specific framework that applies depends on where the business is established: [APPLICABLE DATA PROTECTION FRAMEWORK].

6. Who we share it with

We share personal data only where necessary, with:

  • service providers that host the website, deliver form submissions or provide security and anti-abuse protection, acting on our instructions;
  • professional advisers, where required for legal, accounting or compliance purposes; and
  • authorities or regulators, where we are legally required to disclose.

We do not sell personal data and we do not share it for third-party advertising.

The current list of processors is: [SUBPROCESSOR LIST].

7. International transfers

The Service is delivered from a globally distributed network, so personal data may be processed in countries other than your own. Where required, transfers are made under an appropriate safeguard, such as standard contractual clauses or an adequacy decision. Details: [TRANSFER MECHANISM].

8. How long we keep it

We keep personal data only as long as needed for the purpose it was collected for, and for any period required by law. Enquiries that do not lead to an account are retained for [ENQUIRY RETENTION PERIOD] and merchant records for [MERCHANT RECORD RETENTION PERIOD].

9. Your rights

Depending on where you are, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where processing relies on it.

To exercise a right, contact us using the details below. We may need to verify your identity before we act. You also have the right to complain to your local data-protection authority.

10. Security

The website is served over HTTPS with a strict Content-Security-Policy and related security headers. Form submissions are validated on the server, rate limited, and delivered over encrypted connections. Secrets are held in server-side environment variables and are never included in code sent to the browser. No system is perfectly secure, so we also limit what we collect in the first place.

11. Changes to this policy

We may update this policy. Where a change materially affects how we use personal data, we will give notice before it takes effect. The “last updated” date at the top of this page always reflects the current version.

12. Contacting us

Questions about this document can be sent to support@upibanking.com.

Registered entity: UPI BANKING GLOBAL LLC (registration number [REGISTRATION NUMBER]), of [REGISTERED ADDRESS].