PRIVACY POLICY

This Privacy Policy explains our policy regarding the collection, processing, use, disclosure, and transfer of customer/end-user (“End-User”) and website visitors’ (“Website Visitor”) (collectively “you”, “your”) personal data (“Personal Data”) by Catagrowth Technologies Private Limited (“Company”, “we”, “us”, “our”), in compliance with applicable Indian laws, including but not limited to the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 (as may be made applicable), the Reserve Bank of India (RBI) Guidelines, and other relevant data protection and cybersecurity regulations. The Company is committed to ensuring the privacy and security of your Personal Data processed by us.

The Company does not knowingly process Personal Data of children under the age of 18. To the extent we learn we have unknowingly processed Personal Data of a child under the age of 18, we will delete such information as soon as possible.

I.SCOPE AND APPLICABILITY

There are two main parts to this Privacy Policy, in addition to the General Terms provided herein:

(1)Part A: applies to processing of Personal Data in relation to our proprietary B2B platform application/portal (“Platform”), which facilitates transactions, rewards, and data analytics between banks, NBFCs, merchants, and other financial institutions (collectively referred to as “Partners”). To this extent, End-Users do not directly access or interact with our Platform. All End-User Personal Data pertinent to the Platform is received, processed, and stored in hashed form to ensure data security and privacy after appropriate consent to do so has been obtained by our Partners. Having said that, the Company is committed to protecting End Users’ privacy and Personal Data and to that extent, this Privacy Policy also outlines our ethos on the collection, usage, storage, disclosure, and processing of Personal Data in compliance with applicable law. We are not data fiduciaries of End Users’ Personal Data processed by us; our role is limited to that of a data processor.
(2)Part B. applies to processing of Personal Data in relation to Website Visitors, who visit and interact with our website (“Website”). Website Visitors may voluntarily provide their Personal Data to us through the “contact us” form directly. To this extent, we act as data fiduciaries of Website Visitor’s Personal Data processed by us.

Hence, we only collect Personal Data directly from you when:

(1)Website Visitors voluntarily provide it, such as when Website Visitors use our Website’s contact form, or
(2)End-Users provide consent to our Partners for the processing of End Users’ Personal Data, such as phone number and/or email address, provided through our widgets for purposes such as to access offers and rewards.

Consequently, any Personal Data processed by us will only be based on a lawful basis of processing and for lawful purposes.

II.PART A
(1)Personal Data we process

The type of Personal Data processed will depend on your interaction with us. This may include

(i)Contact information (name, email address, phone number; details of the location); any financial information required to undertake transactions on our Platform; user account data – i.e., username and password relating to your user profile maintained with us; technical data – IP address, device type, etc., and usage data.
(ii)Rewards and Transactional Data: We collect Personal Data related to your activity within rewards programs, i.e., information about the points you earn, offers you redeem, and your current reward status, and details about the purchases or actions that qualify for rewards through our Partners.
(iii)Usage and Technical Data: When you access our services, we automatically collect your device information (IP address, browser type, operating system and unique device identifiers) and interaction data (pages viewed, links clicked and the date and time of your interactions).
(2)Sharing of Personal Data

We do not sell, trade, or disclose data to third parties, except in accordance with the instructions of our Partners, or applicable law, under the following conditions:

(i)Regulatory Compliance: When required by Indian such as RBI, SEBI, NPCI, or other government authorities.
(ii)Legal Requirements: In response to legal orders, warrants, or law enforcement investigations.
(iii)Service Providers: We share data with third-party service providers (like cloud hosting providers or SMS delivery platforms) who perform services on our behalf and require access to your information to do so.
(iv)Rewards Partners: We may share your Personal Data with our participating Partners to facilitate the reward calculation and delivery of services.
(3)Purpose of Data Processing:

We process your Personal Data for the purposes instructed by our Partners and as permitted under applicable law. This may include purposes such as:

(i)Suggest potential partners on the platform to run joint campaigns
(ii)Launch Offer campaigns and disburse rewards
(iii)Analyze spending patterns to customize and enhance rewards programs
(iv)Provide business intelligence reports to our Partners
(v)Ensure compliance with regulatory and legal obligations
(vi)To provide and manage the services (i.e., to track your loyalty points, status and redemptions, manage your rewards account, authenticate your identity (using your phone number), deliver non-marketing operational messages necessary for service function (account verification codes, redemption codes etc.).
(vii)for communications relating to our services (vide SMS, email, WhatsApp, etc.). We may use your phone number and rewards data to send you promotional and marketing messages based on the consent you have provided, including to send you exclusive offers, special discounts, news and time-sensitive deals directly relating to the rewards programs, or analyzing your rewards activity to provide personalized offers that we believe are most relevant to you. We may also enable our service providers to contact you through our platform for specific purposes, such as facilitating transactions or collaborations such as facilitating post order experience
(viii)for improvement and security (to monitor, analyze and improve the functionality and user experience of the services, to detect, investigate and prevent fraudulent, unauthorized or illegal activity, etc.).
III.PART B
(1)Personal Data we process

We may process your voluntarily provided Personal Data submitted through the ‘contact us’ form:

(i)Full Name
(ii)Work Email
(iii)Phone Number
(iv)Company/Brand Name
(v)Any other Personal Data that you may submit through the ‘Message’ text box.
(2)Sharing of Personal Data

We do not sell, trade, or disclose data to third parties, except in accordance with applicable law, under the following conditions:

(i)Regulatory Compliance: When required by Indian such as RBI, SEBI, NPCI, or other government authorities.
(ii)Legal Requirements: In response to legal orders, warrants, or law enforcement investigations.
(iii)Service Providers: We share data with third-party service providers (like cloud hosting providers or SMS delivery platforms) who perform services on our behalf and require access to your information to do so.
(3)Purpose of Data Processing:

We process the personal data submitted through the ‘Contact Us’ form for the following purposes:

(i)Responding to Your Business Inquiry: To review, evaluate, and respond to the inquiry or request for information submitted by you on behalf of your organisation regarding our Platform, services, or partnership opportunities. This includes communicating with you through the contact details you have provided for the purpose of addressing your query.
(ii)Evaluating Partnership and Onboarding Suitability: To assess whether your organisation is suitable for onboarding onto our platform as a merchant, brand, payment partner, issuer, or any other commercial partner, and to initiate preliminary discussions or due diligence processes towards a potential business arrangement.
(iii)Internal Business Communications and Record-Keeping: To maintain internal records of communications with prospective business partners, including for the purposes of business development, and ensuring continuity of our commercial engagement processes.

We collect and process only such personal data as is adequate, relevant, and limited to what is necessary for the purposes described above. We shall not process your personal data for any purpose other than as stated herein, except with your explicit consent or as required by applicable law.

IV.GENERAL TERMS
(1)Rights and Responsibilities
(i)For End Users: Partners are responsible for ensuring that they collect and share End Users’ Personal Data in compliance with applicable laws including, obtaining the necessary consent from you. Partners act as the data fiduciaries and are responsible for compliance with applicable laws, including in relation to your data rights.
(ii)For Website Visitors: You have certain rights in relation to the processing of your Personal Data. These include the right to access details of your data we hold, correct inaccurate or incomplete data, request erasure (unless retention is required by law), designate a nominee for your data in case of incapacity, and file grievances about data processing. Please see below a detailed description of your rights.

To exercise these rights, contact us at the details provided in section (IV)(9) below with your request and proof of identity. We will respond within the timelines prescribed by applicable laws. Rights may be limited if they conflict with legal obligations.

Right to grievance redressal
  • You have the right to readily available means of grievance redressal in respect of any act or omission by us regarding the performance of our obligations in relation to your personal data or the exercise of your rights under applicable laws.
  • We shall respond to your grievances within 90 days from the date of receipt of your grievance.
  • You must exhaust the opportunity of redressing your grievance through our internal grievance redressal mechanism before approaching the Data Protection Board of India.
Right to nominate
  • You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under applicable laws.
  • For this purpose, “incapacity” means inability to exercise your rights under applicable laws due to unsoundness of mind or infirmity of body.
  • To exercise your right to nominate an individual, you may:
    • Access the nomination feature by writing us to care@useunloq.com;
    • Provide the following particulars of the nominee: Name , Contact Details, Relationship , Identity Proof.

Certain rights are available only when we process your personal data on the basis of your consent, or voluntarily provided personal data. These include:

Right to access information about personal data: You have the right to obtain from us:
  • Summary of Personal Data: A summary of the personal data which is being processed by us and the processing activities undertaken by us with respect to such personal data;
  • Details of Data Sharing: The identities of all other Data Fiduciaries and Data Processors with whom your personal data has been shared by us, along with a description of the personal data so shared; and
  • Other Information: Any other information related to your personal data and its processing, as may be prescribed under law.
Right to correction and erasure of Personal Data: Subject to compliance with any requirements or procedures under applicable law, you may request us to:
  • correct any inaccurate or misleading personal data;
  • complete any incomplete personal data; and
  • update your personal data.
  • erase your personal data.

Upon receiving your request, we shall correct, complete or update your personal data accordingly. We shall erase your personal data unless retention of the same is necessary for the specified purpose or for compliance with any applicable law.

Please keep in mind that these rights are not absolute and the exercise of each is subject to certain conditions in accordance with applicable laws.

(2)Data Retention

Your Personal Data is retained in accordance with applicable laws and, in case of End Users, also in accordance with the instructions of our Partners.

Upon expiration of the retention period, data is securely deleted, returned to Partners (where applicable) or anonymized, in accordance with applicable law and, in case of End Users, also in accordance with the instructions of our Partners.

(3)Data Breach Notification Policy

In case of a data breach, we will notify the affected parties, regulatory authorities in accordance with the applicable law.

(4)Cookies & Tracking Technologies
(i)Use of Cookies: To the extent of our Website and Platform that does not allow direct individual logins, our use of cookies and tracking technologies is limited to system functionality, security, and performance monitoring.
(ii)We utilize the following types of cookies and tracking technologies:
Essential Cookies: These are strictly necessary for the operation of our Website and Platform, ensuring secure authentication, session management, and fraud prevention.
Performance & Analytics Cookies: These help us analyze system performance, detect anomalies, and optimize platform functionality for our banking, NBFC, and merchant partners.
Security Cookies: Used to prevent fraud, unauthorized access, and detect malicious activities on our platform.
Third-Party Tracking & Analytics: We may use third-party analytics services (such as Google Analytics or similar tools) to collect aggregated, non-personal insights about platform usage, ensuring compliance with Indian data protection laws. However, all customer-related data remains hashed and anonymized before being processed.
Cookie Control & Consent: Since the Platform is used exclusively by registered partners (banks, NBFCs, merchants), cookie policies are part of contractual agreements with our partners. Partners may configure their browser settings to block or restrict cookies, but this may impact platform functionality. For Website Visitors, you may configure your browser settings to block or restrict cookies, but this may impact Website functionality.
(5)Opt-Out/Withdrawal

If you wish to stop receiving marketing text messages, you can reply STOP to any promotional message. Please note that if you opt out of marketing messages, you may still receive essential operational messages (like account alerts or verification codes) required for maintaining your account.

End Users may contact the relevant Partner to withdraw their consent from processing of Personal Data.

Website Visitors may contact us at the details provided in section (IV)(9) below to withdraw their consent from processing of Personal Data.

(6)Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information against unauthorized access, use, alteration, or destruction. However, no security system is impenetrable, and we cannot guarantee the security of our databases, nor can we guarantee that the information you supply will not be intercepted while being transmitted to us.

(7)Amendments and Updates

We may update this Privacy Policy periodically to comply with new laws, regulatory requirements, or changes in our business practices. Any changes will be posted on this page, and the “Last Updated” date will be revised. We encourage you to review this policy periodically to stay informed about how we are protecting your data.

(8)Questions / Grievance Redressal

In the event you have any grievance relating to the processing of information provided by you, you may

(i)If you are an End User, contact the relevant Partner.
(ii)If you are a Website Visitor, contact us at the details provided in section (IV)(9) below.
(9)Contact Us

In case of general queries please use our ‘Contact Us’ form available on the website www.useunloq.com

If you are a Website Visitor, you may contact us at reachout@useunloq.com in case you have any grievance or if you wish to exercise your rights as explained in section (IV)(1) above.