Privacy Policy

1. Overview & Scope

This Privacy Policy describes how UTILIPAY HUB (OPC) PVT LTD (referred to as “UTILIPAY HUB”, “Company”, “we”, “us”, or “our”), having its registered office at 420, 4th Floor, Metro Trade Center, VIP Road, Zirakpur, Mohali – 140603, Punjab, India, collects, uses, processes, stores, and protects personal information when you visit our website, submit service enquiries, purchase digital solutions, or interact with our platforms.

We are committed to processing your personal data responsibly and in strict compliance with applicable Indian legislation, including the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020.

2. Information We Collect

We collect only necessary personal data strictly required to deliver our business services, including:

• Identity & Contact Details: Full name, professional or personal email address, telephone / mobile number, WhatsApp contact number, and organization or business entity name.
• Business & Statutory Details: GSTIN, registered business address, and company information when requested for business registration, CA compliance, or merchant onboarding.
• Technical Project Specifications: Project briefs, domain names, hosting configurations, Figma / design assets, source code repositories, and technical deliverables required to fulfill contracted orders.
• Device & Telemetry Data: IP address, browser type, operating system, referring URL, access timestamps, and anonymous analytical telemetry used solely for security monitoring and system performance.

3. Purpose of Data Processing

Your personal data is collected and utilized solely for lawful business purposes, including:

• Fulfilling contracted website development, custom software engineering, CA filing, and marketing campaigns.
• Processing transactional milestone payments, generating GST-compliant tax invoices, and accounting audits.
• Responding to your direct enquiries, quotation requests, and technical support tickets.
• Complying with statutory reporting requirements under the Companies Act, GST Act, and Income Tax Act.
• Preventing fraud, unauthorized account access, and cybersecurity threats across our systems.

We strictly do not sell, rent, lease, or monetize your personal or business data to third-party data brokers.

4. Payment Data & Payment Gateway Security

All electronic transactions are routed directly through Reserve Bank of India (RBI) authorized, PCI-DSS Level 1 certified payment aggregators (such as Razorpay, Cashfree, or equivalent licensed gateways). Payment gateways employ bank-grade 256-bit SSL/TLS encryption and adhere to RBI card-on-file tokenization mandates. We only receive non-sensitive transactional metadata (such as Payment ID, Order ID, transaction status, and timestamp) for billing verification and invoice generation.

5. Third-Party Sharing & Transfers

We share your data only with trusted infrastructure providers essential for service delivery, under strict data processing agreements:

• Cloud Infrastructure Providers: Managed database and hosting providers (e.g. AWS, Vercel) for secure operational hosting.
• Licensed Payment Aggregators: RBI-authorized payment gateways for payment processing.
• Statutory Authorities: Government bodies or law enforcement agencies when strictly mandated under Indian law or a lawful court order.

6. Data Retention & Storage

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as mandated by applicable statutory retention laws:

• Service & Project Assets: Retained during the active engagement and for up to 90 days following project sign-off for warranty support, after which technical credentials are decommissioned.
• Billing & Tax Records: Invoices and transaction records are preserved for up to eight (8) financial years as required by Indian taxation and corporate compliance laws.

7. User Rights Under DPDP Act 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access: You may request a summary of the personal data we process about you.
• Right to Correction & Updating: You may request correction or completion of inaccurate personal data.
• Right to Erasure: You may request erasure of personal data that is no longer necessary for the specified purpose, subject to statutory retention obligations.
• Right to Grievance Redressal: You may register grievances with our designated Grievance Officer.
• Right to Nominate: You may nominate an individual to exercise your data rights in the event of death or incapacity.

To exercise any of these rights, visit our Data Request Portal or email our Grievance Officer.

8. Security Measures

We implement technical and organizational security controls aligned with ISO/IEC 27001 standards and IT Act Section 43A guidelines. These include TLS 1.3 encryption in transit, strict least-privilege role-based access controls, encrypted environment credentials, and continuous system monitoring.

9. Children’s Privacy

Our services are exclusively intended for commercial enterprises, working professionals, and individuals aged 18 and older. We do not knowingly solicit or collect personal data from minors.

10. Grievance Redressal Officer & Statutory Details

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and theConsumer Protection (E-Commerce) Rules, 2020, the details of the appointed Grievance Officer are published below: