NAVI PAYMENT TECHNOLOGIES PRIVATE LIMITED

PRIVACY POLICY

PLEASE READ THIS POLICY CAREFULLY

Last Updated on October 29^th, 2026

The privacy policy (“NPTPL Privacy Policy” or “Policy”) explains how Navi Payment Technologies Private Limited (formerly known as Uniorbit Payment Solutions Private Limited) (“our”, “us”, “we”, “Company”) collects, stores, uses, transfers and otherwise processes your personal data, in connection with or related to providing you Payment Aggregator Services (“PA Services”) (defined in the NPTPL Terms & Conditions) through the Navi platform / website / application or integrated merchant interfaces (“Platform”).

Your personal data shall include any data that we may have access to, which can identify you or may be attributable to you (“Personal Data”).

We may revise this Policy as well as update the PA Services, from time to time. Therefore, please keep visiting this page regularly to take notice of any changes we make. If you do not agree with any part of this Policy, please stop using our PA immediately. Further, if at any time, you wish to manage your consent for processing of your Personal Data, please reach out to our grievance redressal officer by e-mail.

This Policy, incorporates, and includes our NPTPL Terms & Conditions available here (“Terms”) and any consents provided by you on the App while availing while availing PA Services.

Words and phrases that are capitalised but not defined in this Policy shall have the same meaning as ascribed to such words and phrases in the Terms.

1. CONTACT INFORMATION

Summary: You may reach out to the nodal officer, Vivek Balwani at: [email protected] , confidentially to enquire about the treatment of your data.

If you have any queries, concerns, or grievances regarding this Policy, or the processing of your information, you may please write to our nodal officer, Vivek Balwani at: [email protected].

2. WHAT DATA IS COLLECTED AND HOW IT IS USED?

Summary: We collect certain information about you, some of which may be sensitive personal information. We have detailed what data and the manner in which this data is collected.

We collect data to ensure that you are provided with the PA Services in the most customer friendly, and robust manner possible. We use this data for the purposes identified in this Policy. By accepting this Policy, you provide your explicit consent to us for collecting data about you.

Please note that we only collect your data in a need-based manner to provide you with the PA Services. Such Personal Data includes:

(i) our Personal Data provided by you to avail the PA Services:

Data Collected	What is the Data used for?
Personal Details: We collect the data you provide to us when you access or transact vie the PA Services, including your name, phone number, email ID, PAN, date of birth, and address. We may require you to share further information on a later date to confirm the veracity of the information or pursuant to any additional features added to the Platform.	Onboarding and profile creation; enabling and processing the PA Services; enabling customer support; research and development; enabling communications between you and us; marketing and outreach; automated decisions; legal / contractual compliance and requirements.
Financial and KYC Information: We collect the data you provide when you accept the tentative terms of the PA Services. This may include your photograph, PAN, pin code, proof of address (which can be your electricity bill, rental / lease agreement, gas bill, passport or driver’s license, or voter’s identity card or any other officially valid documents as per applicable law), PAN / Aadhaar from Digilocker, bank account details, masked card information/tokenized payment credentials, payment instrument identifiers, transaction amounts, and merchant details.	Enabling KYC authentication; processing, authenticating, and settling payment transactions under the PA Services; enabling and servicing of PA Services; enabling customer support; research and development; legal compliance requirements; enabling communications between you and us; fraud monitoring and chargeback management.
Economic Profile / other data for processing the PA Services: You may be required to provide further information to us for the purposes of processing PA Services for you. Such additional information may include (without limitation) address, and bank account details.	Enabling us to process PA Services; enabling communications between you and us; legal compliance and requirements; research and development.

For KYC and provision of our services, you may provide your Aadhaar number (“Aadhaar Data“) or other valid proof of identity and proof of address accepted under applicable laws and our KYC Policy, including without limitation, your CKYC records. Providing Aadhaar Data is voluntary and is not a condition for availing our services, provided you furnish alternative identification documents acceptable under applicable laws. Where provided, you consent to us collecting, processing, storing, and transferring your Aadhaar Data in accordance with the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, applicable laws, this Privacy Policy and our KYC Policy.

(ii) Your Personal Data we receive from other third parties:

Data Collected	What is the Data used for?
Third Parties (including Merchants, Banks, and Card Networks): We may also be working closely with third parties (including, for example, onboarded merchants, acquiring banks, card networks, payment aggregators/gateways, business partners, other financial institutions, technical sub-contractors, analytics providers, search information providers and valuers) and may lawfully receive information about you from such sources.	Enabling the Platform to facilitate and process PA Services; KYC authentication; transaction processing and reconciliation; enabling customer support; research and development; enabling communications between you and us; marketing and outreach; automated decisions; legal compliance and requirements; product innovation.
Affiliates: To allow you a seamless experience on the App and avoid asking you to re-enter your information, we may, with your consent, collect your information from our Affiliates, in accordance with their respective privacy policies and applicable laws. This may include data from Navi Limited (formerly known as Navi Technologies Limited), and the Navi App, for instance, your account data to auto-fill your details or financial SMS data, app data, etc., for enhanced experience. For more details about the information collected by our Affiliates, please refer to their respective privacy policies.	Enabling the Platform to provide the PA Services; KYC authentication; enabling customer support; research and development: enabling communications between you and us; marketing and outreach; automated decisions; legal compliance and requirements; product innovation; loan servicing and monitoring.

Data Collected

What is the Data used for?

Third Parties (including Merchants, Banks, and Card Networks): We may also be working closely with third parties (including, for example, onboarded merchants, acquiring banks, card networks, payment aggregators/gateways, business partners, other financial institutions, technical sub-contractors, analytics providers, search information providers and valuers) and may lawfully receive information about you from such sources.

Enabling the Platform to facilitate and process PA Services; KYC authentication; transaction processing and reconciliation; enabling customer support; research and development; enabling communications between you and us; marketing and outreach; automated decisions; legal compliance and requirements; product innovation.

Affiliates: To allow you a seamless experience on the App and avoid asking you to re-enter your information, we may, with your consent, collect your information from our Affiliates, in accordance with their respective privacy policies and applicable laws. This may include data from Navi Limited (formerly known as Navi Technologies Limited), and the Navi App, for instance, your account data to auto-fill your details or financial SMS data, app data, etc., for enhanced experience. For more details about the information collected by our Affiliates, please refer to their respective privacy policies.

Enabling the Platform to provide the PA Services; KYC authentication; enabling customer support; research and development: enabling communications between you and us; marketing and outreach; automated decisions; legal compliance and requirements; product innovation; loan servicing and monitoring.

We may supplement the Personal Data that you provide, with other information that we obtain from our dealings with you or which we receive from other organizations, for example, Third Parties or Affiliates.

You are requested to provide us with accurate and complete Personal Data in order to avail the PA Services. We request that any change to your Personal Data be communicated to us, for us to service you better.

3. YOUR CONSENT FOR USAGE AND SHARING OF YOUR PERSONAL DATA

Summary: We collect your Personal Data from you only in accordance with the explicit consents obtained from you and after informing you about the consequences of refusing to provide Personal Data or withdrawing consent for the identified purposes. By applying for PA Services, you have consented to all our data privacy practices. You can write to [email protected] if you wish to revoke any consent.

You consent to our processing of your data, including Personal Data, in accordance with this Policy, by checking the check box presented with this Policy or continuing to transact using our PA Services. To take your prior and explicit consent, we will provide you with appropriate options within the App, to give or deny the consent for the use of data, to permit disclosures to third parties, to retain data, etc., as per the applicable law. We will also disclose the purpose of obtaining your consent at appropriate stages of interface within the Platform. By providing your explicit consent, you agree to our service providers’ processing, storage, usage, and sharing of the data provided by you pursuant to this Policy.

Additionally, you understand and acknowledge the following terms in respect of your consent for our collection and usage of your Personal Data:

We maintain an auditable record of such consents granted, modified or withdrawn by users.
All Personal Data provided by you is in relation to the PA Services.
You may also withdraw or modify your consent to collect / provide / share / process any data provided by you (including your Personal Data) by communicating to the email ID provided in Paragraph 1 above. However, in such instance, (i) you may not be able to avail some or all of the features or pages of the PA Services; or (ii) if you have already availed the PA Services, such PA Services may be withdrawn, curtailed or cancelled as per the terms thereof upon such withdrawal or modification of consent.
Notwithstanding any withdrawal or modification of consent under this Policy, we may continue to retain data attributes that are necessary to be retained under applicable laws or for fraud detection and prevention, regulatory reporting purposes, chargebacks, or dispute management.
If you have already availed PA Services, your request for data deletion and withdrawal of consent would be considered once you have discharged all your obligations related to the PA Services.
In some cases, it is essential for the data you provide (including your Personal Data) to be collected / retained / stored / processed / shared either regulatorily, or as a matter of policy or for any of the purposes above and you are requested not to avail the PA Services if you do not wish to provide such information or provide consent to collect / share / process the same. For any queries in this regard, you may contact the email IDs mentioned under Paragraph 1 above of the Policy.
We ensure that an appropriate data privacy commitment is provided to you and your express consent for seeking, collecting, storing, utilizing and sharing your Personal Data is obtained at the time of or before collecting your Personal Data including any sensitive Personal Data either by the terms of this Policy or otherwise.
Any Personal Data collected is stored in secure databases protected via a variety of access controls and is treated as confidential information by us. You should be careful with usage of your username and password by maintaining confidentiality and ensure that you do not knowingly or accidentally share, provide and facilitate unauthorised use of it.
We may collect your data (including any Personal Data) from publicly available sources in accordance with applicable laws for providing you with the PA Services and purposes in relation to the same.
We may also obtain your data (including any Personal Data) from independent third parties, as governed by their respective privacy policies, including payment partners, acquiring banks, card networks, other financial institutions, technology providers, e-commerce platforms, fraud prevention agencies, independent service providers, our Affiliates, etc.

4. HOW AND WHERE DO WE COLLECT AND STORE YOUR DATA?

Summary: We collect your data (including Personal Data) from the inputs provided by you on our Platform, from communications made by you with us, or any document provided by you to us, or from third parties identified in this Policy. We ensure to keep your data safe and adopt appropriate practices in accordance with Applicable Laws.

When you download the Navi App, sign up with us for an online account, register to receive marketing communications from us, fill in one of our forms (whether online or offline), contact us or otherwise expressly provide us with your Personal Data, we may collect and store any Personal Data that you provide to us and may use it to personalize and improve your experience on the Platform, provide PA Services or any other service you may request from us, and carry out profiling and market research.
We may also collect your Personal Data through your conversations (telephonic or otherwise) with the representatives or any of our customer service agents and / or any other mode of communication or submitted by you vide documents, images or in any other form and whether in the physical or digital / online mode including but not limited to social media. You agree that any such communication whether written or oral may be recorded to comply with our internal processes or any Applicable Laws.
The App may contain advertisements and banners to third-party offerings. Such advertisements and banners may operate as links to the advertiser’s website / platform, and as such any information they collect by virtue of your clicking on that link will be collected and used by the relevant advertiser in accordance with the privacy policy of that third-party advertiser.
The Personal Data collected from you is stored at our backend servers and / or cloud servers situated in India in compliance with applicable Reserve Bank of India (RBI) directives on the storage of payment system data.
Your Personal Data may be stored on an as-is basis, or in an encrypted form.
We shall only collect the above-mentioned data on a need-basis strictly for the purpose of providing you with the PA Services, or any other service specifically requested by you.

5. HOW DO WE SHARE THE COLLECTED INFORMATION?

Summary: Please note that while none of your data is sold, it is shared with third parties for providing you with PA Services.

We are very protective about your data. We may share your data with third parties for the following purposes:

Type of party	Purpose of sharing
Affiliates, and group companies	– Onboarding you on the Navi App and completing your profile creation – Validating and authenticating the official verification documents provided by you – Assisting us with managing any post-purchase activity – Analyzing customer behaviour, conducting research into customer behaviour and contacting the customers for the said purpose, and to automate our marketing and outreach efforts – To personalize and improve your experience of PA Services – To personalize and / or tailor any communications that we may send you – For undertaking joint marketing related to products and services of our Affiliates – Developing and maintaining core systems – Detecting and flagging of fraudulent activities – Availing data and analytics services – To notify you of any updates to the Platform or changes to the PA Services – To carry out our obligations arising from any contract entered into between you and us, you and our Affiliates, or us and our Affiliates – Gathering of additional information regarding your bank account and statement details, in case adequate information has not been provided by you or through the other service providers we work with – Availing cyber-security and disaster recovery services
Third parties (Payment Partners, Acquiring Banks, Card Networks, Merchants, and Tech Vendors)	– Validating and authenticating the official verification documents provided by you – Validating and authenticating your Personal Data – facilitating payment processing, settlement, and chargeback/refund handling – Assisting us with managing any post-purchase activity – Analyzing customer behaviour, conducting research into customer behaviour and contacting the customers for the said purpose, and to automate our marketing and outreach efforts. – To personalize and improve your experience of PA Services – To personalize and / or tailor any communications that we may send you – For undertaking joint marketing related to Products and Services of third parties – Developing and maintaining core systems – Detecting and flagging off fraudulent activities – Availing cloud services – Availing data and analytics services – To carry out our obligations arising from any contract entered into between you and us, you and such third parties, or us and third parties – Availing cyber-security and disaster recovery services
Government and Regulatory Agencies	If any governmental authority or law enforcement officers request or require any information and we think disclosure is required or appropriate in order to comply with laws, regulations, or a legal process, we may share such required information with the governmental authority or law enforcement officers.

Additionally, while negotiating or in relation to a change of corporate control such as a restructuring, merger or sale of our assets, we may have to disclose our databases and information we have stored in the course of our operations.

Third Party Services

The Platform may allow you to connect with other websites, products, or services that we don’t have control over. However, usage of such third-party services is subject to their privacy policies and not within our control. We recommend that you have a look at their privacy policies before agreeing to use their services.

6. WHAT ARE YOUR RIGHTS?

Summary: We have identified your rights in the table below and the manner in which you may exercise these rights.

It is important for us that you remain in control of your data. Please write to us at [email protected] if you wish to exercise any of your rights under the Policy. You shall have the following rights:

S. No.	Your Right	Details
1	Right to rectification	In the event that any personal information provided by you is inaccurate, incomplete or outdated then you shall have the right to provide us with the accurate, complete and up to date data and have us rectify such data. It may take up to 10 days to process your request. We urge you to ensure that you always provide us with accurate and correct information / data to ensure your use of PA Services is uninterrupted.
2	Right to withdraw consent	Please refer to Paragraph 8 below. You may write to us at [email protected] to specifically deny your consent for use of any specific set / class of data you have shared with us, or restrict disclosure to any third parties as mentioned In Paragraph 3 above.
3	Right to opt-out	You can opt out of receiving push notifications through web notifications and your device settings. Please note that opting out of receiving push notifications may impact your use of the App.
4	Right to request deletion	You may request deletion of any data collected by us pursuant to this Policy by writing to us at [email protected]. We will strive to attend to your request within 30 days, subject to statutory retention obligations under applicable RBI and anti-money laundering regulations

7. WHAT IS OUR DATA SECURITY PRACTICE?

Summary: We aspire to keep your data and information as secure as possible and to that effect we have used state of the art software.

We use requisite technical and organizational security measures to ensure a level of protection for personal information appropriate to the nature, scope and purpose of processing personal data, the risks associated with such processing, and the likelihood and severity of the harm that may result from such processing. The transfer of personal information between your end device and us is generally carried out via best-in-class encryption protocols. If you communicate with us by e-mail, access by third parties cannot be ruled out. In the case of confidential information, you may choose to use alternative communication channels, such as post or encrypted e-mail communication.

8. HOW DO WE HANDLE INFORMATION SECURITY BREACHES?

We have internal policies in place to tackle incidents of information security breach. This process enables the incident response team to detect, analyse, contain, eradicate and recover from information security breach incidents.

9. DATA RETENTION

Summary: We retain your personal information to the extent we need to. Once the need for the retention expires, we will not hold onto it.

We do not retain your personal information for longer than required for the purpose for which the information may be lawfully used. Your Personal Data may be retained for a longer period where we need such information for legal, regulatory, accounting, processing or other legitimate purposes which may include but not be limited to filing / addressing complaints, handling chargebacks / transaction disputes ,responding to any queries raised by any of our regulators / customers / governmental bodies and defending any legal claims.

To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data, and whether it can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, we may anonymize your Personal Data so that it can no longer be associated with you and use such information. We may retain, use and process such irreversibly anonymised Data for such period as we deem necessary.

We store your personally identifiable data in our servers in encrypted form.

10. YOUR REPRESENTATIONS

You represent to us that you are above the age of 18 (eighteen) and are in contracting capacity to access our App and share your Personal Data with us.

In circumstances where you provide us with Personal Data relating to other individuals on their behalf (such as Personal Data relating to your family members, spouse, friends, or other parties), you represent and warrant that you have obtained such individual’s consent for, and hereby consent on behalf of such individual to, the collection, use, disclosure and processing of his / her Personal Data by us.

11. CHILDREN’S PRIVACY

PA Services are not directed to children, and we do not knowingly solicit or collect personal information from persons under the age of 18 (eighteen). If we find out that a child has given us personal information, we will take steps to delete that information and terminate the relevant PA Services Account.

12. COMMUNICATIONS FROM US

We may from time to time contact you via calls, SMS, emails, WhatsApp and other communication channels to provide you with information pertaining to PA Services, notifications on updates vis-à-vis PA Services (when we consider it necessary to do so), educational information and promotions. We may also notify you if we need to temporarily suspend the Platform or PA Services for maintenance, and keep you informed on security, privacy, or administrative-related communications. By setting up an account with us, you consent to us contacting you via call, SMS, push notifications, or any other communication channel, as we may deem fit.

13. UPDATES TO THIS POLICY

We may occasionally update this, Policy. Use of PA Services after an update constitutes consent to the updated notice to the extent permitted by law. Please take the time to periodically review this Policy for the latest information on our privacy practices.

14. GOVERNING LAW AND JURISDICTION

This Privacy Policy shall be governed by the laws of India and the courts of Bengaluru, India shall have the exclusive jurisdiction to try any dispute arising thereof.

15. SEVERABILITY

If any court or competent authority finds that any provision of this Policy (or part of any provision hereof) is invalid, illegal or unenforceable, such provision or part thereof (as the case may be) shall, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Policy shall not be affected and shall continue to apply.

*Navi Payment Technologies Private Limited holds an in-principle authorization from the RBI to operate as a Payment Aggregator under the RBI (Regulation of Payment Aggregators) Directions; final authorization remains subject to submission and review of the System Audit Report (SAR).