Privacy Policy

1. Introduction

This Privacy Policy describes how GoFastFlowPe Solutions Pvt Ltd ("FastFlowPe", "FastFlowPeTM", "we", "us", "our"), a company incorporated under the Companies Act, 2013 (CIN: U62099KA2025PTC197377; GSTN: 29AALCG7378K1ZP), acting as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), collects, uses, processes, stores, and protects information in connection with our Services.

Our Services include our website located at www.fastflowpe.com, dashboards, applications, onboarding portals including go.fastflowpe.com, our Payment OS and related products including BankLynkTM, PSaaS, OptiPayTM and Universal Checkout, and any other services offered by FastFlowPe that link to this Policy.

Registered Office: #108 Startup Huts, 2nd Floor, 27th Main Road, Sector 2, HSR Layout, Bangalore - 560102, Karnataka, India.

Corporate Office: #108 Startup Huts, 2nd Floor, 27th Main Road, Sector 2, HSR Layout, Bangalore - 560102, Karnataka, India.

This Policy does not apply to third-party websites, applications, or services that may be linked to or integrated with the Services, including those of partner banks, PSPs, NPCI, or merchants using FastFlowPe's infrastructure. We encourage you to review the privacy policies of such third parties separately.

This Policy should be read together with our Terms of Service, Cancellation and Refund Policy, Account Aggregator Policy, and Anti-Money Laundering Policy.

2. Key Definitions

• Data Principal means the individual to whom the Personal Data relates. Where the individual is a child, Data Principal includes their parent or lawful guardian.
• Data Fiduciary means FastFlowPe (GoFastFlowPe Solutions Pvt Ltd), which determines the purpose and means of processing Personal Data.
• Data Processor means any person who processes Personal Data on behalf of FastFlowPe, such as cloud hosting or KYC verification vendors.
• Personal Data means any data about an individual who is identifiable by or in relation to such data.
• Processing means a wholly or partly automated operation or set of operations performed on digital Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, indexing, sharing, disclosure, erasure, or destruction.
• Consent Manager means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review, or withdraw consent through an accessible, transparent, and interoperable platform, where applicable to our Services.
• Significant Data Fiduciary means a Data Fiduciary notified as such by the Central Government based on factors such as volume or sensitivity of data processed, risk to Data Principal rights, and impact on sovereignty and electoral democracy.

3. Who This Policy Applies To

This Policy applies to:

• Visitors to our Website.
• Banks, NBFCs, and financial institutions that partner with FastFlowPe for TSP or PSaaS infrastructure.
• Businesses, merchants, and platforms that use FastFlowPe's Services to collect, disburse, reconcile, or route payments.
• End-customers of Business Users, to the extent their transaction data passes through FastFlowPe's infrastructure.
• Employees, contractors, vendors, consultants, and job applicants of FastFlowPe.

4. Personal Data We Collect

We collect only the Personal Data reasonably necessary for specified, lawful purposes, consistent with the data minimisation principle under the DPDP Act.

Business and KYC Information: entity name, constitution, PAN, GST registration, CIN/LLPIN, KYC/KYB documents, proof of identity and address, authorized signatory details, and other documents required for onboarding, risk-graded KYB, and regulatory screening.

Financial and Payment Information: bank account numbers, IFSC codes, virtual account details, UPI IDs/VPAs, NEFT/IMPS/RTGS details, and transaction metadata such as amount, currency, timestamp, payment mode, and transaction status.

Technical, Log, and Device Information: IP address, browser type, device identifiers, operating system, geo-location where permitted, pages visited, referring and exit URLs, API call logs, request and response metadata, and error logs generated through our dashboards, APIs, or smart routing and reconciliation systems.

Communications Data: information you provide when contacting support@gofastflowpe.com, submitting a partnership or business inquiry at info@gofastflowpe.com, subscribing to updates, or participating in surveys.

Information from Third Parties: information received from partner banks, NPCI, PSPs, card networks, credit bureaus, or Account Aggregators with your consent under our AA Policy, to the extent necessary to complete a transaction, perform verification, or assess risk.

We do not knowingly collect sensitive categories such as biometric data, health records, religious or political beliefs, or genetic information, unless specifically required for a regulated onboarding process and permitted under applicable law.

5. Notice and Purpose of Processing

In accordance with Section 5 of the DPDP Act, before or at the time of requesting consent, we will provide an itemised notice describing the Personal Data to be collected and the purpose of processing.

We will not process Personal Data for any purpose beyond what was notified to you, except where processing is permitted without consent under Section 7 of the DPDP Act, such as compliance with law, response to a medical emergency, or purposes related to employment.

• Onboard and verify banks, Business Users, and their authorized representatives.
• Provision and operate Services such as virtual accounts, collections, payouts, escrow, smart routing, tokenization, and reconciliation.
• Facilitate real-time transaction processing across UPI, NetBanking, RuPay, and other rails.
• Perform risk assessment, fraud detection, AML/KYC screening, and compliance checks under applicable law.
• Monitor system health, improve uptime, and optimize routing and success rates.
• Communicate onboarding status, service updates, security alerts, and support messages.
• Send product updates, newsletters, or marketing communications where you have opted in.
• Enforce our Terms of Service and this Policy, and investigate suspected fraud, misuse, or illegal activity.
• Comply with directions from the Reserve Bank of India, NPCI, law enforcement, or other regulators.

6. Consent

Where we rely on your consent to process Personal Data, that consent will be free, specific, informed, unconditional, and unambiguous, indicated through a clear affirmative action, and limited to Personal Data necessary for the specified purpose, consistent with Section 6 of the DPDP Act.

Every request for consent will be presented in clear and plain language, giving you the option to access it in English or any language listed in the Eighth Schedule to the Constitution of India.

You have the right to withdraw consent at any time, as easily as it was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, but may mean we can no longer provide certain Services that depend on that processing.

To withdraw consent, write to us at the contact details in Section 16, or through any Consent Manager platform we may make available.

Certain processing, such as transaction records required for RBI compliance or disclosures to law enforcement, does not require consent where permitted under the DPDP Act and other Applicable Laws.

7. Cookies and Similar Technologies

Our Website and dashboards may use cookies and similar technologies to recognize your browser, remember preferences, and understand usage patterns.

You can configure your browser to refuse cookies, though this may limit certain features of the Services.

We may use third-party analytics tools for aggregate usage statistics. These providers do not receive your name, financial details, or other directly identifying Personal Data through such tools.

8. Sharing and Disclosure of Information

We do not sell your Personal Data. Any Business User or bank receiving data through FastFlowPe's infrastructure to fulfil a transaction is independently responsible for its own use of that data and may act as an independent Data Fiduciary. We are not liable for third-party data practices beyond our contractual obligations with them.

We may share Personal Data with:

• Banking and PSP partners integrated into FastFlowPe's infrastructure, strictly to complete the transaction, collection, payout, or reconciliation initiated by you or your platform.
• NPCI and card networks, as required to route UPI, RuPay, or NetBanking transactions.
• Regulators and government authorities, including RBI, the Data Protection Board of India, law enforcement, or courts, where required under Applicable Law, court order, or lawful government request.
• Data Processors and service providers, including cloud hosting, KYC verification vendors, and SMS or email providers, who are contractually bound to process data only for specified purposes and maintain reasonable safeguards.
• Affiliates and successors in connection with any merger, acquisition, restructuring, or sale of assets, subject to equivalent privacy protections.
• Auditors, Data Protection Officers, and certification bodies for ISO, VAPT, PCI-DSS, or DPDP Act compliance audits.

9. Data Security and Breach Notification

We maintain reasonable security safeguards appropriate to the sensitivity of the Personal Data we process, as required under Section 8(5) of the DPDP Act and the Information Technology Act, 2000.

Safeguards include ISO-aligned security controls, periodic VAPT, risk-graded onboarding checks, and encryption of sensitive data in transit and at rest.

In the event of a personal data breach, we will, as required under Section 8(6) of the DPDP Act, intimate the Data Protection Board of India and affected Data Principals in the form and manner prescribed under applicable rules.

No method of internet transmission or electronic storage is completely secure. While we work to protect your information using industry-standard safeguards, we cannot guarantee absolute security, and you acknowledge this inherent risk when using the Services.

10. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required to comply with legal obligations, in line with Section 8(7) and Section 8(8) of the DPDP Act.

Where there is no legal obligation to retain Personal Data, we will erase it and cause our Data Processors to erase it when the specified purpose ceases to be served, subject to applicable law.

• Transaction and KYC records are retained for periods mandated by RBI, PMLA, and other Applicable Laws.
• API and system logs are typically retained for up to 12 months, unless a longer period is required by law or an active investigation.
• Marketing and communication preferences are retained until you withdraw consent or unsubscribe.

11. Your Rights as a Data Principal

Under Chapter III of the DPDP Act, you have the following rights. We will respond to verified requests within the timelines prescribed under the DPDP Act and its rules.

Please note that exercising certain rights, such as erasure, may limit or prevent our ability to provide Services and will not affect the lawfulness of processing carried out before the request.

• Right to access information: obtain a summary of Personal Data we process about you, processing activities undertaken, and identities of Data Processors and other Data Fiduciaries with whom your Personal Data has been shared.
• Right to correction and erasure: request correction of inaccurate or misleading Personal Data, completion of incomplete Personal Data, updating of Personal Data, and erasure of Personal Data no longer necessary for its purpose unless retention is required by law.
• Right of grievance redressal: raise a grievance with us regarding processing of your Personal Data before approaching the Data Protection Board of India.
• Right to nominate: nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.
• Right to withdraw consent at any time.

12. Links to Other Websites

The Website may contain links to third-party websites, banking partner portals, or NPCI/PSP resources for your convenience. We do not control and are not responsible for the privacy practices of these third parties. We recommend reviewing their respective privacy policies.

13. Grievance Redressal

If you have questions, complaints, or concerns about this Policy or how your Personal Data is handled, please contact our Grievance Officer.

Grievance Officer: Debasish Das.

Company: GoFastFlowPe Solutions Pvt Ltd.

Registered Office: #108 Startup Huts, 2nd Floor, 27th Main Road, Sector 2, HSR Layout, Bangalore - 560102, Karnataka, India.

Email: info@gofastflowpe.com.

We aim to acknowledge and address grievances within timelines prescribed under the DPDP Act, the Information Technology Act, 2000, and applicable RBI guidelines. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India, subject to its prescribed procedure.

If FastFlowPe is notified as a Significant Data Fiduciary under Section 10 of the DPDP Act, we will additionally appoint a Data Protection Officer based in India, who will be the point of contact for grievance redressal, and undertake periodic Data Protection Impact Assessments and independent data audits as required.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or Services, including new products under our Payment OS.

Material changes will be notified through a prominent notice on the Website or by email, and where required by law, we will seek fresh consent. Non-material changes take effect upon publication.

Continued use of the Services after any update constitutes acceptance of the revised Policy.

15. Governing Law and Jurisdiction

This Policy is governed by the laws of India, including the DPDP Act, 2023 and the Information Technology Act, 2000.

Any disputes arising out of or relating to this Policy shall be subject to the exclusive jurisdiction of the competent courts at Ahmedabad, Gujarat, India, without prejudice to the Data Protection Board of India's jurisdiction over DPDP Act complaints.

16. Contact Us

For any questions about this Privacy Policy, please reach out to:

GoFastFlowPe Solutions Pvt Ltd.

Registered Office: #108 Startup Huts, 2nd Floor, 27th Main Road, Sector 2, HSR Layout, Bangalore - 560102, Karnataka, India.

Corporate Office: #108 Startup Huts, 2nd Floor, 27th Main Road, Sector 2, HSR Layout, Bangalore - 560102, Karnataka, India.

Email: info@gofastflowpe.com.

Website: www.fastflowpe.com.