This is a global Privacy Policy that describes how Pine Labs, which term includes all its group companies (collectively referred to as “Pine Labs”, “Company”, “We”, “Us” or “Our”) collect, use, disclose, transfer, store, retain, and otherwise process Information, including Personal Data in connection with Your access to the Website and use of the Pine Labs Services (as defined herein).

By accessing the Website or using the Services, You acknowledge that You have read, understood, and agree to be bound by the terms of this Privacy Policy and, where required under Applicable Laws, provide Your consent to the collection and processing of Your Personal Data as described herein. For this Privacy Policy, the individual accessing the website or using the Services shall be referred to as “You”, “Your” or the “User”.

This Privacy Policy should be read in conjunction with the applicable Terms and Conditions of service, product or nature of relationship, as well as any other policies, notices, guidelines, or disclosures made available on the Website or otherwise communicated by Pine Labs from time to time.

1. DEFINED TERMS

“Information” or “Personal Data” refers to any Information associated with an identified or identifiable individual, which can include data that you provide to us, and that we collect about you during your interaction with our Services (such as device Information, IP address, etc.).

“Applicable Law” refers to relevant laws, statutes, regulations, rules, notifications, guidelines, directions, orders, judgments, and other legally binding requirements applicable to the collecting, storage, use of Personal Data in the relevant jurisdiction(s), such as the Digital Personal Data Protection Act, 2023 (DPDPA), Australia Privacy Act 1988, Singapore Personal Data Protection Act 2012 (PDPA), US privacy laws including CCPA, UAE Protection of Personal Data (PDPL), or Malaysia Personal Data Protection Act 2010 (PDPA).

Compliance with Applicable Law: This Privacy Policy is subject to relevant local laws to the extent of Pine Labs operations and nature of service or offering. To such extent only, local requirements, if more rigorous, shall prevail.

“Services” refer to products, services, platforms, applications, websites, software, devices, technologies, solutions, programs, features, content, support services, and related offerings provided, operated, distributed, or made available by Pine Labs, whether through online, mobile, digital, physical, or any other channel. This includes any products, services, features, functionalities, platforms, websites, applications, or offerings made available or offered by Pine Labs from time to time. Annexure A details broadly some key services or products offered by various group companies under Pine Labs, and broad types of Personal Data collected, stored and/or used, as per this Privacy Policy.

2. INFORMATION WE COLLECT OR RECEIVE ABOUT YOU

We need to collect, use, receive, process or store Information about you to provide you with the Services and to support your requests. This Information can vary depending on the jurisdiction from which you access our Services.

Information You Provide

We collect or receive Information you provide when you apply, use or sign up for any of our Services, go through our identity or account verification process, authenticate into your account, communicate with us, answer our surveys, upload content, or otherwise use our Services.

Information we collect or receive about you when you use our Services, including :

• Data about you: Your name, date of birth, gender, user IDs, signature, email addresses, phone numbers, addresses, contact details, government-issued KYC/identity documents (for example, Tax ID or other Government identity card as specified), biometric data, communications with us, device and location data, and Information about how you use our Services.
• Financial data: Bank account details, financial Information, payment credentials, transaction data, credit details (such as amounts, lending history and repayments), credit history, income details, payment Information (such as credit, debit card or gift card Information), and billing address through our payment processing system.
• Marketing and communication data: Your preferences relating to receiving marketing messages from us and our service providers, your communication preferences, and customer preferences such as spending patterns, preferences, and interests.
• Technical data: Device and technical Information you give us when using our website, such as IP addresses, cookie identifiers, or other unique identifiers, mobile carrier, time zone setting, operating system, and platform.
• Other Information You Provide: Information you voluntarily provide to us, including survey responses; participation in contests, promotions, or other prospective seller marketing forms or devices; suggestions for improvements; referrals; or any other actions performed on the Services.

User must ensure that all Personal Information that User provides us is accurate, up-to-date, and true. The User will be responsible for any errors, discrepancies, or inaccuracies in the Personal Information shared with us. When You use our Services, we make best efforts to provide you with the ability to access and correct inaccurate or deficient Personal Information, subject to legal requirements or Applicable Law.

Information We Collect or Receive From Other Sources

We also collect or receive Information about you from third parties, including:

• Identity Verification: Information from third-party verification services, credit bureaus, financial institutions, mailing list providers, and publicly available sources. In some circumstances, where lawful, this Information may include your government-issued identification number.
• Background Information: To the extent permitted by Applicable Laws, we may obtain background check reports from public records of criminal convictions and arrest records. We may use your Information, including your full name, government-issued identification number, and date of birth, to obtain such reports.
• Credit, Compliance and Fraud: Information from third parties in connection with credit investigations, credit eligibility, identity or account verification, fraud detection, collection procedures, or as required by Applicable Law. This includes the receipt and exchange of account or credit-related Information with credit reporting agencies, credit bureaus, and persons or corporations with whom you have had, currently have, or may have a financial relationship.

Information We Collect or Receive from a Child

Our Services may include offerings that are intended for or may be used by children who are below the age at which they may independently provide valid consent under Applicable Law.

Under this Privacy Policy, a “Child” means an individual below the age at which they may independently provide valid consent under Applicable Laws, which may vary by jurisdiction and may range from 13 to 18 years of age. If you are a Child, you will be required to provide the mobile number of your parent or legal guardian for consent and verification purposes. The Child should not interact with or register for our Services or submit Personal Data to us without parental or guardian consent.

If we obtain actual knowledge that a Child’s Information has not been provided with necessary guardian consent as required under Applicable Law, we will take action in accordance with Applicable Law. A parent or lawful guardian may contact us at DPO@pinelabs.com to submit a request concerning a Child’s Personal Data.

Your Consent to Collect, Use and/or Process Information

By providing your Information and using our Services, you expressly consent to the collection, use, storage, disclosure, sharing and processing of your Personal Data by the Company in accordance with this Privacy Policy. Depending on the nature of the service being provided:

• We may act as a Data Processor on behalf of Data Fiduciary(ies) and process your Personal Data strictly in accordance with their instructions.
• We may act as Data Fiduciary(ies) or Co-Data Fiduciary(ies), jointly with one or more entities where both parties independently or jointly determine the purposes and means of processing your Personal Data.
• In such cases, your Personal Data may be shared between and processed by us and such other Data Fiduciary(ies)/Co-Data Fiduciary(ies) for the purposes described in this Privacy Policy, including customer onboarding, service delivery, transaction processing, fraud prevention, compliance, customer support, analytics, risk management, and other legitimate business purposes.

3. HOW WE USE YOUR INFORMATION

We may use Information about you for a number of purposes, including:

Providing, Improving, and Developing our Services

• Determining whether the Services are available in your country; processing or recording payment transactions or money transfers; and otherwise providing the Pine Labs products and features you choose to use.
• Displaying your historical transaction or appointment Information; providing, maintaining and improving our Services; and developing new products and services.
• Delivering the Information and support you request, including technical notices, security alerts, support, administrative messages, dispute resolution, fee collection, and assistance for problems with our Services or your Pine Labs account.
• Improving, personalizing, and facilitating your use of our Services, and measuring, tracking, and analyzing trends and usage in connection with your use or the performance of our Services.
• Performing a contract for providing products or services; taking and handling orders; delivering products and services; and optimising our website to suit your interests and usage patterns.
• Getting in touch with you when necessary and sending materials regarding upcoming offers or Information that we deem material for you to be a fully informed user and customer of Pine Labs Services and visitor to the Website.

Communicating with You About our Services

• Sending you Information we think you may find useful or which you have requested about our products and Services, and conducting surveys and collecting feedback about our Services.

Protecting our Products and Services and Maintaining a Trusted Environment

• Investigating, detecting, preventing, or reporting fraud, misrepresentations, security breaches or incidents, and other potentially prohibited or illegal activities; helping protect your account, including to dispute chargebacks on your behalf.
• Protecting our, our customers’, or your customers’ rights or property, or the security or integrity of our Services; enforcing our Terms of Use or other applicable agreements or policies; and verifying your identity.
• Complying with Applicable Laws or regulations, or responding to lawful government requests or legal process; fulfilling any other disclosed purpose; and contacting you to resolve disputes, collect fees, and provide assistance with our Services.

Advertising and Marketing

• Communicating with you about opportunities, products, services, contests, promotions, discounts, incentives, surveys, and rewards offered by us and select partners. Marketing emails contain instructions permitting you to opt out of future marketing or other communications from the relevant company.

Other Uses

• For any other purpose disclosed to you in connection with our Services from time to time and based on your opt-in consents obtained for such purposes.

4. LEGAL BASIS FOR PROCESSING, RESEARCH AND TRAINING

Depending on the jurisdiction and context in which Personal Data is collected and processed, we may process Personal Data on one or more lawful bases, including performance of a contract; compliance with legal and regulatory obligations; our legitimate business interests; prevention, detection, protection and investigation of fraud or security threats; conducting research, analytics, product development, and the training, testing, validation, and improvement of artificial intelligence and machine learning models and related technologies; and your consent where required by Applicable Law.

5. HOW WE SHARE YOUR INFORMATION

We may share Personal Data belonging to you with your consent and at your direction, or as described when you agree to share. We may also share your Information when you authorize a third-party application or website to access it.

With Other Users of our Services with Whom You Interact

We may share Information with users with whom you interact through your use of our Services, for example when you make or accept a payment, appointment, or money transfer.

With our Affiliates

We may share Information with our group companies and corporate affiliates for agreed purposes outlined in this Policy or pursuant to applicable agreed contractual arrangements.

With Third Parties

We may share Information with third parties to provide, maintain, secure, support, and improve our Services, including technology infrastructure and hosting providers; communication service providers; identity, verification and compliance service providers; payment and financial service providers; and operational and transaction support providers. We may also share Information with third parties that conduct advertising campaigns, promotional programs, contests, special offers, or other activities on our behalf or in connection with our Services, and with financial institutions, payment networks, payment card associations, credit bureaus, merchants, lending service providers, partners, or other entities in connection with the Services.

Business Transfers and Corporate Changes

We may disclose Information to a subsequent owner, co-owner, or operator of one or more Services, or in connection with a corporate merger, consolidation, restructuring, sale of substantially all stock and/or assets, financing, acquisition, divestiture, dissolution, or other corporate change.

Safety and Compliance with Applicable Law

We may disclose Information where reasonably necessary to comply with Applicable Law, regulation, legal process, or governmental request; enforce applicable agreements or policies; protect rights, property, security, or integrity; or protect us, users, or the public from harm, fraud, or potentially prohibited or illegal activities.

Aggregated and Anonymized Information

We may share aggregated and anonymized Information within our group of companies or with third parties where it does not specifically identify you or an individual user of our Services.

6. HOW LONG WE RETAIN YOUR INFORMATION

We retain your Information as long as reasonably necessary to provide you the Services or comply with Applicable Law. We will remove your Personal Data after the purpose of collecting such data is achieved, as per the consent obtained by you. Even after you deactivate your account or place such requests, we may retain copies of Information about you and transactions or Services in which you participated for a period consistent with Applicable Law, statutes of limitation, and needs such as fraud prevention, fee collection, dispute resolution, investigations, enforcement of our Terms of Use, or other actions consistent with Applicable Law.

7. CROSS BORDER DATA MOVEMENT

Pine Labs may transfer Personal Data to countries where we, our group companies, or service providers operate. Such transfers will be made in accordance with Applicable Law and subject to required safeguards, including contractual protections, data minimisation, access controls, and appropriate technical and organisational measures. Where Applicable Law requires local storage or restricts cross-border transfers, we will comply with those requirements.

8. COOKIES AND OTHER SIMILAR TECHNOLOGIES

We use technologies to collect or receive Information when you access or use our Services, including cookies and web beacons. Cookies are small data files stored on your hard drive or device memory when you visit a website or view a message. They support the integrity of our registration process, retain preferences and account settings, and help evaluate aggregated statistics about user activity. By using our Services and according to your cookie settings, you permit us to collect, receive, and use Information from activity on your devices in accordance with this Privacy Policy.

Some cookies last only for the duration of your session and expire when you close your browser or exit the application. Others remember you when you return to the Services and last longer.

We may use cookies to:

• Remember previous visits or use of the Services, identify unique visitors, and provide sufficient capacity for users.
• Customize promotional layouts or content; collect data about your interactions with our Services; and assess and improve advertising campaigns.
• Allow business partners to use tracking technologies to track behaviour on our behalf on our website/platform and partner websites, and enable third parties to collect data about interactions across sites outside our Services.
• Collect anonymous statistical Information about use of the Services, session length, and access location to improve the Services and understand popular elements and functions.

Some cookies are set by us and others by third parties delivering services on our behalf. You will be presented with a cookie banner when visiting our Website and Platforms, where you can select your cookie preferences. Blocking, deleting, or disabling cookies may prevent you from taking full advantage of the Services.

We may also collect or receive Information using web beacons, electronic images used in our Services or emails. They help us deliver cookies, track website and app visits, understand usage and campaign effectiveness, and determine whether an email has been opened and acted upon. This Website may contain links to other websites; we are not responsible for the privacy practices of websites we do not own, manage, or control. Please find more details in our Cookie Policy.

9. THIRD-PARTY ADVERTISING AND ANALYTICS

We may use third-party service providers for site metrics and other analytics services. These providers may use cookies, web beacons, and other technologies to collect Information such as IP addresses, device identifiers, other applications on your device, browsers, webpages viewed, time spent on webpages, links clicked, and conversion Information. Pine Labs and providers acting on our behalf may use this Information to analyze and track use of our Services, determine content popularity, and better understand how you use our Services. Such providers are bound by confidentiality obligations and other restrictions regarding their use and collection of your Information.

This Privacy Policy does not apply to, and we are not responsible for, third-party cookies, web beacons, or other tracking technologies; these are covered by the respective third parties’ privacy policies.

10. YOUR RIGHTS AND CHOICES

Deactivating Your Account

You may deactivate your account through account settings for the relevant Service or by contacting us through the channels below. Deactivating your account does not necessarily delete your Personal Data. We may retain Personal Data where required or permitted by Applicable Law, including for regulatory compliance, fraud prevention, dispute resolution, security, and record-keeping.

Location Information

Certain Services may require precise geolocation to provide a feature, prevent fraud, maintain security, or comply with Applicable Law. Where required, we will obtain your consent or device permission before collecting it. You may manage location permissions in your device settings; disabling location access may prevent the relevant feature from operating.

Promotional Communications

You may receive promotional, marketing, and other commercial communications from us based on your consent. You may opt out by following the instructions in those messages or, for tele-offers, telling the caller you prefer to opt out. This will not affect transactional, security, legal, administrative, or other non-promotional communications relating to the Services.

Your Data Protection Rights

Subject to Applicable Laws, you may exercise rights related to your Personal Data through our Privacy Center where active, or by writing to DPO@pinelabs.com. These rights may include:

• Correction or erasure: You may modify, update, or request erasure of Personal Data. We may need to retain certain data to provide products or Services or comply with legal obligations, and will provide appropriate reasons where applicable.
• Access: You may request a summary of your Personal Data and processing activities, categories of Personal Data, identities of other recipients of your Personal Data, and other Information required by Applicable Law.
• Withdrawal of consent: Where we rely on consent, you may decline or withdraw it for a particular purpose. This does not affect processing before withdrawal, and legal obligations may require us to continue some processing. You may also ask us to stop using your Personal Data for direct marketing.
• Nomination: You may nominate an individual who may exercise your rights in the event of your death or incapacity in accordance with Applicable Law. You may provide the nominee’s name, email address, and phone number through the methods above.
• Grievance redressal: You may contact us regarding concerns about Personal Data or this Privacy Policy. We will respond to grievances within 90 days. You may also raise questions or complaints with your local data protection authority. Where your Personal Data is processed in India and you are dissatisfied with our response, you may complain to the Data Protection Board of India in accordance with Applicable Law.

We may need to verify your identity before responding to certain requests. If you have an account, we may verify you through login credentials; otherwise, we may request email confirmation or relevant identification. You may authorise an agent to make a request, and we will verify the agent’s identity or authority.

Your rights and choices vary by location. Some Personal Data may be exempt from requests under Applicable Law. We need certain Personal Data to provide the Services, and deletion may mean you can no longer access or use them.

11. SECURITY

We take reasonable administrative, technical, and physical safeguards to protect your Information from loss, theft, misuse, and unauthorised access, disclosure, alteration, and destruction. However, the internet is not a 100% secure environment, and we cannot guarantee absolute security of transmission or storage. We hold Information at our premises and with the assistance of third-party service providers.

12. CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy from time to time by posting a revised version and updating the “Effective Date” above. Amendments may include additions of products, group companies, affiliates, or Services offered as part of the Pine Labs environment. The revised version is effective on its listed Effective Date. We will provide reasonable prior notice of material changes in how we use your Information, including by email if you provided an email address. If you disagree, you may cancel your account. Your continued use of our Services constitutes consent to an amendment.

13. CONTACT DETAILS

Please contact our Data Protection Officer with questions or concerns regarding this Privacy Policy or security at DPO@pinelabs.com.

If you have questions or concerns regarding our Policy, or believe our Policy or Applicable Laws relating to protection of your Personal Data have not been respected, you may file a complaint with our Data Privacy Office. We may request additional details and consult other parties to investigate and address your issue. We may keep records of your request and its resolution.

14. JURISDICTION

Your access to and use of the Website is subject to this Privacy Policy and the applicable Terms of Use. Any dispute arising from or relating to this Privacy Policy shall be governed by the law and jurisdiction specified in the applicable Terms of Use, to the extent permitted by Applicable Law.

Nothing in this Privacy Policy limits or excludes mandatory rights or remedies available under Applicable Law, including the right to submit a complaint to or seek relief from a competent data protection authority, regulator, or court. Any dispute, controversy, or claim arising out of or in connection with this Privacy Policy shall be governed by law and the exclusive jurisdiction of the Court(s) located in the relevant jurisdiction.

Note: This Policy is aligned with the DPDPA and is to come into effect post DPDPA implementation in the Pine Labs environment, and before 13^th May 2027.

ANNEXURE A

Payment Services: The core payments business provides merchant acquiring, POS machines, payment gateway services, QR payments, Buy Now Pay Later, EMI solutions, marketplace or acceptance infrastructure for online and offline merchants. It enables businesses to accept digital payments across cards, UPI, wallets, and other payment modes.

Issuing Business Services: Card issuance and embedded financial products, including prepaid solutions such as gift cards, brand wallets, refunds, promo vouchers, transit cards, expense management cards, e-RUPI vouchers, fuel cards, forex cards, and more.

Setu: API-based infrastructure that enables businesses to embed regulated financial services within their products and platforms, including digital onboarding and identity verification, electronic signature, payments and collections, bill payments, and consent-based access to financial information under the Account Aggregator framework.

Shopflo: A technology-enabled checkout platform integrated into the storefronts of select third-party online brands and retailers, i.e. Merchants, who offer purchase of goods/services online.

Fave India: A UPI-powered financial platform for shared money management, offering group and household finances, UPI payments, utility bill and salary payments, savings and expense splitting, gifting, and personal finance management.

We may actively collect the following Personal Data about you when you visit our platform: