Welcome to Upwards Fintech Services Private Limited. The domain name www.upwards.in (hereinafter referred to as "website") are owned by Upwards Fintech Services Private Limited. The content of this website is the property of Upwards Fintech Services Private Limited (the “Company”). The Company is in the business of providing technology services to financial institutions and facilitating services to retail customers availing financial products from these financial institutions via this website (“Services”).
- The term ‘Company’ shall mean ‘UPWARDS FINTECH SERVICES PRIVATE LIMITED’ a private limited company limited by shares and registered under the Companies Act, 2013 and having its registered office at 501-A, Pinnacle Corporate Park, BKC, Vill Kole Kalyan, Near Trade Centre, Mumbai - 400051, Maharashtra. The Company is the exclusive licensee in Indian Territory of the website and App.
- The term ‘website’ shall mean www.upwards.in. “App” shall mean Upwards mobile application platform, and any other application or software run under the brand name “Upwards”. Activities including digital lending are undertaken via the Append this App may be used by other NBFCs as well and the App, and other activities including promotional activities may be undertaken via the App in the future.
- The term ‘You’, ‘Your’ & ‘User’ shall mean any legal person or entity accessing or using the services provided on this Website, who is competent to enter into binding contracts, as per the provisions of the Indian Contract Act, 1872.
- The terms ‘We’, ‘Us’& ‘Our’ shall mean the website/domain/append and the Company (collectively referred to as the “Platform”), as the context so requires. This Policy will be applicable to the Company to the extent applicable under the IT (RSP) Rules (defined hereinafter) and the DLG Guidelines to the extent applicable.
- We are committed to safeguarding your privacy and ensuring that you continue to trust us with your personal data. When you interact with us you may share personal information with us which allows identification of you as an individual. This is known as personal data.
- Various non-banking financial institutions are responsible for the loan and other facilities provided through the App. You acknowledge that such non-banking financial institutions, as per the Reserve Bank of India’s (“RBI”) guidelines, will be responsible for their respective contents displayed on the App, loan and other facilities offered. Upwards reserves the right, subject to prevailing RBI guidelines, in its sole discretion to remove any content or data, information or material from the App from time to time.
- Please do not host, display, upload, modify, publish, transmit, store, update or share any information on the Platform: (i) belongs to another person and to which the user does not have any right; (ii) is defamatory, obscene, pornographic, paedophilic, invasive of other’s privacy including bodily privacy, insulting or harassing on the basis of gender, libellous, racially or ethnically objectionable, relating or encouraging money laundering or gambling, or otherwise inconsistent with or contrary to the laws in force; (iii) is harmful to child; (iv) infringes any patent, trademark, copyright or other proprietary rights; (v) violates any law for the time being in force; (vi) deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates any information which is patently false or misleading in nature but may reasonably be perceived as a fact; (vii) impersonates another person; (viii) threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to the commission of any cognisable offence or prevents investigation of any offence or is insulting other nation; (ix) contains software virus or any other computer code, file or program designed to interrupt, destroy or limit the functionality of any computer resource; (x) is patently false and untrue, and is written or published in any form, with the intent to mislead or harass a person, entity or agency for financial gain or to cause any injury to any person.
- This Policy applies to the personal data and the sensitive personal data that we collect about you for the purposes of providing you with our services. Personal data or information as used in this Policy shall include sensitive personal data or information, as applicable. This Policy is formulated under the Information Technology Act 2000, the IT (RSP) Rules (defined hereinafter) and the Guidelines on Digital Lending issued by the Reserve Bank of India dated 2 September 2022(“DLG Guidelines”).
- We reserve the right to change this Policy without prior notice. We encourage you to regularly review this policy to ensure that you are aware of any changes and how your personal data may be used.
- Please note that this App also deals with activities part from digital lending as covered under the DLG Guidelines. Please note that with respect to digital lending under the DLG Guidelines, the following shall be applicable to the Company and the App: Company and the App shall ensure that lending service provider/App engaged by it do not store personal information of borrowers except some basic minimal data (viz., name, address, contact details of the customer, etc.) that may be required to carry out their operations. A one-time access can be taken for camera, microphone, location or any other facility necessary for the purpose of on-boarding/KYC requirements only, with the explicit consent of the borrower. Please note that separately, the aspects pertaining to DLG Guidelines as mentioned in this Policy shall only be applicable with respect to digital lending undertaking by App. With respect to the DLG Guidelines, respective parties shall comply with the extant RBI guidelines in this respect.
- DATA COLLECTED BY US
- Online and electronic interactions with us, including via the website, mobile applications, text messaging programs or through our pages on third party social networks.
- Your interaction with online targeted content (such as advertisements) that we or service providers on our behalf provide to you via third party websites and/or applications.
- Personal contact information, including any information allowing us to contact you in person. It would include, but is not limited to, users’ KYC details, borrowers’/users’ academic information and documents, co-borrowers/users’ financial documents, etc.
- Demographic information, including date of birth, age, gender, location. We may also collect the location data, if enabled by you to do so. Geolocation includes country of access, IP address, etc.
- User image, for us to cross check and verify the authenticity of the User and for prevention of fraud.
- Account login information including any information that is required for you to establish a user account with us. (e.g. login ID/ email, user name, password and security question/answer);
- Consumer feedback, including information that you share with us about your experience in using our services (e.g. your comments and suggestions, testimonials and other feedback)
- We may collect the Usage data, including but not limited to access date and time, platform features and/or pages viewed, type of browser, hardware models, operating systems and versions, software, mobile network data, etc.
- The data collected, as mentioned above, is solely restricted to the above-mentioned activities and will not be in further used for any other purpose. In case we use the data for any other purpose, explicit consent shall be taken from the customers.
- We will desist from accessing mobile phone resources like file and media, contact list, call logs, telephony functions from user phone resources.
- We will ensure that access to camera, microphone, location or any other facility necessary for the purpose of on-boarding/ KYC requirements and only with the explicit consent of the user.
- We will ensure that biometric data is stored/collected in the systems, only in accordance with applicable law and the IT RSP Rules.
- We will ensure that all data is stored only in servers located within India, while ensuring compliance with statutory obligations/ regulatory instructions.
- You are provided with an option to give or deny consent for use of specific data, restrict disclosure to third parties, data retention, revoke consent already granted to collect personal data and if required, make the App (as defined under the DLG Guidelines) delete/forget the data. In case of withdrawal or modification of your consent or your amendment of any of your choices in this regard, we reserve the option not to provide the services or modify the services provided to you for which such information was sought.
- To facilitate our service.
- To provide the service on our behalf.
- To perform service-related services; or
- To assist us in analyzing how our service is used.
- DIVULGING/SHARING OF PERSONAL INFORMATION
- We may share your personal information with other corporate entities and affiliates to help detect and prevent identity theft, fraud and other potentially illegal acts; correlate related or multiple accounts to prevent abuse of our services, to facilitate joint or co-branded services, where such services are provided by more than one corporate entity, or if required to do so in course of our business operations. The third parties to whom your data may be disclosed shall not disclose the data further.
- We may disclose personal information if required to do so by law or if we in good faith believe that such disclosure is reasonably necessary to respond to subpoenas, court-orders, or other legal processes.
- Protection of App: We release personal information when we believe, release is appropriate to comply with the law; enforce or apply our User Terms and Conditions and other agreements; or protect the rights, property or safety of App, our users or others. This includes exchanging information with other companies, organizations, government or regulatory authorities for fraud protection and credit risk reduction.
- The Company shall tie up with authorized lenders to ensure you get the best financing options. We have currently ties up with the following financing partners (i.e. Lenders) –
- a. InCred Financial Services Limited
- b. Upwards Capital Private Limited
- c. Vivriti Capital Private Limited
- d. Aditya Birla Finance Limited
- e. HDB Financial Services Ltd
- f. PayU Finance India Private Limited
- USE OF PERSONAL INFORMATION
- THIRD PARTY ADVERTISEMENTS / PROMOTIONS
- DATA PROTECTION OFFICER AND GRIEVANCE REDRESSAL OFFICER
- DATA SECURITY & RETENTION
- All suspected or reported security breaches or violations shall be logged and tracked from initiation of the preliminary analysis to determine whether there was a security breach or violation till completion of actions taken.
- Appropriate contacts with relevant authorities shall be maintained to escalate to respective authorities as required, including the local cyber cell information.
- Below mentioned are the steps for handling security breach:
- Move quickly to secure the systems and fix vulnerabilities that may have caused the breach.
- Switch off the servers and change the access code to prevent additional data loss.
- Mobilize the breach response team right away to prevent additional data loss.
- Additional security required will be placed.
- Securely delete personally identifiable information (PII) and other sensitive data when it no longer needed for business purposes.
- if any security breach comes to our knowledge, then we may take all steps required to protect misuse of such information and may attempt to notify you electronically so that you can take appropriate steps.
- As per the Indian Computer Emergency Response Team (“CERT-In”) cyber-security directions under Section 70B (6) of the Information Technology Act, 2000 (CERT Directions), we shall report cyber incidents (as mentioned in Annexure I of the CERT Directions) within 6 (six) hours of noticing such incidents or being brought to notice about such incidents. For incidents not covered herein, we shall report cyber security incidents within a reasonable time of occurrence or noticing the incident to have scope for timely action under Rule 12(1)(a) of the CERT Rules, any entity affected by cyber-security incidents should. We shall report the cyber security incidents if they arise to: CERT- In via an email (incident@cert- in.org.in), Phone (1800-11-4949) and Fax (1800-116969). We shall comply with the Information Technology Act 2000 and the rules thereunder with respect to the applicable cyber security standards.
- YOUR RIGHTS
- DISCLAIMER, INDEMNITY AND LIMITATION OF LIABILITY. YOU EXPRESSLY UNDERSTAND AND AGREE THAT:
- It will be the sole responsibility of the user to ensure that the use of User Name, Password, PINs and one-time password are kept confidential and not disclosed to any third party, including any representative of the Company, or its agents and shall take all possible care to prevent discovery of the User Name or Password by any person.
- The information, content and materials on this Website and / or Services are provided on an "as is" and "as available" basis. The Company and all its subsidiaries, affiliates, officers, employees, agents, partners and licensors disclaim all warranties of any kind, either express or implied, including but not limited to, implied warranties on merchantability, fitness for a particular purpose and noninfringement.
- Though the Company has taken proper care and precaution to make the Website reliable, the Company does not warrant that the functions contained in content, information and materials on the Website and / or Services, including, without limitation, any third party sites or services linked to the Website and / or Services will be uninterrupted, timely or errorfree, or that the defects will be rectified, or that the Website or the servers that make such content, information and materials available are free of viruses or other harmful components. The Company will not be held responsible for any liability that may arise out of any such error in the Website.
- Any material downloaded or otherwise obtained through the Website and / or Services are accessed at your own risk, and you will be solely responsible for any damage or loss of data that results from such download to your computer system.
- You hereby indemnify, defend, and hold the Company, the Company's shareholders, directors, affiliates, distributors, agents, representatives and other authorized users, and each of the foregoing entities' respective resellers, distributors, service providers and suppliers, officers, directors, owners, employees, agents and representatives, harmless from and against any and all losses, damages, liabilities and costs arising from your use of the Website, including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of the Website.
- Certain services, such as retrieving user data from third party vendors and processing and attaching digital signatures to LAFs depends on continuous connection to the Website and third party servers. Company makes no assurance, representation, promise whatsoever that such connectivity will always be available.
- Company reserves the right to suspend these Services if in the Company’s opinion security of the Website or of the data could be compromised.
- You expressly understand that under no circumstances, including, but not limited to, negligence, shall the Company be liable to you or any other person or entity for any direct, indirect, incidental, special, or consequential damages, including, but not limited to damages for loss of profits, goodwill, use, data or other intangible losses, resulting from circumstances, including but not limited to:
- the use or the inability to use the Website and / or Services; or
- unauthorized access to or alteration of the users’ transmissions or data;
- statements or conduct of any third party on the Website and / or Services; or
- any other matter relating to the Website and / or Services.
- The Company and the Company's shareholders, directors, affiliates, distributors, agents, representatives, employees and vendors be relieved of all of their responsibilities, if any, in the event of failure of performance resulting directly or indirectly from an act of force majeure or causes beyond the Company's reasonable control including, without limitation, acts of god, war, equipment and technical failures, electrical power failures or fluctuations, disruption in telephone lines and internet, overload of system capabilities, strikes, labour disputes, riots, civil disturbances, shortages of labour or materials, natural disasters, orders of domestic or foreign courts or tribunals, non performance of third parties, or any reasons beyond the reasonable control of the Company or any of the foregoing entities' respective resellers, distributors, service providers and suppliers. You further acknowledge and agree that neither the Company nor any of the foregoing entities' respective resellers, distributors, service providers and suppliers are responsible or liable for
- any incompatibility between the Website and / or Services and any other website, service, software or hardware, or
- any delays or failures that users may experience with any transmissions or transactions relating to the Website in an accurate or timely manner.
- LEGAL EFFECT
- APPLICABLE LAWS & DISPUTE RESOLUTION
You will register with us using your Facebook or LinkedIn account or Google identity or any other third party website mentioned on our Platform (“Third Party Sites”). You understand that, by creating an account or by registering through Third Party Sites, we and others will be able to identify you by your profile. We will also not be liable for the photographs and data that the users might upload, which are not in accordance with applicable law. We will ask for your bank account details only for the service provided by us. Such data is stored in our systems in accordance with Rule 3(h) of the Intermediary Rules and the IT RSP Rules.
Please note that we always ask for your permission before accessing the information on your phone. We collect and monitor only your financial transaction SMS, names of transacting parties, transaction description and amount to perform a credit risk assessment. Such data is stored in our systems in accordance with Rule 3(h) of the Intermediary Rules and the IT RSP Rules. No personal SMS data is collected, read or stored. All information requested is relevant to create a credit score which helps us make faster credit disbursals and better credit limits. You may choose not to provide the information requested. However, your credit score may be inaccurate or unavailable for your application as a result.
We hereby confirm that we do not store your personal information, except the following personal information provided in Clause 4.1 of the Policy which is necessary to carry out our business operations which may be shared with third parties. The App does not store personal information of borrowers/users except some basic minimal data (viz., name, address, contact details of the customer, etc.) that may be required to carry out business operations.
We may collect data about you from a variety of sources, including through:
4.1 DATA THAT YOU PROVIDE US DIRECTLY
This includes the types of personal or sensitive personal data that you provide us, in addition to the data mentioned in Section 4 above, with your consent for a specified purpose of providing you the services as mentioned in the Platform, including the following, under Rule 3 of the IT RSP Rules.
Some of these may be regarded as sensitive personal data or information under Rule 3 of the IT RSP Rules. We shall use the information collected by us only for the purpose for which it has been collected, for a specified purpose of providing you the services as mentioned in the Platform.
4.2 DATA WE COLLECT WHEN YOU VISIT OUR PLATFORM
SMS Permission: We will request permission to view SMS messages relating to financial transactions only in order to determine your income and expense profile. The App will only access financial SMSs sent by 6- digit alphanumeric senders from the inbox which helps us identify the various accounts held by the user and to help perform an optimal ‘credit risk assessment’ of the user.
The data is accessed by our machine learning models only. We will only access those messages that are relevant to this purpose and will not read / store/share irrelevant or personal messages in any form or manner. The permission is voluntary and can be revoked at any time. However, denying access may lead to an inaccurate assessment of the user’s credit assessment on the platform. The data accessed by the said permission is stored in our systems in accordance with Rule 3(h) of the Intermediary Rules and the IT RSP Rules.
Phone Permission: Collect and monitor specific information about your device including your hardware model, operating system and version, unique device identifiers like IMEI and serial number, user profile information and mobile network information to uniquely identify the devices and ensure that unauthorized devices are not able to act on your behalf to prevent frauds. The data accessed by the said permission is stored in our systems in accordance with Rule 3(h) of the Intermediary Rules and the IT RSP Rules.
Contact: We do not collect or store contact information. However, we request the users to provide us with contact references for the purpose of filling the reference details screen during the loan application stage. The data accessed by the said permission is stored in our systems in accordance with Rule 3(h) of the Intermediary Rules and the IT RSP Rules.
Location Permission: The App will request permission to capture the user’s location for verification, risk analysis and operational purposes. The user’s location will enable the App to verify addresses, determine serviceability and expedite the KYC process. The data accessed by the said permission is stored in our systems in accordance with Rule 3(h) of the Intermediary Rules and the IT RSP Rules.
Apps Permission: Collect and monitor a list of installed apps on your device for credit profile enrichment Accounts Permissions Collect and monitor the list of accounts on your device for credit profile enrichment. The data accessed by the said permission is stored in our systems in accordance with Rule 3(h) of the Intermediary Rules and the IT RSP Rules.
Information Collection and Use
The app does use third party services that may collect information used to identify you.
Certain third-party providers’ services are used by the App including the following: (i) Google; (ii) Facebook; (iii) IOs/ Apple, (iv) LinkedIn etc. Third Party Link
We want to inform you that whenever you use our service, in a case of an error in the app we collect data and information
(through third party products) on your phone called Log Data. This Log Data may include information such as your device Internet Protocol(“IP”) address, device name, operating system version, the configuration of the app when utilizing our service, the time and date of your use of the service, and other statistics.
Cookies are files with a small amount of data that are commonly used as anonymous unique identifiers. These are sent to your browser from the websites that you visit and are stored on your device’s internal memory.
We may set cookies to track your usage on our web application platforms. We use data collection devices such as “cookies” on certain pages of the App and Website to help analyze our web page flow, measure promotional effectiveness, and promote trust and safety.
Please note that if you decline or delete these cookies, some parts of the App may not work properly.
We may employ third-party companies and individuals due to the following reasons:
We want to inform users of this service that these third parties have access to your personal information. The reason is to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose.
We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.
You can access your personal identity details on our App through your login and password. We recommend that you do not share your password with anyone. In addition, your personal details are stored on a secure server located in India that only selected personnel contractors and authorised Agencies have access to on a need- to- know basis. We encrypt certain sensitive information using Secure Socket Layer (SSL) technology to ensure that your personal details are safe as it is transmitted to us.
Protection of your privacy and your data security is a top priority for us. We encrypt your data and store it in multiple databases. There are security group and firewall checks to control the APIs with multi-level authentication, authorisation and verifications.
However, you understand and accept no data transmission over the Internet can be guaranteed to be completely secure. We cannot ensure or warrant the security of any information that you transmit to us and you do so at your own risk. Data pilferage due to unauthorized hacking, virus attacks, technical is possible and we take no liabilities or responsibilities for it, except to the extent permitted in law. In case such security breach happens, we take the following steps as mentioned in Para 10 of this Policy.
Links to Other Sites
We and our affiliated partners may use the personal information submitted by you to contact you in relation to the services offered. This shall override any calling preferences, which you may have registered in the NDNC.
Transactions on the Website are secure and protected. Any information entered by the User when transacting on the Website is encrypted to protect the User against unintentional disclosure to third parties. The User’s credit and debit card information is not received, stored by or retained by the Company / Website in any manner. This information is supplied by the User directly to the relevant payment gateway, which is authorized to handle the information provided, and is compliant with the regulations and requirements of various banks and institutions and payment franchisees that it is associated with.
We use third-party advertising companies to serve ads to the users of the Website. These companies may use information relating to the User’s visits to the Website and other websites in order to provide customised advertisements to the User. Furthermore, the Website may contain links to other websites that may collect personally identifiable information about the ser.
If you have any complaint under the Information Technology Act 2000, the IT RSP Rules or any FinTech/ digital lending related complaints/issues, the contact details of the Data Protection Officer and Grievance Redressal Officer are provided below.
The Data Protection and Grievance Redressal Officer should acknowledge the complaint within 24 (twenty-four) hours and dispose of such complaint within a period of 15 (fifteen) days from the date of its receipt.
Mr Roshan Giri (Customer Care Department): +91 77150 98615
Correspondence Address: 501-A, Pinnacle Corporate Park, BKC Bandra (East), Mumbai-400051
For any complaints / escalation please reach out to our Grievance Redressal Officer.Mr. Venkatesh Dontul
Head – Operations and Customer Service,
M. No: + 91 98921 56608
Email IDs: email@example.com
10.1 DATA SECURITY
In order to keep your personal data secure, we have implemented a number of security measures including:
We value your Personal Information, and protect it on the Platform against loss, misuse or alteration by taking extensive security measures. In order to protect your Personal Information, we have implemented adequate technology and will update these measures as new technology becomes available, as appropriate. All Personal Information is securely stored on a secure cloud setup and all communication happens via secure SSL communication channels.
You are responsible for all actions that take place under your User Account. If you choose to share your User Account details and password or any Personal Information with third parties, you are solely responsible for the same. If you lose control of your User Account, you may lose substantial control over your Personal Information and may be subject to legally binding actions.
No data collected and allowed to be stored by us shall be stored in any server which is not located in India.
Standards for handling security breach:
10.2 RETENTION & DATA PURGING
We will only retain your personal data for as long as it is necessary for the stated purpose, taking into account also our need to answer queries or resolve problems, provide improved and new services, and comply with legal requirements under applicable laws. This means that we may retain your personal data for a reasonable period after your last interaction with us. Kindly note that we do not sell your personal data to any third party and the use of your personal data is strictly restricted to the services provided by us, as mentioned herein. Your data will be stored in our systems in accordance with the Information Technology Act, 2000, Rule 3(h) of the Intermediary Rules and the IT RSP Rules (“IT RSP Rules”).
When there is no longer a business, legal, or regulatory requirement to keep the data, then the data will be purged in a secure manner.
Data Destruction Protocol: All the data, including all the copies thereof will be destroyed post the completion of the business, legal or regulatory requirement. In case the data are stored in physical form, that is, CDs, DVDs, Pen Drive, tapes, etc., then the physical device storage shall be destroyed. In case the data are stored in digital form, then secure erasure of individual folders and/or files will be done.
As per the applicable data protection law, your principal rights are as follows. Please read this in in conjunction with the Policy, specifically Clause 4.1:
Right to withdraw consent: You have the option, at any time while availing our Services or otherwise, to withdraw your consent given to us, for processing your data. In case of withdrawal of your consent, we reserve the option not to provide the Services for which such information was sought. In case the Services are already availed and then you raise a request to withdraw consent, then we have the right to retain to stop the provision of the Services.
You have the right to exercise any of the above rights by contacting our grievance officers as mentioned under Clause 9 of this Policy. Once we receive your request and verify the same satisfactorily, we shall proceed with assisting you on your request.
Any controversy or claim arising out of or relating to this policy shall be decided by Arbitration in accordance with the Arbitration and Conciliation Act 1996 and the governing law shall be the laws of India. The Arbitral Tribunal shall consist of one arbitrator who shall be appointed in accordance with the Arbitration and Conciliation Act 1996.Any such controversy or claim shall be arbitrated on an individual basis and shall not be consolidated in any arbitration with any claim or controversy of any other party. Any other dispute or disagreement of a legal nature will also be decided in accordance with the laws of India, and the Courts at Mumbai shall have exclusive jurisdiction in all such cases, subject to the foregoing.
We keep our Policy under regular review and may update the same to reflect changes to our information related practices. We encourage you to periodically review this page for the latest information on our privacy practices, your continued use and access of our platform will be taken as acceptance of the updated policy.
Last Updated At 2023/04/13