We at Transbnk Solutions Pvt. Ltd (hereinafter referred to as “TBX” or “Company” or “We” or “Us”) are committed to protecting the privacy and security of its users (“user(s)”, “your”, or “you”). User and their customers privacy is important and maintaining User trust is paramount to us. This Privacy Policy (“Privacy Policy”) explains how we collect, use, process, and disclose, User or their Customer’s information including Personal Data, and is published in accordance with the Digital Personal Data Protection Act, 2023 and the rules made thereunder ("DPDP Act"). By using our website/ app/ platform and affiliated services, User or Customer Consent on their and their customers behalf to the terms of our privacy policy (“Privacy Policy”) in addition to our ‘Terms of Services.’ Where TBX processes Personal Data for its own purposes (Part A), it does so on the basis of Consent obtained by TBX for a legitimate use (as highlighted in this Privacy Policy) permitted under the DPDP Act. Where TBX processes Personal Data on behalf of its Customers (Part B), it does so only on the Customer's instructions, and the Customer is responsible for giving notice to, and obtaining Consent from its Data Principals. This Privacy Policy should be read together with our Terms of Service. The consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action.
TBX is committed to protecting your privacy. This Privacy Policy applies to the personal data we collect and process in the course of our business. TBX acts in different roles when processing data:
(i) TBX acts as a ‘Processor’ when our customers use our products and services to collect and process personal data in connection with their financial transactions, Customer verification, Customer authorization and other business activities. In this case, we act as a processor (or service provider) on behalf of our customers (who are fiduciaries of personal data) as outlined under the Master Services Agreement with these Customers. This is the predominant capacity in which TBX processes Personal Data.
(ii) TBX sometimes acts as a ‘Fiduciary’ of your personal data, only in limited circumstances and to the extent applicable, including when you sign up for our products and services, visit our websites or interact with us through other channels like app/ platform and affiliated services. We use this data for a variety of purposes, including to provide our products and services to you, contact you about relevant content, process fees payable to TBX under the Customer Agreement, and improve and promote our products and services.
This Privacy Policy is accordingly divided into: Part A, which describes TBX's processing of Personal Data as a Data Fiduciary, applicable only in the limited circumstances described therein; and Part B, which describes TBX's processing of Personal Data as a Processor on behalf of Customers, which is the predominant capacity in which TBX processes Personal Data. Save as expressly stated in Part A, it is clarified that TBX works in a Business-to-Business ecosystem and through the Platform/App/Website, TBX does not act as a Data Fiduciary in respect of Personal Data belonging to a Customer's own customers; such Personal Data is processed by TBX solely as a Processor, strictly on the Customer's instructions and as set out in Part B.
“Act” shall mean the Information Technology Act, 2005, and Rules thereunder as amended from time to time and the Consumer Protection (E-Commerce) Rules, 2020.
“Board” means the Data Protection Board of India established by the Central Government under section 18
“Customer” means a registered user who has entered into a contractual agreement with us to avail our services, and is bound by the terms and conditions of that agreement.
“Customer Agreement” or “Master Services Agreement” means the commercial agreement (including any related data-processing terms, statement of work, or order form) entered into between TBX and a Customer governing the provision of Services, pursuant to which TBX processes Personal Information as a Processor.
“Consent” shall have the same context as defined in section 6 (1) and shall mean that the Consent given by the Data Principal to Fiduciary is free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of such User’s Personal Data for the specified purpose and be limited to such Personal Data as is necessary for such specified purpose.
“Fiduciary” means the person who determines the purposes and means of processing of Personal Information, being TBX, only in the limited circumstances described in Part A of this Privacy Policy, or the Customer, in respect of Personal Information processed by TBX as a Processor under Part B.
“DPDP Act” shall mean The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) and the DPDP Rules, 2025.
“Data Principal” means the individual to whom the personal data relates and where such individual is—
“Information” shall mean and include Personal Information and Sensitive Personal Data and Information as may be collected by TBX.
“Personal Information (PI)” shall have the same meaning as under Rule 2 (i) of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 as amended from time to time. For ease of reference Rule 2 (i) of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 is re-produced under Schedule 1.
“Personal data” under section 2(t) of DPDP act means any data about an individual who is identifiable by or in relation to such data.
“Processor” means a person who processes Personal Information on behalf of a Data Fiduciary pursuant to a written contract, being TBX, in respect of Personal Information described in Part B of this Privacy Policy.
“Rules” shall mean the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 as amended from time to time.
“Registered User” shall mean such user whose registration is accepted by TBX.
“Sensitive Personal Data and Information (SPDI)” shall mean and include information under Rule 3 of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 as amended from time to time. For ease of reference Rule 3 of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 is re-produced under Schedule 1.
“Services” for the purpose of this Privacy Policy shall mean any person who by way of registration has sought or in any manner has requested the services of TBX. All words and expressions used and not defined in this document but defined in the Act or the Rules shall have the meanings respectively assigned to them in the Act or the rules.
“Specified Purpose” means the purpose for which Personal Data is processed, as stated in the notice given by TBX under Section 5 of the DPDP Act and in the clause titled “How Do We Use Information” of this Policy. Where TBX acts as a Data Processor, it means the purpose determined by the Customer and communicated to TBX.
"User" means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.
We encourage User to read this privacy policy to understand the collection, use, and disclosure information from time to time, to keep Users updated with the changes and updates that we make to this policy.
Users may use TBX’s website to access Information, learn about its products and services, read publications and check career opportunities etc. without providing any PI/SPDI. However, when a User agrees to use our services then they will have to share their or their customers information with us.
This Part A applies only to the categories of Personal Data described below, which TBX collects and uses for its own purposes as described in this Part A. It does not apply to Personal Data of a Customer's own customers or other data subjects, which is addressed exclusively in Part B.
(a) When You Visit our website:
We collect Data from you when you interact with our website to book a Demo with us or to Contact us requesting customer support. We may ask for the following Data:
Should User opt to access such services of TBX, which are available only to Registered Users, certain Information is required to be provided by User at registration such as name, address, phone number, and email address. Providing additional information beyond what is required at the time of registration is entirely optional and can be altered or removed by User at any time. Registered Users are given access to the web portal/business applications based on the password-based authentication which is chosen by them and securely stored in TBX servers for the purpose of authentication of the Registered Users at the time of login;
(b) When you interact with us outside of our website:
Any PI/SPDI/Information that User provide directly to TBX via email or electronic communication; Information that User provide to TBX through any mode/medium including telephone number, TBX may make and keep a record of such information shared by User;
(d) Information that TBX has access to from third parties on behalf of the User so that they can provide services;
(e) Information that User provide to TBX in physical form whether sent through post or courier or handed over to a TBX representative in person; and
(f) PI/SPDI collected by TBX from its employees, suppliers or onsite consultants for the purpose of employment, availing their services and recording their attendance etc.
(g) PI/SPDI collected by TBX from its partners for the purpose of providing services to its Registered Users or enabling services for a set of customers.
(h) We may post testimonials and comments on our websites, which may contain Personal Data like Name, Designation, Company’s Name after receiving your Consent.
(c) Billing and payment information:
When a Customer registers for or purchases Services, we collect payment and billing information such as a billing address or billing contact. This information is collected and used by TBX in its capacity as a Data Fiduciary, for the purpose of processing fees payable under the Customer Agreement. If a Customer gives us payment information, we use it solely as authorized by the Customer in accordance with this Privacy Policy.
(d) Website usage and technical information:
When User visits our Platform, we may log certain non-personal or technical information which we use in our capacity as a Data Fiduciary for website administration, security, and product improvement.
For the avoidance of doubt, the rights and obligations described in this Part A apply only where, and to the extent, TBX is in fact acting as a Data Fiduciary in respect of the relevant Personal Information described above.
This Part B describes the predominant category of Personal Data processing undertaken by TBX. It applies to Personal Data relating to a Customer's own customers, employees, or other data subjects (“Customer's Data Subjects”), which TBX processes strictly on the Customer's documented instructions, under the applicable Customer Agreement, and for which the Customer remains the Data Fiduciary.
When customers use our product, they may require us to process Personal Data such as first and last name, email address, physical address, phone number, or other information about them or their clients. We generally store and process information about and on behalf of our customers on our servers as a processor (or service provider) based on a customer’s instructions and in accordance with our Terms and Conditions. Each customer controls and is responsible for the information they process using the Service and for complying with any regulations or laws that require providing notice, disclosure, and/or obtaining consent prior to transferring the Personal Data to TBX for processing purposes.
TBX requires for the Customers to share the minimized PI/SPDI of the User and/or their clients, as outlined in the Master Services Agreement. In other instances, TBX will try to minimize the PI/SPDI collected for a User. However, if PI/SPDI has been shared with TBX and certain services are availed basis that PI/SPDI then the same cannot be removed from the platform.
As a further example, in performing the Services TBX may Process, we may require Professional Personal Data including but not limited to first and last name, business email address, business employer, business role, professional title, IP address, online identifiers, and other similar information to provide Customer with business information and to provide, maintain, append, improve, enhance, and develop TBX’s Services on the Customer's instructions. This Personal Data will be Processed and retained by the parties in accordance with their respective data retention policies or as otherwise set out under the Customer Agreement.
This Privacy Policy applies to:
Information that User may provide to us voluntarily as mentioned above for using our Services, including but not limited to, full name, mobile number, email address, password, photograph, audio file, location, date of birth, gender, Permanent Account Number (PAN), Aadhaar details, e-KYC through UIDAI, CKYC through CERSAI, income/salary information, marital status, sexual orientation, biometric data, health status and nominee details. We may also hold financial information, including but not limited to, billing address, bank account details, bank statements, bank transaction details, credit/debit card details, payment related details, payment method data, debit instructions, e-mandates, standing instructions or any other personal/financial information as required by various applicable laws and regulations from time to time to process the Services (“PI/SPDI”).
Certain additional information about User or their customers on a case-to-case basis. Further, when User visit our Platform, we may log certain non-personal information such as their IP address, cookie information, browser type, mobile operating system, manufacturer and model of their mobile device, geolocation, preferred language, access time and time spent.
Any information that is freely available, accessible in the public domain, furnished under the Right to Information Act, 2005 or any other law for the time being in force, where such information shall not be regarded as sensitive personal data or information. We may also retrieve from records available with third party Know Your Customer (KYC) Registration Agency (KRA), information such as KYC details, KYC status, father’s name, occupation, address details and related documents. We may also verify KYC information from third party resources to ascertain that the information provided by User is correct. TBX undertakes such KYC retrieval and verification as a Processor, on the Customer's instructions and for the Customer's transaction, as described in Part B above.
We use the PI/SPDI provided by User:
We may send User or their customers text messages on User or their customers registered mobile number that User or their customers share with us.
Where TBX collects Personal Data for its own purposes, such as demo requests, support queries, registration, marketing communications, testimonials and non-essential cookies, it will do so only after obtaining the User's Consent.
A User may withdraw Consent at any time, as easily as it was given. TBX will then stop processing that data within a reasonable time, unless the law requires otherwise.
Where TBX processes Personal Data on behalf of its Customers under Part B, the Customer is responsible for notice and Consent. TBX will act on the Customer's instructions, including any withdrawal of Consent.
We may disclose User or their customers PI/SPDI, to the extent necessary:
We may store/process and retain User or their customers PI/SPDI, to the extent necessary:
We are dedicated to guarding the security of User or their customers information and our Platform has several industry-standard security technologies and procedures devised to help protect User or their customers data from unauthorized access, use, destruction or disclosure, including managerial, technical, physical and organizational security measures to protect the security of User or their customers personal data both online and offline. The App/Website/Platform receives regular security scans and penetration tests. In addition, we actively prevent third parties from getting access to the personal information of Users that we store and/or process on the servers. We will implement reasonable security measures every time User or their customers (a) enter, submit, or access User or their customers information, (b) register, or (c) access the App.
A personal data breach means any unauthorised or accidental access to, or sharing, alteration, loss or destruction of, personal data. TBX has an incident response process to detect, contain and fix any such breach promptly.
Where a breach affects Personal Data that TBX processes as a Data Fiduciary, TBX will inform the affected Data Principal upon being aware. TBX will describe the nature, extent and timing of the breach, its likely impact on the Data Principal, the measures TBX has taken, the steps the Data Principal may take to protect itself, and the TBX contact person for assistance. TBX will also report the breach to the Data Protection Board of India within the time required by law, and will report cyber security incidents to CERT-In.
Where a breach affects Personal Data that TBX processes on behalf of a Customer, TBX will promptly inform that Customer. The Customer, as the Data Fiduciary, shall ensure to notify its affected Data Principals and the authorities, and TBX will assist the Customer in doing so, in its capacity as the Data Processor.
A User may review and request correction of their Personal Data described in Part A by contacting TBX using the details in the “Privacy Questions” section below. As per the existing legal regulations, specific data fields (such as name, Aadhaar number, address etc.) in a User's Personal Information would be locked in our systems once the User enters that information on our Platform. We will respond to all such requests in accordance with applicable law.
TBX does not independently action requests to review or correct Personal Data that it processes as a Processor under Part B, as TBX is not the controller of such Personal Data. Any such request must be directed to the relevant Customer. TBX will provide reasonable assistance to the Customer to action such requests, in accordance with the Customer Agreement and applicable law.
TBX does not sell, trade, or otherwise transfer to outside third parties any Personal Information. Please note that (i) if we delete User or their customers Personal Information as requested, we will no longer be able to provide our Services to User or their customers and (ii) we may need to keep such Personal Information for a while during the shutting down and billing process. Users also have the option to request for an account deactivation instead. This will temporarily block user access to the App and the Platform until they send a re-activation request and successfully re-activate their account. Kindly note that deletion of Personal Information will be decided on a case-to-case basis as there may be cases owing to certain reasons, we cannot delete any account.
We may retain a User's Personal Information described in Part A for a period no longer than is required for the purpose for which it was collected, or as required under applicable law, subject to the retention periods set out above. We may retain such data for longer if we believe it necessary to prevent fraud or future abuse, to exercise or defend legal rights and claims, or as otherwise required by law. We may continue to retain such data in anonymized form for analytical and research purposes.
TBX does not independently action requests to delete or deactivate access to Personal Data of a Customer's own customers that it processes under Part B. Any such request must be directed to the relevant Customer, as controller of that Personal Data. TBX will delete, return, or otherwise deal with such Personal Data strictly in accordance with the Customer's instructions and the Customer Agreement, subject to any retention obligations under applicable law (including the Prevention of Money Laundering Act, 2002, where applicable).
In accordance with Rules 5(6), 5(7), and 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, a User whose Personal Information TBX processes in its capacity as Data Fiduciary under Part A has the following rights:
Right to Review: the right to review the Personal Information provided to TBX, on request made in the manner set out in the “Privacy Questions” section below;
Right to Correction: the right to have any inaccurate or deficient Personal Information corrected or amended, as and when a User becomes aware of such inaccuracy or deficiency, to the extent TBX is legally required and able to do so;
Right to Withdraw Consent: the right to withdraw consent given earlier to TBX for the collection or processing of Personal Information, by written notice to TBX; provided that TBX shall have the option, in such an event, to not provide the goods or Services for which the Personal Information was sought and which cannot reasonably be provided without such Personal Information;
Right to Opt Out at Collection: the right to choose not to provide certain Personal Information at the time of collection, save that certain Information may be mandatory for TBX to provide the relevant Services, and declining to provide it may result in TBX being unable to provide those Services; and
Right to Grievance Redressal: the right to raise a complaint or grievance regarding the collection, use, processing, disclosure, or deletion of Personal Information, with the Grievance Officer named below, who shall address the grievance within the timelines specified in this Privacy Policy.
Where TBX processes Personal Data as a Processor under Part B, the above rights are exercisable by the relevant data subject against the Customer (as Fiduciary), and TBX will provide the Customer with reasonable assistance to give effect to such rights, in accordance with the Customer Agreement and applicable law.
We reserve the right, at our sole discretion, to revise, change or modify this Privacy Policy from time to time and such modifications shall be binding upon User or their customers. Therefore, we urge User or their customers to review the Privacy Policy periodically to ensure that User or their customers agree with our latest information on our privacy practices.
The contents of this website and the Platform may not be reproduced partially or fully, without due permission from TBX, as per the Copyright Act, 1957. If referred to as a part of another publication, the source must be appropriately acknowledged. The contents of this website cannot be used in any misleading or objectionable context.
This Privacy Policy shall be governed by the law of the republic of India, without respect to its conflicts of laws principles. Each of the parties to this Privacy Policy consents to the exclusive jurisdiction and venue of the courts located in New - Delhi, India for any actions not subject to Dispute Resolution and Arbitration provisions as set forth below in (Dispute Resolution).
Any claim, dispute or difference relating to or arising out of this Terms of Service and Platform Privacy Policy shall be referred to the arbitration, of a sole arbitrator appointed mutually. The arbitration shall be subject to the Arbitration and Conciliation Act, 1996 as may be amended from time to time. The seat and venue of arbitration shall be New - Delhi, India. The proceedings shall be undertaken in English. The arbitration award shall be final and binding on the parties.
Any User, Customer or Data Principal who notices suspicious activity or believes Personal Data may have been compromised or any visitor or User who has any questions about this Privacy Policy and our privacy practices, can contact:
Email: admin@transbnk.co.in
Address: 163/F, W-2 Western Avenue Sainik Farms, New Delhi -110062
In accordance with the Information Technology Act, 2005 and the rules made thereunder, i.e. Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 the name and contact details of the Grievance Officer are provided below. Any complaints, abuse or concerns with regards to the use, processing, deletion and disclosure of Information provided by User or their customers or breach of these terms should immediately be informed to the designated Grievance Officers as mentioned below via in writing or through email signed
Name: Srishti Agarwal
Email: Srishti.agarwal@tbx.co.in
Address: 163/F, W-2 Western Avenue Sainik Farms, New Delhi -110062
Telephone: +91 11-41415558
Where a complaint or grievance pertains to Personal Data that TBX processes as a Processor under Part B, TBX shall forward the same to the relevant Customer and render reasonable assistance to resolve it, as the Customer remains the Fiduciary responsible for such Personal Data.
We request User to please provide the following information in their complaint/Grievance:
The Company may reach out to User to confirm or discuss certain details about Users complaint and issues raised.
The Company shall not be responsible for any communication, if addressed, to any non-designated person in this regard.
In accordance with the Consumer Protection (E-Commerce) Rules, 2020, the name and contact details of the Customer Care Service and Grievance Officer of Transbnk solutions Private Limited are provided below:
Name: Srishti Agarwal
Email: Srishti.agarwal@tbx.co.in
Address: 163/F, W-2 Western Avenue Sainik Farms, New Delhi -110062
Telephone: +91 11-41415558
For any complaints or grievances received, our Grievance Officer shall acknowledge the receipt of the consumer complaint within forty-eight (48) hours and redress the complaint within one (1) month from the date of receipt of the complaint.
“Personal information" means any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person.
Sensitive personal data or information of a person means such personal information which consists of information relating to:-
provided that, any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 or any other law for the time being in force shall not be regarded as sensitive personal data or information for the purposes of these rules.