Privacy Policy

UrbanEase B2B Platform — Anvaron Private Limited

This Privacy Policy (“Policy”) governs the collection, use, processing, storage, and disclosure of information by UrbanEase, a product of Anvaron Private Limited (“Company”, “we”, “us”, or “our”) through its B2B SaaS platform and associated mobile/web applications (“Platform”). This Policy applies to all business clients (“Clients”), their authorised administrators, and end users including employees and staff (“Users”) who access the Platform.

By accessing or using the Platform, you confirm that you have read, understood, and agree to this Policy. If you do not agree, you must discontinue use immediately.

---

1. Scope and Applicability

This Policy applies to all services currently offered on the Platform, including but not limited to:

• Parking management and operations
• Valet management services
• Electric Vehicle (EV) charging station management
• FASTag recharge and toll management
• Any additional urban mobility or facility services added from time to time (“Future Services”)

By accepting this Policy, Clients and Users acknowledge that it shall automatically extend to cover any Future Services introduced by UrbanEase without requiring a separate consent, unless a materially different data practice is introduced, in which case we will provide notice.

2. Information We Collect

2.1 Business & Client Information

• Company name, GST registration number, PAN, and registered business address
• Authorised signatory details and business contact information
• Billing and invoicing details
• Business correspondence and communication records

2.2 User / Employee Information

• Full name, employee ID, designation, and department
• Official email address and phone number
• Login credentials (stored in encrypted form)
• Profile photographs (if voluntarily uploaded)

2.3 Financial & Transaction Data

• Payment method details (processed via PCI-DSS compliant third-party gateways; we do not store full card numbers)
• Transaction history, invoices, and receipts
• FASTag wallet balance and recharge history
• UPI or net banking reference identifiers

2.4 Location & Operational Data

• GPS coordinates during active use of parking, valet, or EV services
• Vehicle registration numbers and type
• Entry/exit timestamps at facilities
• Slot or bay allocation data
• EV charging session data including duration, units consumed, and charging station ID

2.5 Technical & Device Data

• IP address, device type, operating system, and browser
• App usage logs, crash reports, and session data
• API access tokens and integration metadata

3. How We Use Your Information

We use collected information strictly for the following purposes:

• To provide, operate, and maintain the Platform and all services
• To process payments, generate invoices, and manage billing
• To enable real-time tracking of parking, valet, EV, and FASTag services
• To authenticate users and prevent unauthorised access
• To communicate service updates, maintenance notices, or policy changes
• To improve Platform features and develop new services
• To comply with applicable laws, regulations, and legal obligations
• To resolve disputes, investigate misuse, and enforce our Terms & Conditions
• To generate anonymised, aggregated analytics for internal business intelligence

We do NOT sell, rent, or trade your personal data to third parties for marketing purposes.

4. Legal Basis for Processing

Our processing of personal data is based on the following lawful grounds under applicable Indian law, including the Digital Personal Data Protection Act, 2023 (“DPDPA”):

• Contractual necessity — processing required to perform services under the Client agreement
• Legitimate interests — fraud prevention, platform security, and service improvement
• Legal obligation — compliance with Indian tax laws, RBI regulations, NHAI FASTag guidelines, and other applicable regulations
• Consent — where separately obtained for specific activities such as location tracking or marketing communications

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers

We share data with carefully vetted third-party partners solely to operate the Platform, including:

• Payment gateway providers (e.g., Razorpay, PayU, or equivalent) for processing transactions
• Cloud infrastructure providers for secure data hosting
• SMS/OTP providers for authentication
• NHAI-authorised FASTag issuers and NETC ecosystem participants
• EV charging network operators integrated with the Platform

All third-party providers are contractually bound to handle data confidentially and in accordance with applicable law.

5.2 Legal Disclosure

We may disclose information without prior notice if required by court order, government directive, law enforcement request, or where disclosure is necessary to protect the rights, property, or safety of UrbanEase, our Clients, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, Client and User data may be transferred to the successor entity, subject to equivalent privacy protections.

6. Data Security

We implement industry-standard technical and organisational security measures including:

• AES-256 encryption for data at rest; TLS 1.2+ for data in transit
• Role-based access controls (RBAC) and multi-factor authentication
• Regular security audits and vulnerability assessments
• Segregated environments for development and production data
• Incident response procedures with breach notification protocols

Notwithstanding the above, no method of electronic transmission or storage is 100% secure. UrbanEase shall not be liable for unauthorised access resulting from circumstances beyond our reasonable control, including force majeure events, cyberattacks, or Client-side security failures.

7. Cookies and Tracking

The Platform uses cookies and similar technologies for session management, security, and analytics. Essential cookies are necessary for Platform functionality and cannot be disabled. Analytics cookies may be managed via browser settings. We do not use third-party advertising cookies.

8. Children’s Privacy

The Platform is strictly a B2B service intended for use by registered business entities and their authorised adult employees. We do not knowingly collect data from individuals under the age of 18.

9. Cross-Border Data Transfers

Data is primarily stored on servers located within India. Any cross-border transfer shall be conducted in accordance with the provisions of the DPDPA 2023 and applicable RBI/SEBI guidelines, with appropriate contractual safeguards in place.

10. Changes to This Policy

We reserve the right to update this Policy at any time. Material changes will be communicated via email to the registered Client contact and/or in-app notification at least 15 days prior to taking effect. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDPA 2023, we have appointed a Grievance Officer:

---

© Anvaron Private Limited. All rights reserved.