Privacy Policy | BOB Digital Software Ecosystem

Effective date: 6 November 2026 · Company: Rellancer Software Solution Pvt. Ltd. ("we", "our", "us") · Website: https://onboard.bobpey.com

This Privacy Policy explains how we collect, use, share, store and protect personal data on the BOBPEY partner portal (onboard.bobpey.com). It applies to:

Partners: Super Partners, Associate Super Partners, Star Partners, Handshake Partners, Associates and Sub Associates, including people applying to become one;
Merchants whose onboarding application is submitted through the portal, whether by a partner, through a partner's onboarding link, or by the merchant on our website; and
Visitors to the public pages of the portal.

It should be read with our Terms and Conditions. The portal is part of the BOBPEY platform, together with bobpey.com (customer payments) and merchant.bobpey.com (the merchant portal).

1. Personal data we collect

From partners and partner applicants

Identity and contact: name, mobile number, email address and postal address.
KYC: PAN number and a copy of the PAN card; copies of the Aadhaar card (front and back). We keep only the last 4 digits of the Aadhaar number; the full number is never stored.
Bank account for commission payouts (account holder name, account number, IFSC, bank name) with a cancelled cheque or passbook copy.
Joining fee transfer (where a joining fee applies): transfer reference (UTR), date, amount and receipt.
Partnership details: your partner type and Star Partner tier, the partner who created you and your place in the hierarchy, your area of operation (state or pincode), the onboarding fee shares you give or receive and their history, your referral code, and your application status with the notes from our team.
Commission, withdrawal and tax records: commission earned, withdrawals, TDS deducted and TDS certificates.
Nominee details and a profile photo, when you add them to your profile.
Account data: your password (stored only in hashed form, never readable), login times, notifications we send you, and your acceptance of these terms (version, time and IP address).

About merchants

Owner: name, mobile number, email address, PAN, the last 4 digits of the Aadhaar number, and copies of the PAN and Aadhaar cards.
Business: shop or business name, type of business, shop phone number (and whether to show it on the QR stand), shop address, payment announcement language, a photo of the shop, and optionally the GSTIN, GST certificate and shop licence or Udyam registration.
Bank account for settlements, with a cancelled cheque or passbook copy.
Payment of the onboarding fee: amount, payment and order references, payment method, time and status, and any refund. Card, UPI and bank login details are entered on Razorpay's secure checkout; we never see or store them.
After approval: the merchant's BPI / QR code and the partner the merchant is linked to.

Transaction data used for commission. To calculate daily transaction commission, we use the amount, date, status and refunds of customer payments made to merchants on bobpey.com. Partners see only the amount, date and merchant of each payment and the commission on it, never the customer's identity.

Collected automatically. IP address, browser and device information, and the time of actions such as logins, form submissions, payments and document views, for security, fraud prevention and audit. See also section 8 on cookies.

2. Where the data comes from

From you, when you register, apply through a joining link, fill in forms or update your details.
From the partner who creates your account, who enters your details on your behalf; you then confirm them by setting your password and accepting these terms.
For merchants: from the onboarding partner, or from the merchant directly through an onboarding link or our website.
From Razorpay (payment status and refunds) and from bobpey.com (customer payment amounts for commission).

Consent for others' data. When you submit someone else's personal data, such as a merchant's documents or a new partner's details, you confirm that they have agreed to it, that they have been told about this policy, and that the information is genuine.

3. Why we use it

To create, verify, approve and manage partner accounts and the partner hierarchy, including areas of operation.
To verify merchant documents, take the onboarding fee, approve merchants, assign their QR / BPI code and set up their merchant account, and to refund the fee if an application is rejected.
To calculate onboarding, renewal and daily transaction commission, process withdrawals to your bank account, deduct TDS, file TDS returns and issue TDS certificates.
To send emails, SMS one-time passwords and dashboard notifications about your account, your team, your merchants, commission and payouts.
To keep the platform secure, prevent and investigate fraud and misuse, keep audit records, and resolve disputes.
To understand how the public pages are used and improve them, if you accept analytics cookies (see section 8).
To meet our legal, tax and regulatory obligations.

We process this data with your consent, which you give when you register or accept these terms, and where the law requires or permits it, for example for tax.

4. Who can see it

Partners above you in the hierarchy can see your name, partner type, area, status, the date you joined, the last 4 digits of your mobile number, your team and the merchants onboarded by you and your team. They cannot see your KYC documents, bank details or joining fee details.
Commission splits are visible one level only: the partner who created you sees the share they gave you, and you see the shares you give your direct Associates or Sub Associates. Nobody sees the split two levels away.
Merchant details: the onboarding partner sees the details they entered. Partners above them see the shop name, location, owner's name, the last 4 digits of the owner's mobile, and the status. They never see merchant documents or bank details.
Our authorised staff see what they need to verify applications, approve merchants, process refunds, withdrawals and TDS, and support you. Every view of a document by our staff is logged, and so is every decision.
Our other BOBPEY systems: an approved merchant's details are used by the merchant portal (merchant.bobpey.com) and the payment platform (bobpey.com) to run the merchant's account and settlements.
Service providers acting for us: Razorpay (online payments and refunds), Mailjet (email), our SMS provider (one-time passwords), Google (website analytics, see section 8) and our hosting and database providers. They may use the data only to provide their service to us.
Banks, to pay withdrawals and refunds.
Government authorities, including the Income Tax Department for TDS (your PAN, the amounts paid and the tax deducted), and courts, regulators or law enforcement when the law requires it.
A successor business, if BOBPEY or its business is reorganised, merged or sold, under the same protections.

We do not sell or rent personal data, and we do not share it for third-party advertising.

5. Where it is stored

Uploaded documents are stored privately on our server and are never reachable through a public link. Other data is stored in our database. Our hosting, database, email and payment providers may store or process data on servers in or outside India. We use providers that protect data under contract and, where data leaves India, we do so only as Indian law permits.

6. How we protect it

Documents are checked on upload, stored privately, and shown to our staff only through a signed, short-lived request between our systems. Every access is logged.
Passwords are stored only as secure hashes. Logins are protected against repeated guessing, and changing your password signs out your other sessions.
What each partner can see is decided by the server on every request, based on your place in the hierarchy.
The portal uses HTTPS, forms are protected against forged submissions, and payments are confirmed with Razorpay on our server.
We store only the last 4 digits of Aadhaar numbers.

No system is completely secure. If a breach affects your personal data, we will inform you and the authorities as the law requires.

7. How long we keep it

Partner data: while your account is active, and afterwards for as long as needed for tax, accounting, audit and legal purposes, and to settle any disputes.
Commission, withdrawal, TDS and payment records: for as long as tax and accounting laws require.
Merchant applications: approved applications for as long as the merchant uses BOBPEY and afterwards as the law requires. Rejected applications, with their payment and refund records, as long as needed for accounting and disputes.
Unfinished drafts and unpaid applications may be deleted after a reasonable time.
Security and access logs: as long as needed for security and audit.

When data is no longer needed, we delete it or make it anonymous.

8. Cookies, analytics and similar technologies

The full list, and how to change your choice, is in our Cookie Policy. Google Analytics is used only if you accept it in the cookie banner.

Login cookie (bds_partner): keeps you logged in, and protects forms. It is required for the portal to work and is removed when you log out or close the session.
Browser storage: remembers small preferences on your device, such as whether you closed the "install the app" prompt.
Google Analytics is used on the website to measure visits, only after you accept analytics cookies. It sets its own cookies and collects information such as pages visited, device and approximate location. You can block it with your browser settings or Google's opt-out add-on.
Razorpay's checkout, on the payment page, may set its own cookies for security and fraud prevention, under Razorpay's privacy policy.

9. Your rights

Under applicable Indian law, including the Digital Personal Data Protection Act, 2023, you may:

ask for a summary of the personal data we hold about you and how it is used;
ask us to correct, complete or update it;
withdraw your consent, which stops future processing that relies on it but does not affect what was done before. Since a partner account needs this data, withdrawing consent ends the partnership;
ask us to erase data we no longer need and are not required by law to keep, for example tax records;
nominate another person to exercise these rights in the event of your death or incapacity; and
raise a grievance with us, and if not resolved, with the Data Protection Board of India.

Write to the contact below. We may ask you to verify your identity first. Merchants can also contact us directly about data a partner submitted about them.

10. Age

The portal is for people aged 18 or over. We do not knowingly accept partners or merchant owners under 18.

11. Grievances and contact

For privacy questions, requests or complaints, contact our grievance officer at info@bobpey.com (Rellancer Software Solution Pvt. Ltd.). We will acknowledge your request and respond within the time required by law. How complaints are handled and escalated is described in our Grievance Redressal Policy.

12. Changes to this policy

We may update this policy as the platform or the law changes. The new version is published on this page with its effective date, and partners are asked to accept it on their next login.