Acceptable Use Policy

Rules governing the lawful and responsible use of the BillBasket POS App

1. Introduction

This Acceptable Use Policy ("AUP" or "Policy") sets out the rules that apply to all use of the BillBasket POS App and related services provided by BillBasket Solutions LLP ("BillBasket", "Company", "we", "our", or "us") — including the desktop and mobile applications, web dashboard, customer portal, APIs, and the billing, invoicing, reconciliation, and in-app payment-acceptance features.

This Policy supplements, and forms part of, the BillBasket Terms of Service and any Enterprise Service Agreement, and expands on their "Acceptable Use" and "Prohibited Activities" provisions. It should be read together with the Privacy Policy, Payment & Billing Policy, and Data Processing Agreement.

2. Who This Policy Applies To

This Policy applies to every Customer, authorised user, administrator, outlet operator, and any other person who accesses or uses the POS App. Customers are responsible for ensuring that their authorised users and anyone acting on their behalf comply with this Policy.

3. General Principles

You must use the POS App:

• Only for lawful, legitimate business purposes;
• In compliance with this Policy, the Terms of Service, and all applicable laws and regulations;
• In a manner that does not harm, disable, overburden, or impair the Services or interfere with any other user's use;
• With respect for the rights, privacy, and security of others.

4. Prohibited Activities — General

You must not, and must not permit any person to:

• Use the POS App for any unlawful, fraudulent, deceptive, or misleading purpose;
• Violate any applicable law, regulation, governmental order, or third-party right;
• Infringe the intellectual property, privacy, publicity, or other rights of any person;
• Upload, store, or transmit content that is unlawful, defamatory, obscene, harassing, hateful, or otherwise objectionable;
• Impersonate any person or entity or misrepresent your affiliation with any person or entity;
• Use the Services to send unlawful, unsolicited, or deceptive communications.

5. Payment Acceptance and Financial Integrity

Because the POS App lets you accept digital payments (such as UPI, cards, net banking, and QR), the following rules are important. You must not use the Services to:

• Facilitate money laundering, terrorist financing, or any activity that violates anti-money-laundering (AML) or counter-terrorist-financing (CFT) laws;
• Accept or process payments for any person or entity subject to applicable sanctions, or in any sanctioned jurisdiction, in violation of applicable law;
• Engage in or facilitate fraud, unauthorised transactions, deceptive billing, or unauthorised use of payment instruments;
• Process transactions that do not reflect a genuine sale of the goods or services you actually provide (for example, "transaction laundering" or processing payments on behalf of another, undisclosed business);
• Submit false, manipulated, or fictitious transactions, or abuse refunds, chargebacks, or dispute mechanisms;
• Collect, store, or process payment credentials in violation of applicable payment-security standards or law.

You are responsible for complying with the rules of your acquiring bank, payment service providers, and relevant regulators (including the Reserve Bank of India, Nepal Rastra Bank, and Bangladesh Bank, as applicable), and for any "know your customer" obligations applicable to your business.

6. Customer Communications (Receipts, Reminders, Pay-Links)

Where you use the POS App's communication features to send receipts, invoices, payment links, or reminders (for example via SMS, WhatsApp, or email), you must:

• Communicate only with individuals from whom you have the necessary consent or another lawful basis, and respect opt-out and unsubscribe requests;
• Comply with applicable laws and regulations governing electronic and commercial communications, including applicable telecom-regulator rules;
• Provide accurate information and not send deceptive, abusive, or harassing messages;
• Not misuse customer contact details collected through the POS App for unrelated purposes.

7. Data Protection and Privacy Obligations

When you use the POS App to process personal data of others (such as your customers, staff, or suppliers), you must:

• Have a valid legal basis and provide any required notices and obtain any required consents;
• Process such data only for lawful and disclosed purposes;
• Comply with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (India), the Individual Privacy Act, 2018 (Nepal), and applicable laws in Bangladesh;
• Not upload special, sensitive, or restricted categories of data except as supported by the POS App and permitted by law;
• Honour the rights of individuals whose data you process.

8. System, Network, and Security Rules

You must not:

• Attempt to gain unauthorised access to the Services, other accounts, or BillBasket systems, networks, or data;
• Probe, scan, or test the vulnerability of the Services, or breach or circumvent security or authentication measures, except under an authorised arrangement agreed in writing with BillBasket;
• Introduce viruses, malware, ransomware, worms, or other malicious code;
• Interfere with or disrupt the integrity or performance of the Services, including through denial-of-service activity or excessive load;
• Use the Services to store or transmit malicious code or to attack any third-party system.

9. Licence Integrity and Anti-Piracy

You must not:

• Use unauthorised, cracked, pirated, or counterfeit copies of the Software, or use key generators or activation-bypass tools;
• Bypass, disable, or interfere with licensing, activation, or usage-limit mechanisms;
• Share, sublicense, resell, rent, or transfer licences except as expressly permitted in writing;
• Reverse engineer, decompile, or disassemble the Software except to the limited extent permitted by applicable law;
• Exceed the user, device, branch, outlet, or transaction limits applicable to your licence.

10. API and Integration Use

Where you use BillBasket APIs or integrations, you must:

• Use them only in accordance with the applicable documentation and any rate limits or quotas;
• Not use automated means to extract data in a way that overburdens or disrupts the Services, or to scrape data without authorisation;
• Keep API credentials secure and not share them with unauthorised parties;
• Not use the APIs to build a product that replicates or competes unfairly with the Services in violation of your agreement.

11. Use of AI and Automated Features

Where the POS App includes artificial-intelligence or automated features (such as reports, insights, or recommendations), you must use outputs responsibly, understand that they are decision-support tools and not professional advice, and independently verify important business, financial, legal, or tax decisions. You must not use AI features to generate unlawful, deceptive, or harmful content.

12. Prohibited and Restricted Business Categories

You must not use the POS App in connection with activities that are illegal in your jurisdiction or prohibited by applicable payment-network or regulatory rules. Depending on applicable law and the requirements of payment partners, restricted or prohibited categories may include:

• Illegal goods or services, including illegal drugs, controlled substances, or related paraphernalia;
• Illegal gambling or betting, and unlicensed lottery activity;
• Counterfeit goods or goods that infringe intellectual property rights;
• Unlicensed financial, investment, or money-services activity, including unlawful schemes and unauthorised fund-collection or deposit-taking;
• Weapons, ammunition, or explosives prohibited or restricted by law;
• Child sexual abuse material or any content that exploits or endangers minors;
• Human trafficking, forced labour, or other exploitative activity;
• Any activity prohibited by applicable sanctions or that supports terrorism;
• Other activities prohibited by applicable law or by BillBasket's payment partners or acquiring banks.

BillBasket may decline, suspend, or terminate Services used for prohibited or high-risk activities, or where required by a payment partner, acquiring bank, or regulator.

13. Monitoring and Enforcement

BillBasket does not routinely monitor Customer Business Data, consistent with its privacy-first approach. However, BillBasket may investigate suspected violations of this Policy and may access information to the limited extent reasonably necessary to do so, to protect the security and integrity of the Services, or to comply with law, and may cooperate with law-enforcement and regulatory authorities where required.

14. Consequences of Violation

If you violate this Policy, BillBasket may, depending on the nature and severity of the violation and consistent with the Terms of Service:

• Issue a warning and request that the violation be remedied;
• Restrict, suspend, or disable affected features or accounts;
• Remove or disable access to offending content where technically feasible and lawful;
• Suspend or terminate the Services or applicable licences;
• Report unlawful activity to competent authorities where required by law.

Where practicable, BillBasket will give notice before taking action, but may act immediately where necessary to protect the Services, other users, payment partners, or to comply with law. Suspension or termination for violation does not entitle the Customer to a refund except where required by applicable law.

15. Reporting Abuse or Violations

If you become aware of any violation of this Policy, security vulnerability, or abuse of the Services, please report it promptly using the contact details below so we can investigate.

16. Changes to This Policy

BillBasket may update this Policy to reflect changes in the Services, applicable law, payment-network requirements, or operational needs. The current version will be published on billbasket.app and, unless otherwise required by law, becomes effective upon publication. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

17. Governing Law and Jurisdiction

This Policy is governed by the laws of the Republic of India, and the courts located in Pune, Maharashtra, India shall have jurisdiction, subject to mandatory local laws.

India. Users must comply with applicable laws including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, the Prevention of Money-Laundering Act, 2002, applicable Reserve Bank of India directions, and applicable TRAI regulations on commercial communications.

Nepal. Users must comply with applicable laws including the Electronic Transactions Act, 2008 (2063), the Individual Privacy Act, 2018 (2075), applicable anti-money-laundering law, consumer-protection law, and applicable Nepal Rastra Bank directives governing payment systems.

Bangladesh. Users must comply with applicable laws including the Information and Communication Technology Act, 2006, the Cyber Security Act, 2023, the Money Laundering Prevention Act, 2012, consumer-protection law, and applicable Bangladesh Bank regulations governing payment and settlement systems.

18. Contact Information

BillBasket Solutions LLP Registered Office: 101, Shree Apartment, Ubalenagar, Wagholi, Pune – 412207, Maharashtra, India

• Abuse & Security Reports: legal@billbasket.in
• General Support: support@billbasket.in
• Phone: +91 86006 00903