1. INTRODUCTION

1. This Privacy Policy (“Policy”) outlines kreditbuddha (“kreditbuddha”, “We”, “Us” or “Ours”) practices in relation to the storage, use, processing, and disclosure of personal data that You have chosen to share with Us when You download and use Our mobile application “kreditbuddha: Personal Loan App” or use the Services made available on kreditbuddha.com (the app is referred to as the “App” and the App and the website are collectively referred to as the “Platform”).

2. The services We offer you on or through the Platform are referred to as “Services”, which shall be as defined in the Terms. Unless specifically defined in this Policy, capitalised terms shall have the same meaning ascribed to them in Our Terms and Conditions available at www.kreditbuddha.com/terms-and-conditions .

3. At kreditbuddha, We are committed to protecting Your personal data and respecting Your privacy. Please read this Policy carefully to understand Our practices regarding Your personal data and how We will treat it. This Policy sets out the basis on which any personal data We collect from You, collect about You, or that You provide to Us, will be processed by Us.

4. By providing Us with consent to process Your personal data, You acknowledge that We will collect, store, use, and disclose Your personal data in accordance with this Policy.

2. THE DATA WE COLLECT ABOUT YOU

We collect, transmit, and store personal data about You on Our secured kreditbuddha server after obtaining Your consent, to provide You with, or in connection with, the Services. We only collect and process a minimal amount of Your personal data to provide You with the Services. Such personal data includes:

1. Identity and profile-related data: first and last name, parents’ name, date of birth, gender, photographs, educational qualifications, purpose of loan, house ownership, employment status, company name, contact information (addresses, email IDs and phone numbers) and marital status.

2. KYC data: identification documents issued by the government or other authorities, including Aadhaar, PAN card, voter ID, etc.

3. Transaction data: details of transactions that may occur through the Platform or in connection with the Services (loan applications, confirmations of services, repayment history, etc.).

4. Data from SMSs: With Your permission, We collect, transmit and store transactional SMS data from Your phone on Our secured kreditbuddha server to verify and analyse Your financial position. We do not collect, read or store personal SMSs or unrelated account details.

5. Financial data: past credit history, income details, loan details, payments, bank account details, and bank statements.

6. Device data: IP addresses, browser types and versions, time zone settings, operating systems, and device information. This data is collected for analytics and security purposes.

7. App data: We collect the package name of installed applications to assess creditworthiness and provide customized loan offers. Collected app data is stored on Our secured kreditbuddha server.

We do not access Your phone resources such as contact list, call logs, telephony functions, or files & media except to enable uploads when expressly disclosed. We do not collect biometric data. We may take a one-time access of Your camera, microphone, or location for onboarding or KYC after obtaining explicit consent. For certain Services, We may require permission to send SMS for verification.

We are required to collect certain personal data to provide access to the Platform and Services. If You fail to provide requested data, We may be unable to fulfill Our obligations or provide the Services, which may result in cancellation or limitation of Your access to the Services.

3. HOW WE COLLECT DATA ABOUT YOU

We use different methods to collect and process personal data about You, including:

1. Information You provide Us: data You consent to give when You register, use Platform features, upload documents, correspond with Us, or report issues.

2. Information We collect about You and Your device: automatically collected data via cookies and similar technologies each time You visit the Platform or use the Services.

3. Information from other sources: data received from third parties and public sources, including analytics providers, credit bureaus and other service providers used for fraud checks and service improvement.

We do not control personal data You choose to make public (for example, public reviews or comments). Posting such data is at Your own risk.

4. HOW WE USE YOUR PERSONAL DATA AND FOR WHAT PURPOSES

1. We use Your personal data in accordance with applicable law, primarily to provide the Services or to comply with legal obligations.

2. By using Our Services and creating an account, You authorise Us, Our partners, Lenders, Insurance Partners, Third Party Insurance Intermediaries, Partnered FD Facilitators, Digital Gold Providers and affiliates to contact You about Services and credit products, customer support, dispute resolution and collection services.

3. Examples of purposes and activities (including automated processing) for which We use Your personal data:

   1. To register You as a user of the Platform;

   2. To provide You with the Services;

   3. To communicate details of Services and process queries;

   4. To facilitate KYC;

   5. To facilitate loan applications and credit facilities with regulated entities;

   6. To facilitate Services by Our partners;

   7. To manage Our relationship with You;

   8. To administer and protect Our business and Platform (troubleshooting, analytics, testing);

   9. To send communications including WhatsApp business messages or calls (including AI-initiated calls) related to Services;

   10. To conduct data analytics and monitor trends;

   11. To improve Our business and delivery models;

   12. To perform contractual obligations;

   13. To enforce Our Terms;

   14. To undertake marketing services (including promotional messages/calls);

   15. To respond to court orders or legal requests;

   16. To comply with RBI and IRDAI norms such as contacting or locating You in case of defaults;

   17. To ensure compliance with applicable laws.

5. HOW WE SHARE YOUR PERSONAL DATA

1. You agree and acknowledge that any and all information pertaining to You, whether or not You directly provide it to Us (via the Services or otherwise), including but not limited to personal correspondence such as emails, instructions from You, etc., may be collected, compiled, and shared by Us with third parties after obtaining Your explicit consent, solely in order to render the Services to You. This may include but not be limited to Lenders, Insurance Partners, Third Party Insurance Intermediaries, Partnered FD Facilitators Digital Gold Providers and (as defined in the Terms), other partners who facilitate the provision of Services and products available on Our Platform, storage providers, data analytics providers, consultants, lawyers, and auditors. We may also share this information with other entities in the kreditbuddha group in connection with the above-mentioned purposes. If You fail to provide consent for sharing of such data when requested by Us, We may not be able to perform Our obligations under the arrangement We have with You or are trying to enter into with You. In this case, We may not be able to provide the Services to You.

2. You agree and acknowledge that by using Our Services and creating an account on the Platform, You authorise Us, Our associates, partners, service providers, and affiliates to contact You via email, phone, or otherwise. This is to ensure that You are aware of all the features of the Services and facilitate You in Your access and use of the Services.

3. You agree and acknowledge that We may share Your data, where We are required by law, any court, a government agency, or authority to disclose such information. Such disclosures are made in good faith and belief that it is reasonably necessary to do so for enforcing this Policy or the Terms, or in order to comply with any applicable laws and regulations.

6. ACCESS AND UPDATING YOUR PERSONAL DATA

You warrant that all personal data You provide is accurate and up-to-date. We make best efforts to provide You with the ability to review and correct inaccurate or deficient data (subject to legal requirements). We reserve the right to verify the accuracy of personal data You provide.

7. DATA SECURITY

1. We implement appropriate security measures and access controls to protect Your personal data and follow standards prescribed by applicable law, including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, and RBI norms. Our safety processes are audited by third-party cyber security agencies periodically.

2. Where personal information collection is mandatory (e.g., to pull bureau reports or loan applications), We encrypt the data with up-to-date security algorithms before transmission. All such data is encrypted at rest.

3. Information exchanged during Services is transmitted through secure sockets layer (SSL). We encrypt and store personal information wherever possible. Data is not shared with third parties unless core to serving the end-user, and user consent is taken in such scenarios.

4. Access to personal information is restricted only to employees who need to know to provide Services. Employees are trained on security procedures.

5. We maintain internal incident response processes to detect, analyse, contain, eradicate and recover from information security breaches. In the event of a breach, we will take timely measures to mitigate risk and inform impacted users as required by law.

8. DATA RETENTION AND DESTRUCTION

For details about retention and destruction practices, please refer to the Schedule to this Policy. Generally, personal data will be stored as required by applicable laws, regulatory requirements, or to defend legal claims. Other data not required by law will be deleted or anonymised upon customer request for deletion provided there is no active loan or service being availed.

9. YOUR LEGAL RIGHTS

Under certain circumstances, You have the right to:

1. Request the erasure of Your personal data: This enables You to ask Us to delete or remove Your personal data. We shall comply with any request, subject to applicable laws and the terms applicable to the Services you have availed through the Platform.

2. Right to deny consent: This enables You to deny Us the consent necessary to process Your personal data. If You exercise this right, it may impact or restrict Our ability to provide Services to You.

3. Right to revoke consent: This enables You to withdraw consent provided to Us previously for specific use of information, storing of information, sharing Your information with Our Lenders, Insurance Partners, Third Party Insurance Intermediaries, Partnered FD Facilitators, Digital Gold Providers and third parties and consent to contact You. We shall comply with any request, subject to applicable laws and the terms applicable to the Services You have availed through the Platform.

4. Right to rectify: We disclaim all liability and responsibility for the authenticity of the information provided by You to Us. However, You have the right to review and correct, update and/or amend Your information provided to Us previously for it to be accurate, complete and up to date. However, kindly note that in a situation where You deny consent, withdraw consent, avail the right to be forgotten, or provide inaccurate information, You may not be able to avail the entire scope of Our Services, and in such instance, We reserve the right to not provide You access to Our Services or any part thereof.

2. Notwithstanding Your right 9.1 (a) and (c), We reserve the right to retain information to the extent required for below mentioned purposes:

1. Comply with applicable laws;

2. Enforce Our legal rights; or

3. To provide any information required by regulatory authorities investigating any fraud or illegal activities.

However, Our Lenders, Insurance Partners, Third Party Insurance Intermediaries, Partnered FD Facilitators and Digital Gold Providers and such other partners who facilitate the provision of Services may contact You regarding Your potential or Your Use of the Services. This includes Our Lenders contacting You about and in relation to Your loan application, and payment of dues. Us and Our Lenders shall continue processing Your information, if Your application for provision of loan was sent to the Lender or if You have availed any loan from Our Lenders till all dues of such loan are paid. The Lenders may store Your information for as long as required to be stored per applicable laws. The Lenders may also require Us to retain information in circumstances the Lender has outsourced any services in relation to such loan, such as collection of dues, to Us and in such cases, We will be required to retain Your information for the period required by the Lender. We may deploy AI systems, tools and technologies either developed in-house or are deployed by Our third-party service providers, for specific tasks in payment collections, such as payment reminders, etc., and for this purpose, We will share Your information with the AI system.

If You wish to exercise any of the rights set out above, please write an email to the Grievance Officer, whose details are mentioned in Section 15 of this Policy, providing in as much detail as possible, the right(s) You wish to exercise. Please also include a description of the personal data You believe We hold or process about you, so that We may be able to locate such personal data. In the event that We need additional information from You, Our Grievance Officer will contact You further.

We will be able to reply to Your request(s) within 30 (thirty) days of raising the request. In the event that We are not able to respond to or acknowledge Your request within 30 (thirty) days of receipt due to any reason, We will inform You.

10. TRANSFER OF PERSONAL DATA

1. All Your data, including financial data collected by Us, is stored on systems located in India. We do not transfer personal data to any third country.

2. We share Your information with Lenders and third parties to complete loan applications, KYC checks, bank authentication, employment checks, NACH registrations, and loan repayment purposes. We also share information with Insurance Partners, Third Party Insurance Intermediaries, Partnered FD Facilitators and Digital Gold Providers.

3. Lists of Our Lenders and key third-party service providers are available at: www.kreditbuddha.com/digital-lending-partners .

11. LINKS TO THIRD PARTY WEBSITES

Our Services may link to Third-Party Services provided by partners, service providers, financial institutions, advertisers, and affiliates. Third-Party Services are governed by their own privacy policies. We are not responsible for third-party privacy practices. Please review third-party policies before submitting personal data to them. The list of third-parties collecting Information through the App is available at This link , which will be updated from time to time, for your reference

12. COOKIES

1. Cookies are small data files stored on Your device. We use cookies and tracking technologies to distinguish You from other users and remember preferences to improve the Services.

2. Cookies do not provide access to data on Your device like email addresses. Data collected via cookies enables Us to administer Services and provide a tailored experience. Disabling cookies may limit functionality.

3. Third parties may place cookies on certain pages of the Platform. We do not control third-party cookie practices.

13. BUSINESS TRANSITIONS

In the event of a business transition (merger, acquisition, sale of assets), Your personal data may be among assets transferred.

14. CHANGE IN PRIVACY POLICY

1. We keep Our Policy under regular review and may amend it from time to time at Our sole discretion.

2. Changes will be posted on this page and, where appropriate, notified to You by email or SMS.

15. GRIEVANCE OFFICER

You may contact Our Grievance Officer with enquiries relating to this Policy or Your personal data:

• Name: Gargi Shukla
• Email Address: Gargi.shukla@kreditbuddha.com

16. GOVERNING LAW AND DISPUTE RESOLUTION

The governing law and dispute resolution mechanism specified in the Terms shall apply to this Privacy Policy.

SCHEDULE

DATA RETENTION AND DESTRUCTION POLICY

1. OVERVIEW

This Data Retention and Destruction Policy describes kreditbuddha’s policy on data retention and destruction.

2. HOW LONG DO WE STORE YOUR DATA

Your personal data will continue to be stored as required or permitted by applicable laws or regulatory requirements, or as required for defending future legal claims. Data not required to be retained will be deleted or anonymised upon request for deletion provided there is no active loan or service being availed. In some instances, deletion requests may not be possible due to legal obligations.

3. OUR DATA DESTRUCTION PROTOCOLS

Upon completion of the retention period for each category of personal data, We shall delete or destroy, to the extent technically possible, personal data in Our possession or render the personal data anonymised so it no longer constitutes personal data.