Privacy Policy

This Privacy Policy ("Policy") describes how Credbuddha Financial Consultancy Services Private Limited, a company incorporated under the Companies Act, 2013 and having its registered office at [Building No./Flat No.: 50-90-25/GF-1, Road/Street: main road, Santhi Puram, Visakhapatnam, Andhra Pradesh - 530016]. ("CREDBUDDHA", "Company", "we", "our" or "us"), collects, receives, processes, stores, uses, shares, transfers, retains and protects Personal Data in connection with the website, mobile application, digital interfaces, APIs, communications, loan application journeys and related services operated by CREDBUDDHA (collectively, the "Platform").

CREDBUDDHA operates a digital lending platform and may act as a Lending Service Provider ("LSP"), Digital Lending Application ("DLA") operator, technology service provider, marketplace facilitator or such other role as may be permitted under Applicable Law and contractual arrangements with partner lenders and service providers.

This Policy applies to all users, customers, prospective customers, visitors and other individuals who access, interact with or use the Platform or Services. It also extends to users who visit the Platform to learn more about the Company, its offerings, and its operations. For the purposes of this Privacy Policy the term “User(s)” and wherever the context so requires “You”, “Your”, “Yourself” shall mean any natural or legal person who accesses or uses the Platform.

You are advised to read the Privacy Policy carefully and accept the terms of this Privacy Policy before using the services offered by us. By accessing and using the Platform directly or indirectly, you signify that you have read, understood and agree to be bound by this Privacy Policy. This Policy should be read together with the Terms of Use, consent notices, disclosures presented during customer journeys and any lender-specific privacy notices that may be applicable to a particular product or service. Any capitalised terms used but not specifically defined in this Policy shall carry the same meaning as set forth in the relevant Terms of Use.

By accessing or using the Platform, submitting information through the Platform or availing any Services, you acknowledge that you have read and understood this Policy and consent to the processing of your Personal Data in accordance with this Policy and Applicable Law. If you do not agree with the terms of this Policy or do not wish for your Personal Data to be processed in the manner described herein, you should discontinue access to and use of the Platform and Services. However, please note that certain Services may not be available unless the necessary Personal Data is provided and the required consents are granted.

CREDBUDDHA reserves the right to amend, modify, update or replace this Policy from time to time to reflect changes in Applicable Law, regulatory requirements, technology, business practices or the Services offered through the Platform. Any revised version of this Policy shall become effective upon publication on the Platform unless otherwise specified. Users are encouraged to review this Policy periodically to remain informed regarding CREDBUDDHA's privacy practices.

1. DEFINITIONS

For the purposes of this Policy, the following terms shall have the meanings assigned to them below:

2. CATEGORIES OF PERSONAL DATA WE COLLECT

Depending on the nature of the Services requested, the stage of the customer journey, the permissions granted by You and the requirements of Applicable Law, CREDBUDDHA may collect, receive, generate, verify, infer or otherwise process the following categories of Personal Data:

2.1 Identity and KYC Information

We may collect information required to identify and verify You, including Your name, date of birth, age, gender, photograph, signature, Permanent Account Number (PAN), Aadhaar-related information as permitted under Applicable Law, government-issued identification documents, video verification records, Know Your Customer (KYC) information and other information required for customer onboarding, verification, fraud prevention and regulatory compliance.

2.2 Contact Information

We may collect contact information including residential address, correspondence address, email address, mobile number and other information required to communicate with You regarding the Services.

2.3 Profile, Application and Eligibility Information

We may collect information relating to Your employment, occupation, employer details, educational qualifications, income profile, loan requirements, residential status, financial profile and other information provided during onboarding, application journeys or while availing Services through the Platform.

2.4 Financial Information

We may collect or receive financial information including bank account details, account statements, salary information, income details, cash-flow information, transaction information, repayment capacity information and other financial information provided by You or obtained pursuant to Your consent and Applicable Law.

2.5 Credit Information

Subject to Applicable Law and required consents, we may obtain credit reports, credit scores, repayment history, credit enquiries, existing credit facilities and other credit-related information from Credit Information Companies, lenders and authorised third parties.

2.6 Account Aggregator Information

Where You provide consent through the Account Aggregator ecosystem, we may receive financial information through authorised Account Aggregators, including account information, transaction information and other financial information authorised by You through the applicable consent artefact.

2.7 Device, Technical and Usage Information

When You access or use the Platform, we may automatically collect technical and usage information, including device identifiers, IP address, browser information, operating system details, application logs, security logs, cookie identifiers, SDK identifiers, session information, network information and information relating to Your interaction with the Platform.

2.8 Location Information

Where necessary for a specific Service and with Your consent, we may collect approximate or precise geolocation information for identity verification, fraud prevention, security, regulatory compliance or service delivery purposes.

2.9 Communication Information

We may collect information contained in emails, SMS communications, WhatsApp communications, chats, customer support interactions, grievances, feedback, surveys, complaints and other communications exchanged between You and CREDBUDDHA.

2.10 Consent, Authentication and Audit Information

We may maintain records relating to consents, authorisations, consent artefacts, OTP verification records, electronic signatures, authentication events, communication preferences, transaction logs, audit trails and other records required for operational, legal, security and regulatory purposes.

2.11 Information Received from Third Parties

We may receive Personal Data from lenders, Regulated Entities, Account Aggregators, Credit Information Companies, verification agencies, payment service providers, technology service providers, fraud prevention service providers, publicly available sources and other authorised third parties in connection with the Services.

2.12 Information Generated Through Use of the Platform

We may generate information relating to Your use of the Platform, including eligibility assessments, service preferences, customer journey information, application status information, customer support records and other operational information required for providing and improving the Services.

2.13 CREDBUDDHA shall endeavour to collect and process only such Personal Data as is reasonably necessary for the purposes disclosed in this Policy, compliance with Applicable Law and provision of the Services requested by You.

2.14 In accordance with the RBI Digital Lending framework and Applicable Law, CREDBUDDHA does not access or collect contact lists, call logs, SMS messages, telephony functions, photo galleries, stored files, media content or other device-stored personal content for digital lending purposes, except where expressly permitted under Applicable Law, required for a specific Service requested by You and accessed pursuant to Your explicit consent.

3. HOW WE COLLECT PERSONAL DATA

CREDBUDDHA may collect Personal Data directly from You, through Your interactions with the Platform, from Partner Institutions and authorised third parties, or from information generated during the provision of the Services.

3.1 Information Provided Directly by You: We may collect Personal Data that You voluntarily provide while creating an account, completing registration or onboarding processes, applying for financial products, uploading documents, submitting forms, responding to requests for information, participating in surveys, communicating with customer support, lodging grievances, providing consents or otherwise interacting with the Platform or Services.

3.2 Information Collected During Use of the Platform: When You access or use the Platform, certain information may be collected automatically through cookies, software development kits (SDKs), web beacons, tags, device identifiers, log files and similar technologies. Such information may include technical information, usage information, device information, security information and information relating to Your interaction with the Platform.

3.3 Information Obtained from Lenders and Partner Institutions: We may receive Personal Data from Lenders, Regulated Entities, Account Aggregators, Credit Information Companies, verification agencies, payment service providers, communication service providers, technology partners and other authorised third parties involved in the provision of the Services.

3.4 Information Obtained from Credit Information Companies: Subject to Applicable Law and any required consent, we and/or the relevant Lender may obtain credit reports, credit scores, repayment history, credit enquiry information and other credit-related information from Credit Information Companies for purposes including identity verification, eligibility assessment, fraud prevention, risk evaluation, credit underwriting support and regulatory compliance.

3.5 Information Received Through the Account Aggregator Ecosystem: Where You provide valid consent through an Account Aggregator consent artefact, we and/or the relevant Lender may receive financial information from authorised Financial Information Providers through the Account Aggregator ecosystem for the specific purposes authorised by You.

3.6 Information Collected Through Communications: We may collect information contained in emails, SMS messages, WhatsApp messages, telephone conversations, customer support interactions, chats, complaints, feedback, surveys, grievance submissions and other communications exchanged between You and CREDBUDDHA.

3.7 Information Generated During the Provision of Services: We may generate and maintain records relating to Your use of the Platform and Services, including application status information, eligibility assessments, transaction records, authentication records, consent records, communication records, audit logs, security logs and other operational records.

3.8 Information Obtained from Publicly Available and Lawful Source: Where permitted under Applicable Law, we may obtain information from publicly available databases, government repositories, regulatory databases, sanction lists, fraud prevention databases and other lawful sources for identity verification, fraud prevention, risk management, due diligence, regulatory compliance and security purposes.

3.9 Information Collected Through Cookies and Similar Technologies: The Platform may use cookies, SDKs, pixels, tags, web beacons and similar technologies to recognise Users, improve functionality, analyse usage patterns, enhance security, personalise user experience, maintain session integrity and support the provision of Services. Further details regarding such technologies are set out in this Policy and any applicable cookie notice.

3.10 Information Received Through Referrals and Business Partners: Where You access the Platform through referral programmes, marketing campaigns, business correspondents, distribution partners, lead generation partners or other authorised channels, we may receive information relating to such referral source in accordance with Applicable Law.

3.11 Combination of Information: CREDBUDDHA may combine information collected from multiple sources described in this Policy for the purposes set out herein, subject to Applicable Law and the consents provided by You.

4. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA

CREDBUDDHA processes Personal Data only for lawful purposes connected with the provision of the Services, compliance with Applicable Law and the legitimate operation, administration and improvement of the Platform. Depending upon the Services requested, the nature of Your interaction with the Platform and the consents provided by You, Personal Data may be processed for one or more of the following purposes:

• (a) To create, maintain and administer user accounts, facilitate registration and onboarding, authenticate Users, verify credentials and enable access to the Platform and Services.
• (b) To verify identity, perform Know Your Customer (KYC) procedures, customer due diligence, document verification, video verification and other checks required under Applicable Law or by Lenders and Partner Institutions.
• (c) To enable Users to explore financial products, facilitate lender matching, assess preliminary eligibility, process and transmit applications, share relevant information with Lenders and Partner Institutions and facilitate access to financial products and Services.
• (d) To obtain, access, review, process and share credit-related information, facilitate credit enquiries, assess creditworthiness, evaluate repayment capacity and support underwriting, servicing and monitoring of financial products.
• (e) To retrieve, receive, analyse, process and share financial information through the Account Aggregator ecosystem pursuant to valid consent artefacts and for the purposes authorised by You, including verification, income assessment, cash-flow analysis, underwriting support and eligibility evaluation.
• (f) To detect, prevent, investigate and mitigate fraud, identity theft, unauthorised access, suspicious activities, cyber threats, money laundering risks, misuse of the Platform and other activities that may compromise the integrity, security or reliability of the Platform or Services.
• (g) To communicate with You regarding applications, transactions, account activity, service updates, consent requests, security alerts, customer support requests, grievances, complaints, repayment reminders, regulatory disclosures and other matters connected with the Services.
• (h) To administer applications, facilitate interactions between Users and Lenders, process transactions, maintain records, manage customer relationships and support the delivery and administration of Services.
• (i) To comply with Applicable Law, regulatory requirements, RBI directions, judicial orders, governmental requests, audit requirements, reporting obligations, record retention requirements and directions issued by competent authorities.
• (j) To analyse user behaviour, evaluate Platform performance, conduct analytics and research, improve customer experience, develop new products and services, optimise Platform functionality and enhance the quality, security and effectiveness of the Services.
• (k) To maintain consent records, audit trails, transaction records, communication records, authentication records, security logs and other operational records required for governance, compliance, business continuity, dispute resolution and risk management purposes.
• (l) Subject to Applicable Law and Your communication preferences, to provide information regarding products, services, offers, promotions, campaigns, surveys, educational content, financial awareness initiatives and other information that may be relevant to You.
• (m) To establish, exercise or defend legal rights, investigate complaints, resolve disputes, enforce contractual obligations and protect the rights, property, reputation, security and legitimate interests of CREDBUDDHA, Users, Lenders, Partner Institutions and other stakeholders.
• (n) To facilitate mergers, acquisitions, investments, financings, restructurings, asset transfers, business transfers, due diligence exercises and other corporate transactions, subject to appropriate confidentiality and security safeguards.
• (o) To generate anonymised, aggregated, statistical or de-identified information for analytics, research, reporting, service improvement, product development and other lawful business purposes, provided that such information does not identify any individual.
• (p) For such other purposes as may be disclosed to You at the time of collection, authorised by You through consent, reasonably connected with the Services or otherwise permitted under Applicable Law.

4.2 CREDBUDDHA shall process Personal Data only for purposes that are lawful, specific and reasonably necessary for the provision of the Services, compliance with Applicable Law and fulfilment of the purposes described in this Policy.

5. LEGAL BASIS, CONSENT AND LAWFUL PROCESSING

5.1 CREDBUDDHA shall process Personal Data only in accordance with Applicable Law and for the purposes described in this Policy.

5.2 Where required under Applicable Law, CREDBUDDHA shall obtain consent through clear, specific, informed and affirmative action prior to collecting, using, sharing or otherwise processing Personal Data.

5.3 By voluntarily providing Personal Data, using the Platform, availing the Services or providing consent through the Platform, You authorise CREDBUDDHA to process Your Personal Data for the purposes set out in this Policy and the Terms of Use.

5.4 Certain Services may require separate or additional consents, including consents relating to identity verification, KYC verification, credit bureau enquiries, Account Aggregator-based financial information sharing, bank account verification, communications, marketing preferences or other regulatory requirements.

5.5 Consents may be obtained through click-wrap acceptance, OTP verification, electronic signatures, biometric authentication, consent artefacts, digital acknowledgements or such other legally recognised mechanisms as may be permitted under Applicable Law.

5.6 CREDBUDDHA shall maintain records of consents, authorisations, consent artefacts and other evidence of lawful processing as may be required under Applicable Law.

5.7 Subject to Applicable Law, You may withdraw consent for consent-based processing through the mechanisms made available on the Platform or as otherwise specified in this Policy.

5.8 Withdrawal of consent shall not affect the lawfulness of processing undertaken prior to such withdrawal and may affect CREDBUDDHA's ability or the ability of a Lender or Partner Institution to provide certain Services.

5.9 Notwithstanding withdrawal of consent, CREDBUDDHA may continue to retain, process, use or disclose information where required under Applicable Law, regulatory requirements, contractual obligations, fraud prevention requirements, dispute resolution obligations or lawful record-retention requirements.

5.10 Subject to Applicable Law, You may withdraw any consent previously provided for the processing of Personal Data at any time through the mechanisms made available on the Platform, through Your account settings, by contacting CREDBUDDHA through the channels specified in this Policy or through such other means as may be made available from time to time. CREDBUDDHA shall endeavour to make the process for withdrawal of consent as accessible and convenient as the process through which such consent was originally provided.

5.11 Upon withdrawal of consent, CREDBUDDHA shall, within a reasonable period and subject to Applicable Law, cease processing the Personal Data for the purposes for which consent has been withdrawn unless:

• (a) such processing is required for compliance with Applicable Law, regulatory requirements, judicial orders or directions issued by competent authorities;
• (b) retention or processing is necessary for the establishment, exercise or defence of legal claims;
• (c) retention or processing is required for fraud prevention, security monitoring, audit requirements, dispute resolution or risk management purposes;
• (d) retention is required pursuant to contractual obligations, lender requirements or lawful record-retention obligations; or
• (e) continued processing is otherwise permitted or required under Applicable Law.

5.12 Where withdrawal of consent relates to marketing or promotional communications, CREDBUDDHA shall cease sending such communications within a reasonable period, subject to operational requirements. However, CREDBUDDHA may continue to send transactional, service-related, security-related, regulatory or legally required communications.

5.13 CREDBUDDHA may take reasonable steps to verify the identity and authority of the individual submitting a withdrawal request before acting upon such request in order to protect the security and integrity of Personal Data.

5.14 Nothing contained in this Clause shall limit any rights available to a Data Principal under the Digital Personal Data Protection Act, 2023 or any other Applicable Law.

6. DEVICE PERMISSIONS AND PLATFORM TECHNOLOGIES

6.1 Depending upon the Services requested by You, CREDBUDDHA may request access to certain device features, including the camera, microphone, location services or document storage functionalities for customer onboarding, identity verification, KYC compliance, fraud prevention, video verification, customer support and other lawful purposes.

6.2 Such access shall be requested only where necessary for a specific purpose and shall remain subject to Your explicit consent.

6.3 The Platform may utilise cookies, software development kits (SDKs), web beacons, pixels, tags, device identifiers, log files and similar technologies for authentication, security, fraud prevention, analytics, service improvement, performance monitoring, personalisation and user experience enhancement.

6.4 Certain cookies and similar technologies may be necessary for the operation, security and functionality of the Platform and may continue to operate in accordance with Applicable Law.

6.5 Users may manage certain browser and device settings relating to cookies and similar technologies; however, disabling such technologies may affect the functionality or availability of certain Services.

6.6 In accordance with the RBI Digital Lending framework, CREDBUDDHA does not access or collect contact lists, call logs, SMS messages, telephony functions, photo galleries, stored files, media content or other device-stored personal content for digital lending purposes except where expressly permitted under Applicable Law and specifically authorised by the User for a clearly disclosed purpose.

7. SHARING AND DISCLOSURE OF PERSONAL DATA

7.1 CREDBUDDHA may share, disclose, transfer, transmit or otherwise make available Personal Data only to the extent reasonably necessary for the purposes described in this Policy, provision of the Services, fulfilment of contractual obligations, compliance with Applicable Law or pursuant to the consent provided by You.

7.2 Subject to Applicable Law and the consent provided by You, Personal Data may be shared with:

• (a) Lenders and Regulated Entities for the purpose of processing loan applications, eligibility assessment, underwriting, loan servicing, customer support and regulatory compliance;
• (b) Account Aggregators, Credit Information Companies, KYC service providers, verification agencies and other financial ecosystem participants involved in the provision of the Services requested by You;
• (c) technology service providers, cloud service providers, communication service providers, payment service providers and other vendors engaged by CREDBUDDHA solely for the purpose of operating the Platform and providing the Services; and
• (d) governmental authorities, regulators, courts, tribunals, law enforcement agencies or other competent authorities where disclosure is required under Applicable Law.

7.3 Where Personal Data is shared with service providers or authorised third parties, such sharing shall be limited to the information reasonably necessary for the relevant purpose and shall be subject to appropriate contractual, confidentiality, privacy and security obligations.

7.4 CREDBUDDHA shall obtain additional consent where required under Applicable Law before sharing Personal Data for any purpose that is materially different from the purpose for which such Personal Data was originally collected or authorised by You.

7.5 CREDBUDDHA may disclose or transfer Personal Data in connection with a merger, acquisition, restructuring, financing transaction, business transfer or similar corporate transaction, subject to Applicable Law and appropriate confidentiality and security safeguards.

7.6 CREDBUDDHA may share anonymised, aggregated or de-identified information that does not identify any individual for analytics, research, service improvement, reporting and other lawful business purposes.

7.7 Any sharing or disclosure of Personal Data shall be undertaken in accordance with the principles of purpose limitation, data minimisation, security and accountability under Applicable Law.

7.8 Lender Privacy Policies

Where a User applies for, accepts or avails a financial product offered by a Lender through the Platform, the relevant Lender may independently collect, process, store, use, share and retain Personal Data in accordance with its own privacy policy, loan documentation, regulatory obligations and Applicable Law. CREDBUDDHA shall endeavour to make available, provide access to or facilitate access to the relevant Lender's privacy policy, Key Fact Statement (KFS), consent disclosures and other applicable documentation before the User proceeds with the relevant loan transaction. The collection, processing, use, sharing and retention of Personal Data by a Lender shall be governed by the Lender's privacy policy, contractual documentation and Applicable Law. CREDBUDDHA shall not be responsible for the privacy practices, data handling activities or independent processing activities undertaken by any Lender, Account Aggregator, Credit Information Company or other third party acting in its own capacity. Users are encouraged to carefully review the privacy policies and disclosures of the relevant Lender and other third parties before providing information or entering into any transaction with such entities.

8. MARKETING AND COMMUNICATIONS

8.1 CREDBUDDHA may communicate with You regarding the Services, applications, account activity, security alerts, consent requests, transaction updates, customer support matters, grievance redressal, regulatory disclosures and other service-related matters through email, SMS, WhatsApp, telephone calls, push notifications, in-app notifications or other communication channels authorised by You or permitted under Applicable Law.

8.2 Subject to Applicable Law and Your communication preferences, CREDBUDDHA may also send information regarding products, services, offers, promotions, campaigns, surveys, financial awareness initiatives, newsletters, campaigns and other information that may be relevant to You.

8.3 By providing Your contact details through the Platform, You consent to receiving service-related and transactional communications that are necessary for the provision of the Services, processing of applications, customer support, fraud prevention, security verification, regulatory compliance and administration of Your relationship with CREDBUDDHA.

8.4 CREDBUDDHA may engage authorised communication service providers, customer engagement platforms and technology partners to facilitate communications with You. Such service providers shall be subject to appropriate contractual, confidentiality and security obligations.

8.5 You may withdraw consent for receiving marketing or promotional communications at any time by using the unsubscribe mechanism provided in such communication, updating Your communication preferences through the Platform, contacting CREDBUDDHA or through such other mechanisms as may be made available from time to time.

8.6 Withdrawal of consent for marketing communications shall not affect the delivery of transactional, service-related, security-related, grievance-related, legal, regulatory or other communications necessary for the provision of the Services or compliance with Applicable Law.

8.7 CREDBUDDHA may maintain records of communication preferences, consent records, opt-in records and opt-out requests for compliance, audit, regulatory and dispute resolution purposes.

8.8 Communications transmitted over electronic channels may be subject to interruptions, delays, transmission failures or technical limitations beyond CREDBUDDHA's reasonable control. CREDBUDDHA shall not be responsible for any delay, non-delivery or interruption of communications caused by telecommunications providers, internet service providers or other third-party service providers.

8.9 CREDBUDDHA does not sell Personal Data to third parties for their independent marketing purposes and shall not disclose Personal Data to third parties for direct marketing except in accordance with Applicable Law and with any consent required thereunder.

9. DATA RETENTION, STORAGE AND DELETION

9.1 CREDBUDDHA shall retain Personal Data only for as long as is reasonably necessary to fulfil the purposes described in this Policy, provide the Services, comply with Applicable Law, fulfil contractual obligations, protect legal rights and interests, prevent fraud and satisfy regulatory, audit, accounting and record-keeping requirements.

9.2 Personal Data shall be stored and processed in secure systems, databases and technology environments maintained by CREDBUDDHA or its authorised service providers, subject to appropriate technical, organisational and contractual safeguards.

9.3 The period for which Personal Data is retained may vary depending on the nature of the information, the Services requested, applicable legal and regulatory requirements, contractual obligations, the existence of ongoing disputes or investigations and other legitimate business purposes.

9.4 Without prejudice to Clause 9.1, CREDBUDDHA may retain application records, onboarding records, KYC records, consent records, communication records, grievance records, authentication records, audit trails, transaction records, credit assessment records and other operational records for a period of up to five (5) years from:

• (a) closure of the customer relationship;
• (b) completion of the relevant transaction or Service;
• (c) rejection, withdrawal or abandonment of an application; or
• (d) such other event as may be determined under CREDBUDDHA's internal retention policies,

whichever is later, unless a longer retention period is required or permitted under Applicable Law, regulatory directions, contractual obligations or lawful business requirements.

9.5 CREDBUDDHA may retain Personal Data beyond the periods specified above where such retention is necessary:

• (a) to comply with Applicable Law, regulatory requirements, judicial orders or directions issued by competent authorities;
• (b) to establish, exercise or defend legal rights or claims;
• (c) for fraud prevention, cybersecurity, risk management, audit or investigative purposes;
• (d) in connection with ongoing disputes, litigation, enforcement actions, regulatory proceedings or governmental investigations; or
• (e) for any other lawful purpose permitted under Applicable Law.

9.6 Upon expiry of the applicable retention period, and subject to Applicable Law, Personal Data may be deleted, erased, anonymised, aggregated, archived or otherwise securely disposed of using measures reasonably designed to prevent unauthorised access, recovery or reconstruction.

9.7 Subject to Applicable Law, You may request deletion or erasure of Personal Data by contacting CREDBUDDHA through the mechanisms specified in this Policy. CREDBUDDHA shall consider such requests in accordance with Applicable Law and may decline or defer deletion where retention is required or permitted under law, regulatory requirements, contractual obligations or legitimate business purposes.

9.8 CREDBUDDHA shall periodically review the Personal Data retained by it and shall take reasonable steps to ensure that Personal Data that is no longer required for lawful purposes is deleted, anonymised or otherwise disposed of in accordance with Applicable Law and internal retention policies.

10. INFORMATION SECURITY AND PROTECTION MEASURES

10.1 CREDBUDDHA is committed to protecting Personal Data through the implementation of appropriate technical, organisational, administrative and physical security measures designed to safeguard Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, misuse or other unlawful forms of processing.

10.2 CREDBUDDHA maintains and implements information security measures that are appropriate to the nature, scope and sensitivity of the Personal Data processed, the risks associated with such processing and the requirements of Applicable Law.

10.3 Such security measures may include, where appropriate:

• (a) access controls and role-based access management;
• (b) user authentication and authorisation mechanisms;
• (c) encryption of data in transit and at rest, where applicable;
• (d) network and endpoint security controls;
• (e) logging, monitoring and audit trail mechanisms;
• (f) vulnerability assessments, security testing and risk assessments;
• (g) secure backup and recovery procedures;
• (h) vendor risk management and due diligence processes;
• (i) employee confidentiality obligations and security awareness programmes; and
• (j) incident response, business continuity and disaster recovery procedures.

10.4 Access to Personal Data shall be restricted to authorised personnel, service providers and representatives who require such access for legitimate business, operational, legal, regulatory or security purposes.

10.5 CREDBUDDHA shall take reasonable steps to ensure that service providers and third parties processing Personal Data on its behalf are subject to appropriate contractual, confidentiality, privacy and information security obligations.

10.6 While CREDBUDDHA seeks to implement commercially reasonable safeguards, no method of transmission over the internet, mobile networks or electronic storage systems can be guaranteed to be completely secure. Accordingly, CREDBUDDHA does not warrant or guarantee absolute security of Personal Data.

10.7 Users are responsible for maintaining the confidentiality of passwords, OTPs, authentication credentials, devices and account access information and shall promptly notify CREDBUDDHA of any suspected unauthorised access, misuse, compromise or security incident relating to their account.

10.8 In the event of a personal data breach, cybersecurity incident or security compromise, CREDBUDDHA shall take such actions as may be required under Applicable Law, including investigation, containment, remediation, notification and reporting obligations, where applicable.

10.9 CREDBUDDHA may periodically review, update and enhance its security controls and practices to address evolving security threats, technological developments, regulatory requirements and business needs.

11. YOUR RIGHTS AS A DATA PRINCIPAL

11.1 Subject to Applicable Law, You may exercise certain rights in relation to Your Personal Data, including the right to:

• (a) obtain information regarding the Personal Data being processed and the processing activities undertaken by CREDBUDDHA;
• (b) seek correction, completion, updating or rectification of inaccurate, incomplete or misleading Personal Data;
• (c) withdraw consent previously provided for the processing of Personal Data;
• (d) request erasure or deletion of Personal Data where such deletion is permissible under Applicable Law;
• (e) seek redressal of grievances relating to the processing of Personal Data;
• (f) nominate another individual to exercise rights available under Applicable Law in the event of death or incapacity; and
• (g) exercise such other rights as may be available under Applicable Law from time to time.

11.2 CREDBUDDHA may require reasonable verification of identity before acting upon any request relating to Personal Data.

11.3 The exercise of certain rights may be subject to legal, regulatory, contractual, technical or operational limitations and exceptions permitted under Applicable Law.

11.4 Where Personal Data is processed by a Lender, Account Aggregator, Credit Information Company or other third party acting as an independent data fiduciary or controller, requests relating to such processing may need to be directed to the relevant entity in accordance with its privacy policy and Applicable Law.

11.5 CREDBUDDHA shall endeavour to respond to requests and grievances relating to Personal Data within the timelines prescribed under Applicable Law.

12. CHILDREN'S PRIVACY

12.1 The Platform and Services are intended only for individuals who are legally competent to enter into binding contracts and who satisfy the eligibility criteria prescribed under Applicable Law and the Terms of Use.

12.2 CREDBUDDHA does not knowingly collect, solicit or process Personal Data from children or persons who are not legally eligible to use the Services.

12.3 If CREDBUDDHA becomes aware that Personal Data relating to a child has been inadvertently collected or processed, CREDBUDDHA may take appropriate steps to delete such information, restrict processing or take such other actions as may be required under Applicable Law.

12.4 Parents, guardians or lawful representatives who believe that a child has provided Personal Data through the Platform may contact CREDBUDDHA using the details provided in this Policy.

13. GRIEVANCE REDRESSAL OFFICER

13.1 CREDBUDDHA has established a grievance redressal mechanism to address complaints, concerns, requests and queries relating to privacy, Personal Data processing, consent management and the Services.

13.2 Any grievance, complaint or request relating to Personal Data may be submitted to the Grievance Redressal Officer using the contact details specified below:

13.3 CREDBUDDHA shall endeavour to acknowledge and address grievances within the timelines prescribed under Applicable Law.

13.4 Where a User is dissatisfied with the resolution of a grievance, the User may avail such remedies as may be available under Applicable Law.

14. CONTACT US

If You have any questions, concerns, requests or feedback relating to this Privacy Policy, the processing of Personal Data, the Services or CREDBUDDHA's privacy practices, You may contact us at:

CREDBUDDHA shall endeavour to respond to legitimate requests and enquiries within a reasonable period and in accordance with Applicable Law.