Privacy Policy

CreditMantri Finserve Private Limited (“CreditMantri”, "we", "us", or "our") operates the websit www.creditmantri.com/ and the mobile application ‘CreditMantri’ (hereinafter collectively referred to as the "Platform"). CreditMantri is committed to protecting your (“you” or “your” or “yourself” or “user”) privacy and the information that you share while using the Platform. We value the trust you place in us and your privacy is important to us. That’s why we maintain the highest security standards for securing the transactions and your information.

This privacy policy (“Privacy Policy”) covers how we collect and treat the personal information that we collect / receive / retain from you. This Privacy Policy is incorporated into and subject to our Terms of Use (“Terms”) and shall be read harmoniously and in conjunction with them. All capitalised terms used herein however not defined under this Privacy Policy shall have the meaning ascribed to them under the Terms.

Please read the Privacy Policy carefully prior to using or registering on the Platform or accessing any material, information or availing any Services through the Platform. This Privacy Policy (i) will be considered to be an electronic record under the Indian data privacy laws including the Information Technology Act, 2000 read with rules and regulations made thereunder; (ii) will constitute a ‘Notice’ under the Digital Personal Data Protection Act, 2023, read with rules and regulations made thereunder; and (iii) will not require any physical, electronic, or digital signature by the Company.

CreditMantri's Privacy Policy is governed by the fundamental principle of maintaining your trust and confidence when handling your Personal Information (defined below).

• (i) You will always have the ability to make choices about what Personal Information you provide to us and how such information is used. All our forms / registrations will have an explicit opt out clause. However, please note we may not be able to provide you our Services if you do not provide us with the requested information.
• We will protect your personal information by maintaining physical, electronic and procedural safeguards as per Indian law.
• We will train our employees in the proper handling of personal information. When we use other companies to provide services for us, we require them to protect the confidentiality of personal information we receive from you.
• Our Privacy Policy describes how we handle your information when you visit our Platform,receive emails / SMSs / WhatsApp messages from CreditMantri.
• This Privacy Policy does not cover information you may choose to provide to third party websites we advertise or to social media sites where we have a profile. These will be governed by the privacy policies on those sites

“Personal Information” is any information about an individual if such individual is identifiable: (i) by such information; or (ii) in relation to such information. This can include, without limitation,information such as:

• name, age, gender, photo, address, phone number, e-mail id, nominee details
• PAN, income details, your business-related information, verification documents as mandated by relevant regulatory authorities;
• your device details such as device identifier, internet bandwidth, mobile device model, browser plug-ins, and cookies or similar technologies that may identify your browser, device and plug-ins, and time spent, IP address and location; and
• your Short Messaging Service (SMS) messages stored on your device, data collected from your camera and microphone.

1. On what grounds do we process your Personal Information?

1.1. Consent: In most cases, we will process your Personal Information on the basis of your prior explicit consent, which you can withdraw at any time. Please refer to Section 2 below to understand the purposes for which we process your Personal Information.

You have the ability to reject consent for providing your Personal Information. However certain Personal Information may be necessary to provide you a Service and we may not be able to provide you with a Service or certain Platform features if the Personal Information requested is necessary for the same.

1.2. Notwithstanding anything contained herein, we may, in compliance with applicable laws in India, process your Personal Information without obtaining your consent in the event: (i) you have voluntarily provided your Personal Information to us, and have not indicated that you do not consent to the use of such Personal Information by us; (ii) the purpose is for fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force; (iii) the purpose is for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India; and (iv) the purpose is for taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order

2. Why, How and What Information Do We Collect

We will only collect your Personal Information on the grounds stated above in Section 1 and in accordance with applicable laws. We collect your Personal Information in the following ways:

2.1. Directly from you, e.g. when you sign up for our Services, apply for or purchase of Services from Us or Products from our Partners.

Account handles (such as Google): In the event you use any other accounts (such as Google)to link your Account, we will only collect such registered email address and user public profile information like your name and email, depending on the social account used by you to log into the Platform. However, we do not collect / store any account passwords.

addition to the aforementioned, information provided by you may also be used: (i) to resolve disputes and troubleshoot problems; (ii) to help promote a safe service on the Platform and protect the security and integrity of the Platform, the Services and the users; (iii) to customize your experience on the Platform or share marketing material with you; (iv) to detect, prevent and protect us from any errors, fraud and other criminal or prohibited activity on the Platform; (v) to enforce and inform about our terms and conditions; (vi) to process and fulfil your request for Services or respond to your comments, and queries on the Platform; (vii) sharing and disclosure of data with Partners and other third parties, as may be required for providing the Services or facilitating the provision of the Products; (viii) to ensure that our Platform and Services function in an effective manner for you; (ix) to investigate potential breaches, or to protect the rights, property or safety of the Platform and its users; and (x) to fulfil our contractual obligations towards you.

use your Personal Information to send you communications regarding the Services, as well as send you promotional emails / transaction updates, however, we will provide you the ability to opt-out of receiving such emails/messages from us. If you opt out, we may still send you non-promotional emails, such as emails about the Services and Products availed by you and your Account on the Platform.

2.2.Information received with your permission, e.g., we collect, store and monitor certain SMS information from your device, location, camera and microphone access on your device.

Personal Information: SMS information from your device, device storage data, location data, data generated from camera and microphone on your device.

How we use this Personal Information: (i) We use SMS data to provide you with updates or confirmation of any actions taken on our Platform during the term of Services. Additionally, financial transaction SMS information allows us to determine your income and expense profile, and to undertake an optimal ‘credit risk assessment’. We only collect SMS information for providing you with the Services, and for such purposes as may be required as per applicable law; (ii) we collect and use your location information for the purposes of completing your KYC process and for onboarding, and to also help diagnose problems with our server, resolve such problems and administer the Platform to enable onboarding/KYC process; (iii) we request camera access to scan and capture the required KYC documents thereby allowing us to auto- fill relevant fields, as per our requirements as well as on the instructions of our Partners in accordance with applicable laws. We share the KYC details with the Partners, as may be required by them to provide you with the relevant Products. This permission allows us or our authorized agents to perform your video KYC while also taking screenshots of your original officially verified documents that you present during your video KYC. Video KYC enables you to complete your KYC digitally, smoothly, and efficiently. Your video shall be recorded and retained for regulatory purposes along with the screenshots of original official verified documents; (iv) we require microphone permissions to enable a two-way communication between our authorised agents and you for the purpose of performing and completing your video KYC for Services. Your audio shall be recorded for regulatory purpose; and (v) we use your device storage access to allow you to easily upload the relevant information and documents for faster filling of the registration details. This ensures that you are provided with a seamless experience while using the Platform. This is a one-time request and the same would be obtained at the time of sign up.

2.3.Information we generate about you, e.g. when you browse or use our sites, or information we generate about you.

Personal Information: When you visit digital properties we own / control (e.g. our website or mobile app), we typically collect the IP address of the device you use to connect to the Internet, information such as what browser, browser version, operating system you have, the website you came from or the advertisement you viewed or clicked on. When you browse the Platform, view our emails/SMS, use your mobile site/app, CreditMantri or the companies we work with, use cookies and/or pixel tags to collect information and store your online preferences. We may also supplement the information we collect with information we receive from other companies. For example, we may use marketing segments developed by us or other companies to customize certain services.

How we use this Personal Information: We use this information to help and analyse our Platform flow, track user trends, and promote trust and safety. We retain such information as necessary to resolve disputes, provide customer support and troubleshoot problems as permitted by law. We will use the cookies on our website similar to other lending websites / apps and online marketplace websites / apps, to do internal research on our users’ demographics, interests, and behaviour to better understand, protect and serve our users and improve our Services. This information is compiled and analysed on an aggregated basis. If you choose to decline cookies, it might adversely affect the service on some parts of our website.

2.4. Information we collect from third parties, e.g. information which we collect when you interact with your social media accounts, payment service providers, credit information companies,banks and financial institutions.

Personal Information: We collect the following types of information from third parties:

Credit Information: We collect your credit information by obtaining specific authorisations from you (if required under applicable laws), from certain third parties such as credit bureaus or credit rating companies (including from Equifax & CRIF Highmark) as your ‘authorised representative’ from time to time in accordance with applicable laws.

Loan Applications: We also collect information relating to the status of your loan application from our Partner lenders and from whom you have availed/are in the process of availing a loan facility.

Redirection: We also receive your information from third parties when you are redirected to the Platform from a third-party website. This may include information such as your mobile number, preferences and identifiers.

How we use this Personal Information: (i) Credit information: to provide you with our Services which require your credit information including credit health assessment, to periodicallydetermine your eligibility for different Products offered by our Partners, marketing different Services and counselling; (ii) Loan applications information from lenders: to provide you with updates on the status of your application for Products made using the Platform; and (iii) Information received from third party websites: for acquiring/onboarding you as a customer and customising and curating your user journey on the Platform to display relevant Services and Products.

2.5. Your Personal Information collected as a lending service provider on behalf of our Partners (such as your KYC details) are not processed or stored by us after such Personal Information has been shared with the relevant Partner. However, we may store certain basic Personal Information such as your name, address and contact details to enable us to carry out our operations.

2.6. Your credit information obtained from credit bureaus or credit rating companies is obtained based on specific authorisation provided by you when you registered your information on the Platform. We may periodically access your credit information for up to a 6 (six) month period after obtaining your authorisation to make available and for providing you the relevant Services, and for the purposes as more specifically described in Clause 2.4 above, subject to applicable laws. CreditMantri will retain the CIR and related data for a limited period of 6 (six) months or till such time the information is required to be retained to offer you our Services, whichever is earlier.

To provide continued Services to you, CreditMantri may require your consent beyond the aforesaid 6 (six) month period, for which purpose you shall be required to renew your consent after the expiry of such period. For ensuring continued Services, you hereby agree that: (i) upon logging in to the Platform with your Account during and beyond the aforesaid period, your consent will be renewed to allow CreditMantri to continue to provide the Services for which the CIR is required; and (ii) in the event you wish to withdraw your consent or do not require the Services for which the CIR is required, you may withdraw your consent by writing to us at datagrievance@creditmantri.com; however, in such an event, CreditMantri will immediately cease providing its relevant Services to you for which CIR is required and we may not be able to service any old requests in this regard.

3. Children’s Data

3.1. CreditMantri does not knowingly collect Personal Information from children (individuals younger than the age of 18) without the consent of a parent or legal guardian; if CreditMantri learns that it has done so, CreditMantri will promptly remove the information from all active databases. If you are a parent or legal guardian who believes that CreditMantri has collected or used their child’s personal information, please contact us at grievance@creditmantri.com

4. How and When Do We Disclose Information To Third Parties?

4.1. We do not sell or rent your Personal Information to third parties for any purpose. We only share Personal Information when we have your express consent, or as otherwise provided for in this Privacy Policy.

4.2. We may share with third parties certain pieces of aggregated or anonymised information, such as the number of users who clicked on a particular advertisement. Such information is not capable of identifying you individually.

4.3. We disclose and share your Personal Information with third party financial service providers, banks or NBFCs who are our Partners for facilitation of a loan or facility or line of credit or credit card or purchase of a Product. Acting as a registered corporate agent for solicitation and procurement of insurance business, we may also share your personal information with insurers for facilitating purchase of an insurance policy. These third parties are bound by contractual obligations to keep such information confidential and use it only for the purposes for which we disclose it to them. We will only disclose your Personal Information to third parties for the purposes consistent with the legal basis for which we collected such information, unless disclosure to third parties is required under applicable law.

4.4. We disclose and share your Personal Information with third party credit information companies in order to retrieve your credit information on your request.

4.5. We use a variety of third-party service providers and vendors to help us provide the Services to you. For example, service providers which assist us to: (i) verify your identity including KYC verification or authenticate your identification documents; (ii) perform product development, software and website maintenance and debugging; (iii) allow the provision of the Services through third party platforms and software tools (e.g. through the integration with our APIs); (iv) provide customer service, advertising, or payments services; (v) processing payments including validation of your bank accounts and account information; (vi) undertake credit assessment on behalf of you or the Partners, or to facilitate the Services or any other Product related applications on behalf of us or the Partners; (vii) to facilitate and assist our marketing and advertising activities/initiatives; (viii) for undertaking auditing or data analysis; or (ix) to prevent, detect, mitigate, and investigate fraudulent or illegal activities related to our Services. These providers have access to your Personal Information to the extent required to perform these tasks on our behalf and are contractually bound to protect and to use it only for the purposes for which it was disclosed and consistent with this Privacy Policy.

4.6. Co-branded and white labelled services: Certain aspects of the Services may be provided to you in association with third parties such as our advertisers, Partners, or sponsors, and may require you to disclose Personal Information to them. Such co-branded Services will identify the third party at the relevant access page on our Platform. If you elect to register for products and/or services through the co-branded Services, you may be providing your Personal Information to both us and the third party. Any such information provided to the third party is subject to that third party's privacy policies.

4.7. Administrative and Legal Reasons: We may access, use, preserve, transfer and disclose your information (including Personal Information), including disclosure to third parties: (i) to satisfy any applicable law, regulation, subpoenas, governmental requests or legal process if in our good faith opinion such is required or permitted by law; (ii) to protect and/or defend the Terms of Use for any of our Services or other policies applicable to any of our Services, including investigation of potential violations thereof; (iii) to protect the safety, rights, property or security of the Services or any third party; and/or (iv) to detect, prevent or otherwise address fraud, security or technical issues. Further, we may use IP addresses or other device identifiers, to identify users, and may do so in cooperation with third parties such as copyright owners, internet service providers, wireless service providers and/or law enforcement agencies, including disclosing such information to third parties. Such disclosures may be carried out without notice to you.

4.8. Business Transfer: Based on your consent, we may share your Personal Information with our subsidiaries and affiliates for internal reasons. We may also disclose and transfer all such information: (i) to a subsequent owner, co-owner or operator of the Services or applicable database; or (ii) in connection with a corporate merger, consolidation, restructuring, the sale of substantially all of our membership interests and/or assets or other corporate change, including, during the course of any due diligence process.

5. What About Information You Disclose Publicly?

5.1. The Services may permit you to submit ideas, questions, comments, suggestions or other content, including Personal Information that is publicly viewable (collectively, "User Content"). We or others may reproduce, publish, distribute or otherwise use User Content online or offline in any media or format (currently existing or hereafter developed). Others may have access to this User Content and may have the ability to share it with third parties across the Internet. Please think carefully before deciding what information you share, including Personal Information, in connection with your User Content.

5.2. Note that CreditMantri does not control who will have access to the information that you choose to make public and cannot ensure that parties who have access to such publicly available information will respect your privacy or keep it secure. This Privacy Policy does not apply to any information that you disclose publicly or share with others, whether through the Services or otherwise. We are not responsible for the accuracy, use or misuse of any content or information that you disclose or receive through the Services.

6. What About Security?

6.1. CreditMantri maintains physical, electronic, and procedural safeguards that comply with the applicable laws to protect Personal Information that we collect about you. We enable our servers with Secure Socket Layer (SSL) technology to establish a secure connection between your computer and our servers, creating a private session. We employ firewalls and other security technologies to protect our servers from external attack and securely store your Personal Information. We control access to this information via secure web pages, and limit access to only those employees or third parties on a need to know basis.

6.2. CreditMantri has reasonable security measures and safeguards in place to protect your privacy and Personal Information from loss, misuse, unauthorized access, disclosure, destruction, and alteration of the information in compliance with applicable laws. We test our systems regularly to ensure that our security mechanisms are up to date. We incorporate commercially reasonable safeguards to help protect and secure your Personal Information and credit report information. However, no data transmission over the Internet, wireless transmission or electronic storage of information can be guaranteed to be 100% secure.

6.3. We or any of our group entities do not assume any liability or responsibility for disclosure of your Personal Information due to errors in transmission, unauthorized third-party access, or other causes beyond its control. You understand and acknowledge that we cannot ensure or warrant the security of any Personal Information you transmit to us or guarantee that your Personal Information may not be accessed, disclosed, altered, or destroyed by a breach of any of our security measures and safeguards. In the event of any actual or suspected security incident, including data breach, we will take all measures required to be undertaken under applicable laws. You play an important role in keeping your Personal Information secure. You shall not share your Personal Information or other security information for your Account with anyone. We have undertaken reasonable measures to protect your rights of privacy with respect to your usage of the Platform controlled by us and our Services. However, we shall not be liable for any unauthorized or unlawful disclosures of your Personal Information made by any third parties who are not subject to our control. In the event of any actual or suspected security incident, including data breach, we will take all measures required to be undertaken under applicable laws.

7. How do I know about changes to the Privacy Policy

7.1. From time to time, we may change this online Privacy Policy. We will notify you of the revised Privacy Policy by sending you an email or when you access the Platform and update the “Last Updated” date at the top of this Privacy Policy.

8. Can You browse the Platform without providing Your Personal Information

8.1. In general, you can browse the Platform without telling us who you are or revealing any Personal Information about yourself. However, in such situations you might not be able to access some features of the Platform or avail some Services. Once you give us your Personal Information, you are not anonymous to us. Wherever possible, we indicate which fields are mandatory and which fields are optional for you. You always have the option to not provide the Personal Information to us through the Platform by choosing to not use a particular Service or feature being provided by us on the Platform, which requires you to provide such Personal Information.

9. Does the Platform collect Personal Information of minors or persons with disability

9.1. Where Personal Information belongs to persons with disability, we collect the same subject to verifiable consent of the guardians of such person with disability, as required under applicable laws.

10. How long do we retain your Information?

10.1. CreditMantri will not retain your Personal Information for longer than is required for the purposes for which the information may lawfully be used or is otherwise required under any other law for the time being in force.

10.2. Subject to this section, we may delete your Personal Information if: (i) the purpose for which such Personal Information is collected has been fulfilled; (ii) there is no legal obligation on us to retain such Personal Information; and (iii) upon reasonable written request by you for the same, at any stage. However, you may not be able to use our Services after requesting us to delete your information.

10.3. Notwithstanding anything contained herein, we will not retain your Personal Information and other information for longer than the periods provided below:

10.4. However, we may retain personal information related to you if we believe it may be necessary to prevent fraud or future abuse, to enable us to exercise our legal rights and/or defend against legal claims or if required by law or for other legitimate purposes. When the retention period for your Personal Information, outlined above expires, we will actively destroy/delete such Personal Information from our systems.

10.5. We will comply with the following procedure for destruction and disposal of your Personal Information:

(i) IT department is responsible for deleting or destroying electronic records. This includes ensuring that the Personal Information is permanently removed from the company system and destroyed.

(ii) No Personal Information that is currently involved in, or have open investigations, audits, or litigation pending shall be destroyed or otherwise discarded.

(iii) When retention requirements have been met, Personal Information shall be immediately destroyed.

(iv) The authorized method of destruction for non-electronic Personal Information is shredding.

We may, however, continue to retain the information in anonymized form for analytical and research purposes.

11. Your rights with respect to your Personal Information

11.1. Modifying or rectifying your Personal Information: In the event that any Personal Information already provided by you is inaccurate, incomplete or outdated, then you must provide us with the accurate, complete and up to date Personal Information, and we shall accordingly rectify such Personal Information at our end immediately. We urge you to ensure that you always provide us with accurate and correct information/data to ensure your use of our Services is uninterrupted. In case of any such modification of Personal Information, you may be required to furnish supporting documents relating to change in Personal Information for the purpose of verification by CreditMantri.

11.2. Your privacy controls: You have certain choices regarding the Personal Information we collect and how it is used:

(i) Your device may have controls that determine what information we collect. For example, you can modify permissions on your Android/iOS device or browser to remove any permissions that may have been given. However, we do not provide a guarantee of the continuation of some of our Services or Platform features if any such controls are exercised.

(ii) You can also request to delete or erase the Personal Information processed and stored with us from our servers, in the manner provided herein.

11.3. Withdrawal/denial of consent: The Platform collects your Personal Information with your free, specific, informed, unconditional, unambiguous and explicit consent and You have the option to deny consent for the use of any specific information or revoke the consent already given. You shall have the following rights pertaining to your Personal Information collected by us:

(i) Deny Consent: You shall have the right to deny a request for consent for (i) collection and processing of specific Personal Information; (ii) disclosure of such Personal Information to any third parties; and (iii) retention of such Personal Information (except when the same is required to be retained under applicable laws). However, any such denial will not prejudice our rights or the rights of our Partners to retain any Personal Information that you have provided in relation to the Services and/or Products already availed by you through the Platform, or by any third-party service providers, in accordance with the provisions of this Privacy Policy. Further, in case of a denial of a request for consent, the Platform does not provide a guarantee for the continued facilitation of a Service or Product.

(ii) Withdraw Consent: You may also choose to withdraw your consent (including consent provided for processing of your Personal Information by us or by any third party on our behalf, or your consent provided for data retention purposes) provided to the Platform at any point of time. In order to withdraw your consent for the use, processing, disclosure, sharing or transferring of any Personal Information, you may raise a request on the Platform or by mailing us at security@creditmantri.com. Your withdrawal of the consent will not affect the lawfulness of processing of Personal Information based on your consent before its withdrawal. In such an event, you are responsible for the consequences of such withdrawal of consent, and the Platform does not provide a guarantee of Services if any such option to withdraw consent is exercised.

In case you do not provide your consent or later withdraw your consent, we reserve the right to not provide you a Service on the Platform. In such a scenario, CreditMantri may delete your Personal Information or other information it had earlier collected and stored, or de-identify it so that it is anonymous and not attributable to you.

Upon receiving a request for deletion of your Personal Information, or withdrawal of consent for the processing of Personal Information, we shall not retain your Personal Information if it is no longer required by us and there is no legal requirement to retain the same. Do note that multiple legal bases may exist in parallel, and we may still have to retain certain data and information at any time.

11.4. Right to certain information: You have the right to ask us: (i) for a summary of your Personal Information being processed by us and the processing activities undertaken by us with respect to such Personal Information; (ii) the identities of all other third-party entities with whom your Personal Information has been shared by us, along with a description of the Personal Information so shared. However, this right has certain limitations as prescribed under applicable law.

11.5. Right to erasure: This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your Personal Information where there is no compelling reason for us to keep it. Such right of erasure can be exercised by writing to us at datagrievance@creditmantri.com. On such a request for erasure, we shall delete your Account, your personal information stored by us, as well as ensure that any third-party service provider processing your Personal Information on behalf of us deletes all your Personal Information, unless retention of the same is necessary for the providing the Services or Products or for compliance with any applicable law for the time being in force.

11.6. Right to nominate: You shall have the right to nominate any other individual, who shall, in the event of your death or incapacity, exercise your rights in relation to your Personal Information,in accordance with applicable law in India.

11.7. Use of a consent manager: You are permitted to give, manage, review or withdraw your consent provided to CreditMantri to process your Personal Information through a ‘consent manager’. The consent manager is accountable to you and can assist you in providing or withdrawing your consent to us to process your Personal Information, on your behalf. Such consent managers must comply with the obligations imposed on them as may be prescribed by the Central Government.

12. Data Grievance Officer

12.1. If you want to exercise any of your rights with respect to your Personal Information, have any concern or grievance or want to address any discrepancy with respect to the processing of any of the information/data you provided to CreditMantri, please contact our Grievance Officer. We will review the matter and take such action as we deem appropriate under the circumstances in accordance with the applicable law.

Name : Mr. R.Sudarshan

Designation : Chief Operating Officer Creditmantri

Address : CreditMantri Finserv Private Limited, a company with its registered office at CreditMantri Finserve Private Limited Unit No. B2, No 769, Phase-1, Lower Ground Floor, Spencer Plaza, Anna Salai, Chennai - 600002

Email : datagrievance@creditmantri.com

Effective Date - This Privacy Statement was last modified November 2023