CAPITALXB FINANCE PRIVATE LIMITED -Privacy Policy

1. BACKGROUND:

This Data Privacy Policy (“Privacy Policy”) describes the practices and policies of CapitalXB Finance Private Limited (“CapitalXB” or Company or “we” or “our” or “us”, as the context may require) in relation to collection, use, processing, storage, retrieving, disclosure and/or transfer of your information, including personal information and sensitive personal data or information that CapitalXB may receive through your access, interaction with us or use of our website, using our interface, mobile application or any other medium through which we offer our Services (collectively, the "Platform") in accordance with applicable laws including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the applicable RBI regulations. The term “Customer” or “user/s” or “you” shall mean any individual who used the Company's Platform or any other company's site or platform, giving access to the Platform or is a registered user on the Company's website or App or a borrower of the Company.

The Company is a Non-Banking Financial Company (“NBFC”) registered with RBI and having registered office at: A/801, 81 Crest FP NOS 81 B and 81 C Linking Road, Santacruz(w.), Near HDFC Bank, Mumbai 400054.

This Privacy Policy sets forth reasonable security practices and procedures adopted by the Company and shall apply to use and disclosure and sharing of the Customer Data by the Company. Personal and financial data is protected through encryption during transmission and storage, and access to such data is restricted on a least-privilege basis, supported by authentication controls, monitoring mechanisms, and audit logging to help prevent unauthorized access, use, alteration, or disclosure.

This Privacy Policy shall be read in conjunction with the agreed terms of use agreed by the Customer while registering with the Company or sharing information with the Company in any manner for use of the Services of the Company.

Our Privacy Policy is subject to change from time to time and we will make all reasonable efforts to intimate and update our Customers of any changes. We strongly recommend that you review our Privacy Policy as available on the Platform. In case you need any clarifications regarding this Privacy Policy, please do not hesitate to contact us at grievances@capitalxb.com.

By using the Platform and/ or by providing your information, you consent to the collection, use, storage and/ or transfer of the information disclosed by you in accordance with this Privacy Policy.

2. INFORMATION COLLECTED AND USED BY THE COMPANY.

The information collected by the Company would fall under either of the two categories (a) Data provided by you and (b) Information we may collect with your explicit consent in order to render our services including but not limited to the following:

A. Data provided by you:

• Data provided by you on the Platform.
• Data provided while corresponding with us over a meeting, e-mail, chat or call.
• Data and information, you provide when you register to use the Platform to any of our Services, search for a Service, or when you report a problem with our Application or our Services
• Your name, address, gender, date of birth, e-mail address, phone number, username, password and other registration information.
• Identity Proof and address Proof such as PAN Card, proof of possession of Aadhaar Card, financial information such as employer name, monthly salary, bank account number, bank statements, credit information, copies of identification documents etc.
• Data generated by your usage of our website and associated internet applications.
• The data provided by you inter alia enables us to create your profile, complete your KYC requirements, offer you the Services and provide you with customised support, if applicable.

B. Information we may collect about you:

Consent shall be obtained from the customer / user in writing or electronically accessed by the Company or any third party, as per the consent provided by the customer / user. The personal data collected by the Company shall be used solely for the purposes for which it is collected in accordance with this Privacy Policy and on the consent granted by the customer/user. The access, storage, use of the data by the Company shall be as permitted/ allowed under extant statutory and regulatory guidelines. Access here means and includes access, collection, storage, sharing and monitoring.

• Credit Information: With your consent, we collect information from credit information companies, which would help the Company in customer verification and due diligence.
• Device Information: We may collect Information related to the electronic device you use to access the Portal, such as your devices' internet protocol (IP) address, browser type, operating system, software, device type, device ID, device international mobile equipment identity (IMEI) and date and time at which you visit the Portal or avail the Services. This helps us learn about and verify your identity as well as detect and prevent fraud. We do not access contacts, media files, call logs, biometric data, or non-essential device data, in compliance with applicable laws
• Data related to Performance of the Application: In addition to the above, we also track and collect the data related to the performance of the Application and other diagnostic data for identifying and resolving any technical glitches that may be identified from such data and also for improving the overall functionality of the Application.
• SMS: We may need access to the SMS functionality in your device for the purposes of activation of certain Services on your device. We may periodically collect transactional SMSs.
• Location: We may receive, collect and analyse your location information, which may be accessed through a variety of methods including, inter alia, GPS, IP address, and cell tower location and, your precise location based on GPS data.
• Cookies and similar technologies: Cookies are small data files that a website uses to recognize repeat users, facilitate user's ongoing access and use of the site. Cookies themselves do not identify individuals, but they identify individual's computers or devices. The Company cannot control the use of cookies of the resulting information by advertisers or third parties hosting data on the Company's website. We will use cookies on our website similar to other lending websites / apps. Use of this information helps us to make improvements to our website and make it more user friendly. If a user does not want information collected through use of cookies, we permit you to decline cookies but if you choose to do this it might affect service on some parts of our website.
• Third Party Information: We may also work closely with third party business partners, technical sub-contractors, analytics providers, search information providers, account aggregators, payment aggregators, Lending Service Providers (LSPs), other platform owners etc. and may lawfully receive Information about you from such sources. Such Information may be combined with Information collected on our platform and such other Information as provided in this Policy.
• Other Information: We may also collect your Information via other sources, such as delivery address or contact Information from our partners, Information from our payment service providers, public records, publicly available sources or internet sites, vendors, data suppliers and service providers, commercially available marketing lists or registries, telephone directories, social network, news outlets and other related media.

C. Use of Customer Data

We may use your data (as mentioned above) for various things including specific business purposes (“Services”), which will include the following:

• to provide services that might be required by the Customer, including for availing any lending related services ,
• to process the Customer's financial and non-financial transaction requests,
• to undertake research and analytics for offering or improving the Company's services,
• to check and process the user's application for availing any financial services,
• to share any updates/changes to the Services and the terms and conditions with the user/customer,
• to take up and investigate any complaints/claims/disputes.
• to respond to queries and feedback submitted by you
• for verification of your identity as per the internal policies including KYC.
• to fulfil the requirements of applicable laws / regulations and / or court orders / regulatory directives received by the Company.

Personal data shall not be used for any purpose other than those stated above unless permitted under applicable law or with fresh and explicit consent of Customer.

D. Retention of information collected.

• The Company would retain the data submitted/collected by you for such reasonable period as would be necessary for it to deliver its Services, also taking into account the Company's requirement to comply with legal requirements under applicable laws.
• We shall not retain any personal data and information longer than permissible under Applicable Laws. The User's Personal Data and Information may however be retained for a longer period where we need such information for legal, regulatory, accounting, processing or other legitimate purposes which may include but not be limited to filing / addressing complaints, responding to any queries raised by any of our regulators / customers / governmental bodies and defending any legal claims.

E. Sharing of Information

Where possible, you shall have the option to restrict disclosure to third parties. However, where sharing of information to a particular third party is necessary for providing the products and/or services, you shall not be able to avail such products and/or services in case you decide to restrict such disclosure. Following are the third parties to whom your information may be shared for providing/enabling the products and/or services:

If you send us personal correspondence, such as emails or letters, or if other users or third parties send us correspondence about your activities on the Platform, we may collect and store such information for providing services and for record keeping purposes.

F. Storage of Data

We will retain any data or information provided by you till the time we render our services towards you. Any data collected shall be stored securely and maintained on servers located in India, in accordance with RBI Directions and the applicable laws.

Our data retention policy is restricted to the provision of our services towards you. You can request for the deletion of your information from us at any stage. Our data retention, storage and deletion policy is in consonance with the applicable laws and guidelines of the RBI.

G. Procedure for correcting inaccuracies or updating of your information

In the event that any information provided by you is inaccurate, incomplete or outdated, you shall have the right to provide us with the accurate, complete and up to date data and have us rectify such data at our end immediately. We urge you to ensure that you always provide us with accurate and correct information/data. In case of modification of personal information, users will be required to furnish supporting documents relating to change in personal information for the purpose of verification by the Company.

H. Right to withdraw/deny consent

You have the option, to deny/withdraw your consent at any time for the collection/continued collection, use or disclosure of your information or request for deletion of your information by mailing us at grievances@capitalxb.com. In case of withdrawal of your consent, we reserve the option not to provide the Services for which such information was sought. In case the services are already availed and then you raise a request to withdraw consent, then we have the right to stop the provision of the Services. We shall have the right to continue processing your information till such credit facility/Service has been repaid in full, along with any interest and dues payable and/or for such period as may be allowed under applicable law. However, we shall not retain your data and information if it is no longer required by us and there is no legal requirement to retain the same. By previously consenting to the sharing of the personal data and information (including to third parties), it would be presumed that the user has made itself aware that the Company may not be able to enforce such deletion request upon such varied third parties and is not responsible nor liable for the deletion of the user's personal data by such third parties.

I. User acknowledgement

• The Company and/or its employees /assigns will not contact the user directly for disclosure of any sensitive and personal information unless required for the providing the Services. User is requested to exercise proper due diligence to verify the identity of the individual(s) contacting before disclosing any personal and sensitive personal data/ information by reaching out to the Company at the customer care number accessible on its website before making any disclosure. The Company will not be liable or responsible for any breach of privacy owing to user's negligence.
• (b) User is aware of the potential risk of data/privacy breach and user shall be solely liable for any unauthorized disclosure/ breach personal/ sensitive personal information etc. and any direct/ indirect loss suffered by user due to user's conduct. To this account user shall shall exercise utmost caution while sharing personal data (including but not limited to any passwords, financial information, account details, etc.)

J. Intimation of product and services

We want our customers and user to be the first to know about our new products and services, and any offers from our partners. We may share these offers with our customers and users only with their prior consent. User can unsubscribe from receiving these offers by emailing us.

K. Changes to this policy

The Company shall post updated versions of its policy from time to time on our website and mobile application. The updated version of our terms will be effective as soon as they are accessible and the user is deemed to have accepted the terms of the updated Privacy Policy.

L. Prohibitions

While visiting or using our application or digital platform, the User shall use the same only for legal purposes and not for any illegal purposes like hacking. User shall not remove any copyright, trademark or other proprietary rights notices contained in the application or digital platform;

M. Consent under this Policy

Consent under this Privacy Policy shall be:

• obtained in a free, specific, informed, unconditional and unambiguous manner;
• provided through clear affirmative action by the user;
• granular in nature, enabling the user to permit or deny specific categories of data processing, where applicable; and
• withdrawable at any time, with ease comparable to the manner in which consent was initially provided.

Withdrawal of consent may impact the Company’s ability to continue providing certain Services. However, such withdrawal shall not affect the lawfulness of any processing undertaken prior to the withdrawal of consent, or processing required to comply with applicable laws, regulatory requirements, or contractual obligations.

N. Communication with Company

If the User has any questions about this Privacy Policy or if the user has any concerns or questions on the manner in which their personal data or information is handled then they may contact the nodal officer so appointed.

The name and contact details of the Nodal/Grievance Officer are provided below. You may contact the Nodal/Grievance Officer to address any discrepancies and grievances you may have with respect to your information with the Company and the same will be redressed expeditiously.

Name: Ajitabh Bharti

Designation: Director

Contact Details: Address: A/801, 81 Crest FP NOS 81 B and 81 C Linking Road, Santacruz(w) CTS NOS G 318 B and G 317, Near HDFC Bank, Mumbai 400054

Privacy Terms applicable to Customers logging into CapitalXB’s site through Amazon Seller Central platform

Appendix A -- "Amazon Selling Partner API Data"

1. Scope and basis

When you choose to log-in to your Amazon seller account, you authorise CapitalXB, through Amazon's Selling Partner API (the “Amazon SP-API”), to access certain information about your Amazon selling activity, stored or processed and available with Amazon. This access is granted only after your explicit, recorded consent and can be withdrawn by you at any time.

Such access is granted only after your explicit consent and is limited to the permissions approved by you. You may revoke such authorization through Amazon Seller Central, your CapitalXB account (where available), or by contacting us at grievances@capitalxb.com.

2. Data we access

With your authorisation, we access the following categories of Amazon selling-account data. We do not access categories outside this list. If our access requirements change, we will publish an amended version of this Privacy Policy and obtain fresh authorisation before accessing any additional category.

3. Buyer data we do not collect

We do not access, use, retain or process your buyer names, addresses, email addresses or phone numbers, or any other customer personal information made available through the Amazon SP – API permissions.

For clarity, the personal information you provide to us directly as a CapitalXB customer when you apply for a credit facility (identity, KYC and financial details), will be handled in accordance with the terms and conditions of the Privacy policy Version 2.0, as mentioned above.

4. How we use it

We use Amazon SP-API data solely for the following purposes:

• assessing your eligibility for a credit facility or other financial products and services;
• determining, reviewing, and managing appropriate credit limits;
• monitoring active facilities and repayment capacity;
• undertaking underwriting, fraud prevention, verification, compliance, audit, and risk-management activities;
• servicing and administering existing facilities; and
• complying with legal, regulatory, and supervisory requirements applicable to the Company.

The Company may use Customer Data, including Amazon SP-API data to develop, train, test, validate and improve credit underwriting models, fraud detection models, risk management systems, servicing tools and operational processes relating to our financial products and services. To the extent feasible, such activities shall be conducted using aggregated, anonymized or de-identified information. The Company shall not use Amazon SP-API data to develop products or services unrelated to the financial products and services requested by the Customer without an appropriate legal basis and, where required, the Customer's consent.

Amazon SP-API data is not sold to any third party and is not used for advertising, profiling, or marketing unrelated to the services requested by you.

5. Security

Amazon SP-API data is transmitted over encrypted connections, including Transport Layer Security (TLS), and is stored using encryption at rest. Access is restricted to authorised personnel, systems, and service providers strictly on a need-to-know and least-privilege basis.

Access, retrieval, and processing activities are monitored through audit logs and are traceable to the authorization and consent under which such access was granted.

6. Retention and deletion

We retain Amazon SP-API data only for as long as reasonably necessary to:

• provide and administer our services;
• service and manage your credit facility;
• comply with legal, regulatory, audit, and record-keeping obligations;
• resolve disputes; and
• enforce contractual and legal rights.

If you withdraw consent or disconnect your Amazon account, we will stop retrieving new Amazon SP-API data. Subject to applicable laws, regulatory, audit, and record-retention requirements, the Company will delete or de-identify previously retrieved Amazon SP-API data when such data is no longer required for the purposes for which it was collected or retained and after expiry of the applicable statutory, regulatory, audit, litigation, fraud-prevention, and record-retention requirements, including any minimum retention periods prescribed under applicable law.

Where no such retention requirement applies, the Company will delete or de-identify the data within 60 (sixty) days following the withdrawal of consent or disconnection of the Amazon account.

Provided that, nothing in this section shall require deletion of information that the Company is legally required or entitled to retain under applicable RBI Directions, the Prevention of Money Laundering Act, 2002 and rules thereunder, court orders, regulatory directions, or other applicable laws.

7. Withdrawing consent

You may withdraw your Amazon data-access consent at any time from your CapitalXB account or by writing to grievances@capitalxb.com. Withdrawal stops all further data retrieval; it does not affect obligations already incurred under an active facility. Withdrawal of consent shall not affect processing undertaken before such withdrawal.