Jayshree Credit Services Private Limited

This Policy applies to Personal Data of any natural person that is collected, received, stored, processed or otherwise handled by the Company in connection with the provision of Services, whether such Personal Data is collected directly from You or is digitized after being collected in physical form.

This Policy also applies where the Company distributes, refers, integrates, or acts through service providers, referral partners, lending partners, technology partners, collection partners, resellers, implementation partners or other intermediaries in relation to products or services made available to You through or in connection with the Services.

In the event You are using the website, mobile application or Services as an authorised signatory, authorised representative, employee, consultant, director, guarantor, co-applicant, or other authorised person of a body corporate or non-individual entity, this Policy shall apply to Your Personal Data as well. Terms and conditions, product-specific agreements and any other consents that You may give to or for the benefit of the Company may contain additional privacy-related provisions. This Policy does not limit or supersede any such specific terms or consents. Any information that is available in the public domain, or which is otherwise made publicly available by You or any third party, does not form part of this Privacy Policy.

Your use of or access to the services shall confirm Your understanding, acknowledgement and acceptance of this Policy. By using Our website, or Services, You expressly consent to the Company’s use of Your personal data in accordance with this Policy. If You do not agree with Our policies and practices as described in this Policy, You must not access our Services or provide any personal data to Us, or You may contact Us in the manner provided in this Policy.

The Website or its Services is intended only for persons who are 18 years of age or above and otherwise competent to contract under applicable law.

Information about Your web-based activity is collected using technologies known as cookies, which can often be controlled through internet browsers. The website and its services use cookies to uniquely recognize Your device and web browser, as well as to improve the performance and quality of Our services. We may use both session-based cookies and persistent cookies. If You block or disable cookies, certain features of the website might not function correctly or may become unavailable.

The Company may also work with selected third-party analytics and technology partners that may gather non-personally identifiable information about Your activity on Our website or app, including how You interact with the website, use Our features, and avail services, through their own cookies and similar technologies, subject always to applicable law.

We assume that all information provided by You is true, accurate, current, non-misleading, consistent and relevant on the date when it is provided. If any person other than You submits Your Personal Data to Us, We shall reasonably assume that such person has been duly authorised by You to submit such Personal Data, unless and until We are informed otherwise.

The Company shall collect only such Personal Data as is necessary, relevant, proportionate, and required for onboarding, KYC verification, credit underwriting, servicing, regulatory compliance, fraud prevention, and other lawful purposes expressly disclosed to the User. No excessive, unrelated, or unnecessary Personal Data shall be collected.

Prior to collecting any Personal Data, the Company shall obtain the User’s explicit, informed, affirmative, and purpose-specific consent through digital consent mechanisms such as click-wrap acceptance, checkbox confirmation, OTP verification, or other auditable electronic means.

The Company shall maintain a complete and auditable electronic record of all User consents obtained in connection with onboarding, underwriting, verification, sanction, documentation, servicing, and related lending activities, including the date, time, purpose, mode of consent, communication channel, relevant transaction reference from time to time.

Where any onboarding, verification, or compliance process requires access to device-based features such as camera, microphone, or location, such access shall be sought strictly on a one-time, purpose-specific basis, with the prior explicit consent of the User.

The Company shall not access, collect, monitor, store, or share the User’s contacts, call logs, SMS, photo gallery, media files, or other device storage content, unless expressly permitted under applicable law.

The Personal Data collected or received could include Your name, address, signatures, date of birth, copies of identity cards and KYC documents, contact details including electronic mail ID and phone number, previous names, domicile, origin, citizenship, nationality, residence, any legal or other identifiers like Permanent Account Number (PAN), Aadhaar, passport, voter ID, driving licence or equivalent officially valid documents, photograph, gender, employment and occupational information, bank account details, card details, UPI handles, income details, borrowing history, repayment history, risk profile, preferences, tax-related information, bank statements, financial documents and returns, transaction information, information collected when You make or receive payments, information about visits to the website or app, website traffic data, location data, weblogs, browser details, IP address, device information, information collected through tracking technologies, communications with the Company or any of its representatives, grievance-related information, records of calls and correspondence, behavioural details, browsing actions, patterns and online activity, and any other information or Personal Data that You consent to share.

In order to provide lending and other financial services securely, enhance customer experience, underwrite credit exposure, comply with legal and regulatory obligations, and for limited marketing of Our services, Personal Data about You may also be obtained from other sources such as referral partners, service providers, affiliates, lending partners, account aggregators, credit information companies, financial information providers, KYC registration agencies, fraud prevention agencies, public databases, and other lawful sources.

We do not ask for personal security details such as full passwords, PINs, OTPs or CVV information. If any request for such information is received purporting to be from Us, You are expected not to respond to it and to contact Us immediately.

The Company may share Personal Data strictly on a need-to-know basis and only for lawful purposes, subject to applicable law and, where required, the User’s prior explicit consent.

The Company may share Personal Data with:

1. Banks, NBFCs, co-lending partners, trustees, investors, assignees, or other regulated financial counterparties in connection with origination, servicing, assignment, securitisation, or administration of financial products.
2. Credit bureaus, credit information companies, account aggregators, financial information providers, and due diligence agencies.
3. Third-party service providers engaged for KYC verification, payments, collections, analytics, communications, storage, fraud prevention, technology support, and operational support.
4. Affiliates, subsidiaries, and group entities for lawful business, compliance, risk management, and service support purposes.
5. Regulators, governmental authorities, courts, tribunals, ombudsman institutions, auditors, and law enforcement authorities where required by law; and
6. Business partners or service providers in anonymised or aggregated form where no personally identifiable information is disclosed;
7. Where a User requests or avails any product or service offered by or through the Company or by any of your selected service providers, the Company may share such Personal Data with the relevant third-party service provider or partner to facilitate such product or service subject to applicable law and the individual's consent, where required.
8. Any third-party that the User consents to.

Except where disclosure is mandated by law, regulatory direction, judicial process, or statutory reporting obligations, the Company shall not share personally identifiable User information without the User’s prior explicit, specific, granular, and revocable consent.

The Company may partner with other service providers, affiliates, regulated entities, lending partners, account aggregators, payment service providers, collection agencies, technology providers, analytics providers, referral partners, implementation partners and compliance support providers (“Partners”) to offer certain facilities and services to its Users. Any Personal Data shared by the Company with these Partners shall be limited to such information as is reasonably necessary for them to perform the services selected or required.

We do not sell, rent or lease Personal Data to third parties. We may, however, disclose Personal Data where We believe in good faith that such disclosure is reasonably required:

• (i) by law;
• (ii) by any statutory, regulatory, supervisory or judicial authority;
• (iii) to comply with legal process, search warrants, subpoenas, statutes or court orders;
• (iv) to protect Our rights, reputation, safety and property, or that of Our Users, affiliates or the public;
• (v) to detect, investigate or prevent fraud, cyber incidents, financial crime, unauthorised transactions or misuse of the website or its services;
• (vi) in connection with a merger, acquisition, restructuring, sale of business or transfer of assets; or
• (vii) for any other reason that the User consents to.

We do not store Users’ full card authentication information, passwords, OTPs or PINs.

The Personal Data We collect will be securely stored by Us or by Our Partners for the purposes mentioned above beyond the expiry of the transactional or account-based relationship with You only if required to:

• (a) comply with contractual, legal or regulatory obligations;
• (b) establish, exercise or defend legal claims and resolve disputes;
• (c) satisfy audit, compliance, fraud detection, supervisory review, legal inquiry, security incident investigation or law enforcement requirements;
• (d) comply with NBFC, KYC, anti-money laundering, record retention or related financial sector requirements; or
• (e) act in accordance with specific consents or lawful purposes.

Notwithstanding the generality of the foregoing, Your Personal Data shall be retained or deleted by the Company in strict compliance with statutory and regulatory requirements applicable from time to time.

We maintain reasonable physical, technical and organisational security safeguards to protect Personal Data against loss, misuse, unauthorized access, disclosure, alteration and destruction. Personal Data is stored in secure servers with encryption and access controls. We also undertake appropriate measures to control access to computer resources and periodically review logs to detect unauthorised access.

The Company also has security measures in place to prevent, respond to and, where required, report any loss or breach of Personal Data and take remediation steps to prevent recurrence, in accordance with applicable law.

You may request access, correction, updation or erasure of Your Personal Data that You have submitted to the Company, subject to applicable law and regulatory requirements. In the event You wish to withdraw consent for further processing of Your Personal Data, or raise any grievances pertaining to Your Personal Data, You may do so by following the procedure set out below. Withdrawal of consent may impact the provision of all or certain services being provided to You at the time of such request.

To access, correct, update or erase Your Personal Data, or to withdraw consent or raise a grievance, You may write to Us using the contact details set out in this Policy. After verification of Your request, the Company shall take action within a reasonable period and subject to applicable law.

The User shall have the right at any time to:

• (i) provide or withhold consent;
• (ii) review previously granted consents;
• (iii) modify, restrict, or revoke consent;
• (iv) request deletion, anonymisation, or correction of Personal Data, subject to applicable law; and
• (v) obtain information regarding the purposes for which consent has been used.

The Company shall provide appropriate digital mechanisms, including account settings, consent dashboards, or designated communication channels, to enable the exercise of such rights.

Withdrawal of consent shall be processed within a reasonable period, and no penalty, adverse action, or unauthorized processing shall continue after such withdrawal, except to the extent retention or processing is required under applicable law, contractual obligations, or regulatory requirements.