2. Definitions

• Personal Data: any data about an individual who is identifiable by or in relation to that data.
• Data Principal: the individual to whom the personal data relates (you).
• Data Fiduciary: the entity that determines the purpose and means of processing personal data. KapitaLoan and Blue Chip Finance Private Limited act as Data Fiduciaries for the data they respectively process.
• Data Processor: any person who processes personal data on behalf of a Data Fiduciary.
• Processing: any operation on personal data, including collection, storage, use, sharing and deletion.

3. Eligibility

Our Platform is intended only for individuals aged 18 years and above who are competent to enter into a binding contract under Indian law. We do not knowingly collect personal data from minors. If we discover that we have collected such data, we will delete it promptly.

4. Information We Collect

We collect the following categories of information, with your consent where required by law. We collect only the data necessary to provide our services.

4.1 Personal Information

• Full name, date of birth, gender, marital status
• Residential address, email address, mobile number
• Occupation details: Business, employment information, monthly income
• Educational qualification

4.2 Identity Verification (KYC) Information

Documents required to verify your identity, including Aadhaar, PAN, Driving Licence, Passport, Voter ID, and other government-issued identification documents permitted by law. Aadhaar-based verification is carried out in accordance with applicable law, and we do not store your full Aadhaar number except as permitted by law.

4.3 Financial Information

• Bank account details, IFSC code, bank statements
• Income proof - Salary slip, ITR with computation/Form-16, Business Record

4.4 Loan and Service Records

Loan applications, approvals and disbursements; and customer support requests.

• Existing loan details, credit score and credit bureau information
• Loan repayment history and transaction information

4.5 Device and Technical Information

When you use the Platform, we may automatically collect device model, operating system, browser information, IP address, device identifier, language settings, time zone, app version and crash reports.

5. App Permissions

We request permissions only when they are needed, and we display a just-in-time consent screen before requesting each one. You may decline any permission; however, if a permission is essential for a step such as KYC, we may not be able to complete that step.

• Camera: used to capture identity documents and photographs and to complete eKYC or video KYC. We do not collect or store biometric data except as required for KYC under applicable law.
• Microphone: used only during video KYC or video verification, where applicable.
• Location: with your explicit consent, we request one-time access to your device location for identity and address verification, fraud prevention, regulatory compliance and customer verification. We do not track your location continuously.
• Device information: limited device details (such as model and operating system version) used for security and fraud prevention. We do not collect permanently identifiable device identifiers such as IMEI, serial number or MAC address

6. What We Do Not Access

We do not access your contact list, call logs, telephony functions, photo gallery, or files and media, except where you choose to upload a document. We do not read your personal SMS messages or OTPs.

7. How We Collect Information

Information you provide: when you create an account, apply for a loan, upload documents, complete KYC, fill in forms or contact customer support.

Automatically collected information: through cookies, device identifiers, analytics tools and security technologies.

Third-party sources: where permitted by law and with your consent, we receive information from:

• Credit Information Companies (CIBIL, Experian, Equifax, CRIF High Mark)
• Banking partners and payment gateways
• Our NBFC partner, Blue Chip Finance Private Limited, and other regulated lending partners
• KYC verification providers and government databases
• Fraud detection services

8. How We Use Your Information

We use your information to:

• Process your loan application and verify your identity (KYC)
• Assess your creditworthiness and carry out fraud and risk assessment
• Provide the Key Fact Statement (KFS) and other mandatory loan disclosures
• Disburse loans and process repayments
• Provide customer support
• Improve our products and services and personalise your experience
• Prevent fraud, money laundering and financial crime
• Comply with RBI guidelines, legal and regulatory obligations, and respond to lawful requests from authorities
• Where you have consented, send promotional communications

9. Legal Basis and Your Consent

We process your personal data only for lawful purposes, on the basis of your consent, performance of a contract with you, compliance with a legal obligation, or other lawful grounds permitted under the DPDP Act.

9.1 Consent

By submitting your information and giving consent through the Platform, you authorise KapitaLoan to:

• Process your loan application
• Share your information with Blue Chip Finance Private Limited and authorised service providers where necessary
• Conduct KYC verification and verify information through government databases and authorised verification providers
• Contact you regarding your application, repayments, customer support and regulatory communications

Consent is requested separately for each purpose. Consent for marketing is separate from consent for processing your loan, and declining marketing will not affect your loan application.

9.2 Credit Information Companies (CIC) Consent

You consent to KapitaLoan and our lending partner:

• Accessing and verifying your credit information, credit score and related reports from RBI-registered Credit Information Companies (TransUnion CIBIL, Experian, Equifax and CRIF High Mark); and
• Reporting your credit information, including loan amount, tenure, repayment history, outstanding dues and any default, to such Credit Information Companies, as required under the Credit Information Companies (Regulation) Act, 2005, the CIC Rules, 2006 and applicable RBI guidelines.

9.3 Consequence of Not Providing Data

Certain personal data is necessary to provide access to the Platform and the loan services. If you do not provide it, or if you decline or withdraw consent, we may be unable to process your application or provide some or all of the services.

10. How We Share Your Information

KapitaLoan does not sell or rent your personal information. We share it only where necessary to provide our services or to comply with law, with:

• Lending partners: Blue Chip Finance Private Limited and other regulated lending partners, for application processing, credit assessment, approval, disbursement, servicing, repayment management, customer support and regulatory compliance.
• Banking partners and payment service providers: for disbursement, repayment, mandates and account verification.
• Credit bureaus: to obtain credit reports and report repayment performance.
• KYC and verification providers: to verify your identity and prevent fraud.
• Technology and cloud service providers: for secure hosting, storage, analytics, customer support and platform operations.
• Regulatory and law enforcement authorities: where disclosure is required by law, court order or a government or regulatory authority.
• Professional advisors: legal advisors, auditors and consultants, where required.

All third parties receiving your data are contractually bound to keep it confidential and to protect it in accordance with applicable law. A list of our lending partners and key third-party service providers is available at our Digital Lending Partners page, and is updated from time to time.

11. Communications

We may contact you by phone, SMS, WhatsApp, email or app notifications regarding your application, loan, repayments, customer support and regulatory matters. These service and regulatory communications will continue while you have an application or loan with us.

Promotional communications are sent only with your consent. You can opt out at any time using the unsubscribe link, by replying STOP, or by contacting support@kapitaloan.com. We honour the National Do Not Disturb (DND) registry for promotional messages.

12. Accessing and Updating Your Information

You are responsible for providing accurate, complete and current information. You can review, update or correct your personal data through your account settings or by contacting customer support. We may verify the information you provide, and inaccurate information may affect your eligibility or result in suspension of your account.

13. Data Security

We implement appropriate technical, administrative and organisational safeguards to prevent unauthorised access, alteration, disclosure, misuse or destruction of your data, including:

• SSL/TLS encrypted data transmission and encryption of sensitive data at rest and in transit
• Secure cloud infrastructure with restricted, role-based access controls
• Multi-layer authentication and authorisation
• Continuous monitoring for suspicious activity
• Secure backup and disaster recovery procedures

Access to personal data is limited to authorised employees, contractors and service providers who need it for their duties, and they are trained on security procedures.

Breach response: We maintain incident response processes to detect, analyse, contain and recover from security incidents. In the event of a personal data breach, we will take timely steps to mitigate the risk and will notify the Data Protection Board of India and affected users as required by law.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

14. Data Retention

We retain your personal data only for as long as necessary to provide our services, fulfil contractual obligations, comply with law and regulation, resolve disputes, prevent fraud and enforce our legal rights. Specific retention periods are set out in the Schedule to this Policy.

We and our lending partner will continue to process your data until all dues on any loan you have availed are fully paid. The lending partner may retain your data for as long as required by law, and may require us to retain data where services such as collections have been outsourced to us.

Data that is no longer required is securely deleted, anonymised or destroyed.

15. Your Privacy Rights

Subject to applicable law, as a Data Principal you have the right to:

• Access: request a summary of the personal data we hold about you and how it is processed.
• Correction: request correction of inaccurate or incomplete data and updating of outdated data.
• Deny consent: decline to give consent for processing. This may limit our ability to provide the services.
• Withdraw consent: withdraw consent previously given, at any time. Withdrawal does not affect processing done before withdrawal, and it may affect our ability to provide or continue services. It is as easy to withdraw consent as it is to give it.
• Erasure: request deletion of your personal data. We may not be able to fulfil this while a loan is active, or where retention is required by law, regulation, fraud investigation or dispute resolution.
• Restrict processing: request restriction of processing where permitted by law.
• Nominate: nominate another individual to exercise your rights in the event of your death or incapacity.
• Grievance redressal: raise a complaint with our Grievance Officer as set out in Section 21, and with the Data Protection Board of India where applicable.

How to exercise your rights: email our Grievance Officer at the address in Section 21, describing the right you wish to exercise and the personal data concerned, so we can locate it. We may ask you to verify your identity. We will respond within 30 days of receiving your request and will inform you if we need more time.

16. Data Storage, Transfer and Localisation

Your personal data is stored and processed on secure servers located in India. We do not transfer your personal data outside India Data is handled in accordance with the DPDP Act, applicable RBI guidelines and other Indian laws.

The parties with whom we may share data for service delivery are described in Section 10. Transfers are made only where appropriate security measures and contractual safeguards are in place.

17. Digital Lending Disclosures

In line with the RBI Digital Lending Guidelines and Directions:

• Loans are sanctioned and disbursed by the RE directly into your bank account. We do not pool funds or receive disbursements on your behalf.
• Repayments are made directly to the RE's bank account.
• Before you accept a loan, you will be given a Key Fact Statement (KFS) showing the loan terms, the annual percentage rate (APR) and all charges.
• The name of the RE and any other lending partner is disclosed to you during the application process.
• Your data is collected only with your prior and explicit consent, and you may ask for deletion of data collected from you where it is no longer needed, subject to Section 15.
• Collection and recovery agents are required to follow the conduct norms prescribed by the RBI.

17A. Loan Terms, APR and Representative Example

The loans offered through the Platform by the RE are subject to the following terms. The final terms applicable to you are shown in your Key Fact Statement (KFS) before you accept a loan.

Repayment period: minimum 61 days; maximum 12 months.

Maximum Annual Percentage Rate (APR): 35% per annum, which includes interest, processing fee and all other charges payable by you. The APR applicable to your loan is stated in your KFS.

Representative example of the total cost of a loan: the example below is for illustration only. Your actual loan amount, interest rate, fees and repayment schedule will be shown in your KFS.

How the figures are calculated: monthly interest = outstanding principal x 2%. In month 1, interest = Rs. 30,000 x 2% = Rs. 600 and principal repaid = Rs. 2,836.79 - Rs. 600 = Rs. 2,236.79, leaving Rs. 27,763.21; the same method applies each month. APR is the annualised rate that equates the net amount disbursed (Rs. 29,292) to the 12 EMIs of Rs. 2,836.79, and so includes interest and the processing fee with GST. As per RBI norms, contingent charges such as penal or late payment charges are not part of the APR and are shown separately in the KFS.

There are no charges other than those shown in your KFS.

18. Third-Party Websites and SDKs

The Platform may contain links to websites or services operated by third parties. We are not responsible for their privacy practices, security or content, and your interactions with them are governed by their own policies. Please review their policies before sharing personal data.

19. Cookies and Tracking Technologies

We use cookies and similar technologies to remember your preferences, keep you securely signed in, improve performance, understand usage through analytics, enhance security and fraud prevention, and measure the effectiveness of marketing campaigns.. Third parties may also place cookies on certain pages, and we do not control their practices.

You can manage or disable cookies through your browser settings, although some features may not work as intended.

20. Business Transfers and Changes to This Policy

Business transfers: In a merger, acquisition, restructuring or sale of assets, your personal data may be transferred as part of the business. The successor will continue to protect it in accordance with this Policy and applicable law, and we will notify you where required by law.

Changes to this Policy: We may update this Policy to reflect changes in our practices, legal requirements or technology. Updates will be published on this page with a revised "Last Updated" date, and, where required, notified by email, SMS or app notification. Where the law requires fresh consent, we will seek it before applying the change to you.

21. Grievance Redressal

22. Governing Law

This Policy is governed by and construed in accordance with the laws of India. Any disputes arising out of or relating to it are subject to the exclusive jurisdiction of the competent courts at Gurugram, Haryana, unless otherwise required by applicable law.

Schedule. Destruction Policy

1. Overview

This Schedule explains how KapitaLoan retains, manages and securely disposes of personal data collected through the Platform. We retain personal data only for as long as necessary to provide our services, fulfil contractual obligations, comply with legal and regulatory requirements, resolve disputes, prevent fraud and enforce our legal rights.

2. Retention Periods

• KYC records: 5 years after the end of the business relationship or closure of the account.
• Rejected or abandoned applications: 6 months from the date of rejection or abandonment, after which data is deleted or anonymised.
• Customer support records: 3 years from resolution.
• Technical and device logs: 12 months.
• Records subject to investigation, dispute or legal hold: until the matter is concluded.

Where you request deletion, certain records may still be retained where required by law, regulatory obligation, ongoing investigation, dispute resolution or an active loan.

3. Deletion and Destruction

Once the applicable retention period has expired and there is no legal or business need to retain your data, KapitaLoan will securely delete, anonymise or permanently destroy it using industry-standard methods designed to ensure that it cannot reasonably be recovered, reconstructed or misused.