1 | 8

DAVINTA DATA PRIVACY AND STORAGE POLICY

OVERVIEW

Davinta Financial Services Private Limited (“Davinta”, “we”, “us” and “our”) recognizes the
importance of privacy as well as maintaining confidentiality of the User Information (defined
below) of its users. This Data Privacy and Storage Policy (“Privacy Policy”) is an integral part
of the Davinta’s terms of use (“Terms”) and is incorporated herein by reference for access and
use of the Platform (defined below).

Capitalised terms not defined in this Privacy Policy shall have the meaning ascribed to them
in the Terms. This Privacy Policy shall be read in conjunction with the Terms.

This  Policy  applies  to  the  information  Davinta  collects  through  the  Platform,  or  while
rendering  services  to  the  Users,  in  e-mail,  text  and  other  electronic  communications  sent
through or in connection with its services.

For the purposes of this Privacy Policy, the term “you” or “your” relates to the individual who
accesses,  avails  or  uses  any  financial  products  or  services  of  Davinta  from  its  technology
platform including (but not limited to) any of its websites such as

www.myloans.davinta.com

www.davintafinserv.com, www.loans.davinta.com

www.davinta.com

or any other platform

owned or operated by Davinta (“Platform”).

This Privacy Policy further describes the policies and procedures (including a summary of the
relevant  security  controls)  that  Davinta  follows  when  collecting,  maintaining,  using,
transmitting or disclosing any User information to third parties.

This Privacy Policy complies with the provisions of the Information Technology Act 2000 (“IT
Act”) and rules made thereunder from time to time, Reserve Bank of India (“RBI”) guidelines
and other applicable laws.

You should be aware that the Platform is not intended for, or designed to attract, individuals
under the age of 18 (eighteen). We do not collect personally identifiable information from any
person that we know to be under the age of 18 (eighteen).

INFORMATION COLLECTED

This Policy further describes the types of User information (as provided below) that may be
collected from you during your access of the Platform.

2.1

User Information. When you sign up on our Platform, we may collect the following categories
of User Information, including but not limited to:

2.1.1 any information, documents, or details that relate to you and/or any third party,

2 | 8

which indirectly or directly or in combination with other information available with
us, can lead to your and/or such third party’s identification (“Personal Information”)
which includes without limitation:

(a)

Contact number;

(b)

Name;

(c)

Email address;

(d)

Residential or business address;

(e)

Nationality;

(f)

Photograph;

(g)

Proof of possession of Aadhar or any personal identification proof

(h)

PAN number;

(i)

Bank account information, as may be necessary subject to the nature of the
transaction; and

(j)

Financial information provided on the application forms and transaction
related data

2.1.2 Employment / business related details, details of your salary / monthly income /

revenue / turnover.

2.1.3 Goods and Services Tax details.

2.1.4 When you connect one or more of your accounts with other financial institutions to

your Davinta account, we also may collect User information to identify you (as
provided in Para 2.3 below), or to help verify that you are the true owner of the
account(s), before connecting your account(s).

2.2

Information received from your device: When you use your device to connect to Davinta’s
Platform, we receive information about that device, including IP address, hardware model,
operating system, and other technical information about the device. We also use cookies or
similar tracking technologies to collect non-personal information such as usage statistics and
location to help us provide and improve our services.

2.3

Information  collected  from  your  financial  institutions:  Davinta  collects  or  maintains  user
information  from  the  financial  institutions  you  use,  such  as  your  bank  depending  on  the
services  you  avail  from  Davinta.  .  When  you  link  your  primary  bank  account  to  Davinta’s
Platform, we may collect several categories of User information, including:
2.3.1  Bank  account  information,  including  your  bank’s  name,  the  account  type  you  use

(such as a “checking account” or “savings account”), account number(s), and the
institution’s routing number;

2.3.2 Information about any balance or transactions in your account; and
2.3.3 Any other Information about the bank account owner(s) provided by the financial

institution.

2.4

Information we receive about you from other sources: We may also collect User Information
directly from third parties, including our service providers or lending partner. For example,

3 | 8

Davinta may collect and maintain User Information from service providers and lending
partners in order to verify that you are authorized to use Davinta’s Services.

PURPOSE OF COLLECTION OF USER INFORMATION

3.1

Collection of User Information for provision of Services.
From time to time, we may request User Information (as provided in Section 2 above) for the
below-mentioned purposes:

  for provision of personalised services such as informing you of new services;
  grievance redressal purposes;
  Verifying, authenticating and/or updating your Aadhaar number in accordance with the

Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act,
2016 solely for the purpose of facilitation of extension of credit facilities and providing
know your customer (“KYC") services to you. Collection of your Aadhaar details is not a
mandatory requirement for availing our services unless required under any applicable law.

 To enable the provision of credit facility services to you through the Platform or activities

and  transactions  that  need  to  occur  during  the  process  of  lending,  including  without
limitation,  generating  and  maintaining  user  profiles,  providing  personalized  features,
facilitating  collection  services,  maintaining  regular  communications  with  the  user
concerning transactions the user initiates, such as requesting information or assistance,
submitting a loan request, making payments, transferring funds, etc.

 Communicate to you necessary account and product and/or service-related information

from time to time.

We will take reasonable steps to ensure that User Information is accurate and complete. The
collection and processing of User Information would be within the scope of this Privacy Policy.

3.2

Disclosure to third parties

We may share User Information as part of our data disclosures to third parties on a need to
know  basis with your prior and explicit consent. This disclosure  may  be  required for us to
check your eligibility for, provide you access to, and enable fulfillment of any services being
provided  to  you,  or  to  comply  with  any  legal  obligations,  to  enforce  user  agreements,  to
facilitate any marketing and advertising activities, to fetch a copy of your credit information
report  from  credit  information  companies  or  to  prevent,  detect,  mitigate,  and  investigate
fraudulent or illegal activities  related to any services  being provided to you.  You expressly
consent and agree to such disclosures to third parties.

We may disclose user information to third parties such as business partners, law enforcement
agencies,  insurers,  regulatory,  government  organisations  and  service  providers.  Such
disclosure  may  be  required for us to provide  you access  to our products and services; for
enhancing your experience; for providing feedback  on products; to  collect payments from
you; to comply with our legal obligations and court orders; to conduct market research or
surveys; to enforce our Terms of Use; to facilitate our marketing and advertising activities; to

4 | 8

analyze  data; for customer service  assistance; to prevent, detect, mitigate, and investigate
fraudulent or illegal activities related to our product and services. We do not disclose  user
information to third parties for their marketing and advertising purposes without your explicit
consent.

We may disclose user information if required to do so by law or in the good faith belief that
such disclosure is reasonably necessary to respond to subpoenas, court orders, or other legal
process. We may disclose user information to law enforcement agencies, third party rights
owners, or others  in the good faith belief  that such  disclosure  is reasonably necessary to:
enforce our Terms of Use or Privacy Policy; respond to claims that an advertisement, posting
or other content violates the rights of a third party; or protect the rights, property or personal
safety of our users or the general public.

We and our affiliates may share / sell user information with another business entity should
we  (or  our  assets)  plan  to  merge  with,  or  be  acquired  by  that  business  entity,  or  re-
organization, amalgamation, restructuring of business. Should such a transaction occur, the
other business entity (or the new combined entity) will be required to follow this Privacy Policy
with respect to user information.

The list of the third parties collecting your information can be accessed here [hyperlink]. The
details of third parties with whom we share user information are provided below:

Name of the third party

Purpose of sharing information

Digio Twentyone Communications Private
Limited

PAN Verification, GST Verification, Bank
Account Verification

Novel Patterns Private Limited

Bank Statement Verification

Signdesk (Desk Nine Private Limited)

e-sign, e-stamping, e-mandate

Axis Bank Limited

Physical NACH Mandate registration &
presentation

Digitap.AI Enterprise Solutions Private
Limited

Video-KYC

Loan Management

Allcloud Enterprise Solutions Private Limited

Astute Corporate Services Private Limited

Contact Point Verification

3.3

Collecting Personal Data for online surveys
At times, we conduct online surveys to better understand the needs and profile of our visitors.
When we conduct a survey, we will inform you about how we will use the Personal Data prior
to your taking the survey. If you do not want to participate in the survey, you may refrain from
contributing to it at your own discretion.

3.4

Use of cookies
The Company tracks information provided by visitor’s browser, including the website the
visitor came from (known as the referring URL), the type of browser used and other

5 | 8

information that does not personally identify any visitor of the Platform. This may include
installation of cookies and collection of other session data.

3.5

IP address
The Platform uses Internet Protocol (IP) addresses. An IP address is a number assigned to your
computer by your Internet service provider so you can access the Internet. Generally, an IP
address changes each time you connect to the Internet (it is a “dynamic” address). We use
your IP address to report aggregate information on use and to help improve our services.

STORAGE OF USER INFORMATION

We operate as per accepted standards to protect all user information submitted to us, both
during  transmission  and  once  we  receive  it.  We  do  not  collect  or  store  any  type  of  your
information other than which you consent to as detailed above and during onboarding to the
Davinta  platform.  We  do  not  collect  or  store  any  biometric  data  from  you  except  where
required as per extant statutory guidelines. All user information collected by us is only stored
in  servers  located  in  India  as  per  extant  RBI  guidelines  and  the  IT  Act  and  rules  made
thereunder.
For other User Information collected as part of our outsourcing services being provided to our
lending  partners,  we  shall  collect  such  information  upon  the  instructions  of  the  lending
partners  and thereafter  transfer the  same  to the  lending  partners upon the  completion of
your onboarding.

PROTECTION OF USER INFORMATION

We take steps designed to protect user information that we collect, store, or disclose. These
steps  include  maintaining  information  security  controls,  such  as  encryption  technologies
when  transferring  or  storing  data,  firewalls,  and  controls  over  the  physical  access  to  our
systems. We regularly evaluate the security controls that we use, as well as the controls that
our service providers use, for protecting the security and confidentiality of user information.
Our goal is to maintain effective security controls, as measured by relevant industry standards
and by independent security auditors, for all of the ways that you can use our Services.

As  part  of  our  security  breach  response  process,  we  report  all  types  of  unusual  security
incidents, including successful and unfruitful breach of security incidents, to the RBI within 24
hours in the format provided under the  RBI  Master  Direction  on  Information  Technology
Framework for the NBFC Sector dated 8 June 2017. Additionally, we require service providers
engaged with us to disclose any security breach or user information leakage to us and the RBI
on an immediate basis as per the RBI Directions on Managing Risks and Code of Conduct in
Outsourcing of Financial Services by NBFCs dated 9 November 2017.

You have a right to report a security incident to the GRO (detailed mentioned herein below).
You are entitled shall be entitled to prevent unauthorised such usage of your information by
our personnel/agents by informing us, within 10 (ten) days of being informed of the proposed

6 | 8

use, that you do not wish to disclose such information. You can also exercise the right at any
time by contacting us at

sladdha@davintafinserv.com

DISCLOSURE OF USER INFORMATION

Davinta makes various types of disclosures of User Information to other persons as permitted
by law. Our disclosures of user information may apply to some or all the categories of user
information that we collect. For example, Davinta may disclose all the types of user
information with your financial institution, consistent with your consent or instruction.
Davinta also discloses, or reserves the right to disclose the User information for the following
purposes:
(a)

With Davinta’s service providers or contractors in connection with the services they
perform for Davinta;

(b)

With Davinta’s lending partner for the credit services rendered through the Platform

(c)

To the extent permitted by law, it will be necessary for us to verify the details you
have supplied. Such verification could be done through third party service providers,
who shall be bound by the obligation of confidentiality and data protection.

(d)

In connection to all lending done  through  us, our business  partners  or our service
providers  to  Credit  Information  Companies  ("CICs”)  as  per  extant  RBI  guidelines
including Credit Information Companies (Regulation) Act and rules made thereunder.

(e)

If Davinta believes in good faith that disclosure is appropriate to comply with
applicable law, regulation, or legal process (such as a court order or subpoena);

(f)

In connection with a change in ownership or control of all or a part of Davinta’s
business (such as a merger, acquisition, or bankruptcy);

(g)

Between and among Davinta and Davinta’s future affiliates (such as subsidiaries or
other companies under common control or ownership); or

(h)

To help investigate, prevent or take action regarding unlawful and illegal activities,
suspected fraud, potential threat to the safety or security of any person or other user,
violations of the Platform’s terms of use or to defend against legal claims.

(i)

To our subsidiaries, group companies and/ or affiliates.

We may collect, use, process, or disclose user information in an aggregated or anonymized
manner (i.e., in a manner that does not identify you personally) for any purpose permitted
under applicable law.

As a convenience to our visitors, the Davinta Platform may contain links to a number of sites
that we believe may offer useful information. The policies and procedures we described here
may not apply to those sites. We suggest contacting those sites directly for information on
their privacy, security, data collection, and distribution policies.

We will process, disclose or share user information only if required to do so by law or in good
faith belief that such action is necessary to comply with our contractual obligations, legal
requirements or legal process served on us.

7 | 8

REVOCATION OF CONSENT

If you change your mind after opting-in, you may withdraw your consent to contact you, or
for the continued collection, use or disclosure of user information, restrict disclosure to third
parties, or any other consent already granted to us at any time, by mailing us at

customercare@davintafinserv.com

. Please note that this could impede or restrict our ability

to provide our services to you. Further, if you have availed any credit facility from our lending
partner, the lending partner shall have the right to continue processing your information till
such credit facility has been repaid in full, along with any interest and dues payable and/or for
such period as may be allowed under applicable law. Please provide details in the format
below as part of your consent revocation request:

First Name

Last Name

Country

State

City

Registered Email

Registered Mobile Number

DATA RETENTION AND DELETION

We retain your data for as long as necessary to provide you with our services. We may also
retain  and  use  your  basic  personal  information  inter  alia  as  name,  contact  number,
transactional details and address details as necessary to comply with our legal obligations,
resolve  disputes,  and  enforce  our  agreements  which  shall  always  be  in  accordance  with
applicable laws.

Please  note  that  consent  for  user  information  shared  with  us  on  a  one-time  basis  for
onboarding  cannot  be  revoked  after  we  have  shared  the  same  with  our  third  parties  to
complete the verification and onboarding process.

RIGHT TO RECTIFICATION

In the event that user information provided to us is inaccurate, incomplete or outdated then
you shall have the right to provide us with the accurate, complete and up to date data and
have us rectify such data at our end immediately. We urge you to ensure that you always
provide us with accurate and correct information/data to ensure your use of our services is
uninterrupted.

10.

GRIEVANCE REDRESSAL

For any grievance or complaint, questions, comments, concerns or feedback in relation to the

8 | 8

processing of information or regarding this Privacy Policy, please reach out to us through one
of the following modes:

a. Email. Customer can write to us at

customercare@davintafinserv.com

b. Telephone for call back. 080-47185381
c. You can also write to us at our Corporate Address: Urban Vault 1515, 2nd Floor, 19th main,

Vanganahalli, Sector 1, HSR Layout, Bengaluru, Karnataka 560102

d. Website – The Grievance Redressal Mechanism of Davinta can be accessed

here

EFFECTIVE DATE: [15-12-2022]