Privacy Policy

1. Preliminary

1.1 This Privacy Policy (the “Policy”) is issued by Shantilekh Global Technology Private Limited, a company incorporated under the laws of India, having its office at Office No. 1418, Tower A, Spectrum Metro Mall, Sector 75, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301 (the “Company”, “SUVRON Money”, “we”, “us” or “our”), which owns and operates the SUVRON Money mobile application and the website located at suvron.in (collectively, the “Platform”).

1.2 This Policy is published in accordance with, and shall be construed in conformity with, the Digital Personal Data Protection Act, 2023 and the rules framed thereunder (collectively, the “DPDP Act”), the Information Technology Act, 2000 and the rules framed thereunder, and the directions issued by the Reserve Bank of India (“RBI”) governing digital lending, each as amended from time to time (collectively, “Applicable Law”).

1.3 This Policy forms an integral part of, and shall be read together with, the Terms of Use. By accessing the Platform, registering an account, or providing consent in the manner set out herein, the Data Principal acknowledges having read and understood this Policy.

2. Definitions and interpretation

2.1 In this Policy, unless the context otherwise requires:

• “Consent” means a free, specific, informed, unconditional and unambiguous indication of the Data Principal’s wishes, signifying agreement to the Processing of Personal Data for a specified purpose, given by a clear affirmative action;
• “Credit Information Company” means a credit information company registered with the RBI under the Credit Information Companies (Regulation) Act, 2005;
• “Data Fiduciary”, “Data Principal”, “Data Processor”, “Personal Data”, “Personal Data Breach” and “Processing” shall have the meanings ascribed to them under the DPDP Act;
• “Key Fact Statement” or “KFS” means the key fact statement provided to the Data Principal prior to the execution of any loan agreement, in the form prescribed by the RBI;
• “Lending Partner” means a regulated entity, being a bank or non-banking financial company registered with the RBI, with which the Company has entered into an arrangement for the sourcing and servicing of loans, presently Ready Leasings Private Limited;
• “Loan” means any credit facility sanctioned and disbursed by the Lending Partner to a Data Principal through the Platform; and
• “Service Provider” means any third party engaged by the Company or the Lending Partner to Process Personal Data on its behalf, including providers of identity verification, KYC, electronic signature, payment, cloud hosting, data analytics and communication services.

2.2 Headings are for convenience only and shall not affect interpretation. Words importing the singular include the plural and vice versa. The words “include” and “including” shall be construed without limitation. Reference to any statute includes any amendment, modification or re-enactment thereof.

3. Role of the Company and the Lending Partner

3.1 The Company acts as a lending service provider to the Lending Partner within the meaning of the RBI’s directions on digital lending. The Company does not lend, and does not hold itself out as lending, any money.

3.2 Each Loan is sanctioned, disbursed and owned by the Lending Partner, which shall exercise final and exclusive control over all credit decisions. The Company collects Personal Data through the Platform and Processes it for the purposes set out in this Policy, and discloses to the Lending Partner such Personal Data as is necessary for the Lending Partner to assess, sanction, disburse, service and recover the Loan.

3.3 To the extent that the Lending Partner determines the purpose and means of Processing of Personal Data for its own purposes, the Lending Partner shall act as an independent Data Fiduciary in respect of such Processing, subject to its own privacy policy.

4. Consent

4.1 The Company shall Process Personal Data only for a lawful purpose for which the Data Principal has given Consent, or for such legitimate uses as are permitted under the DPDP Act, including compliance with any law or any judgment or order, and the fulfilment of any obligation under law to disclose information to the State or its instrumentalities.

4.2 Consent shall be obtained through the Platform by way of a clear affirmative action, preceded by a notice describing the Personal Data sought and the purpose of Processing. Each device permission shall be requested separately and shall be accompanied by a description of the purpose for which it is sought.

4.3 The Data Principal may withdraw Consent at any time in the manner set out in Clause 11. Withdrawal of Consent shall not affect the lawfulness of Processing undertaken prior to such withdrawal, nor any Processing required or authorised under Applicable Law, including the retention of records under Clause 9.

4.4 Where the Data Principal declines or withdraws Consent to the Processing of Personal Data that is necessary for the assessment of a Loan application, including access to Financial SMS under Clause 5.2(a), the Company shall be unable to process any new Loan application. The servicing of any outstanding Loan shall continue in accordance with the loan agreement.

5. Personal Data collected

5.1 Personal Data provided by the Data Principal. The Company may collect: (a) identification and contact details, including name, mobile number, email address, date of birth, gender, current address and PIN code; (b) know-your-customer information, including Permanent Account Number, Aadhaar details collected and verified in accordance with the requirements of the Unique Identification Authority of India, live photograph, and proof of address; (c) occupational and financial information, including employment or student status, employer or institution, and monthly income; (d) bank account number and IFSC of the account nominated for disbursement and repayment; (e) documents uploaded by the Data Principal, including bank statements and salary slips; and (f) records of communications with the Company, including messages, emails and recordings of telephone calls.

5.2 Personal Data collected from the device, subject to Consent. The Company may collect: (a) financial SMS messages only (“Financial SMS”), being transactional and service messages received from banks, non-banking financial companies, payment service providers, credit card issuers, wallets, billers and other financial institutions, including the sender identifier, content and time of receipt thereof, for the purpose of assessing income, expenditure and existing repayment obligations, access to which is a mandatory condition for the submission of a Loan application. The Company does not read, collect, store or Process personal SMS messages, including messages exchanged with individuals, one-time passwords unrelated to the Platform, and promotional messages, and such messages are excluded from collection; (b) a list of applications installed on the device, principally for the identification of other lending and financial applications, the assessment of existing indebtedness, and the prevention of fraud; (c) the location of the device, collected once at the time of registration, for the verification of address, determination of serviceability, and prevention of fraud, and the Company shall not track location in the background; (d) access to the camera, used once during KYC, for capturing the photographs required for identity verification; and (e) device data, comprising (i) hardware information, including device manufacturer and model, random access memory and storage capacity; (ii) unique device identifiers, including International Mobile Equipment Identity (IMEI), device serial number and Android ID (SSAID); (iii) SIM information, including network operator, roaming state, Mobile Network Code (MNC) and Mobile Country Code (MCC); (iv) Wi-Fi and network information, including media access control (MAC) address and mobile network information; and (v) operating system and version, and application version, for the purposes of uniquely identifying the device, securing the account, detecting and preventing fraud and unauthorised access, and enriching the credit profile of the Data Principal for the assessment of eligibility and determination of Loan offers.

5.3 Exclusions. The Platform shall not access the contact list, call logs, or files and media stored on the device of the Data Principal.

5.4 Personal Data arising from use of the Platform. The Company may collect records of Loan applications, offers, Loans, repayments, due dates and modes of payment, and information relating to the use of the Platform, including access times, features used, crashes and errors.

5.5 Personal Data obtained from third parties. Subject to Consent where required, the Company and the Lending Partner may obtain Personal Data from: (a) Credit Information Companies, including credit reports and scores; (b) the Central KYC Records Registry and authorised government verification services, and the Data Principal hereby consents to the Company and the Lending Partner fetching KYC records from the Central KYC Records Registry using the details provided; and (c) banks and verification service providers, for the verification of ownership and status of the nominated bank account.

5.6 A summary of the categories of Personal Data, the purposes of Processing, and the categories of recipients is set out in the Schedule to this Policy.

6. Purposes of Processing

6.1 The Company shall Process Personal Data for the following purposes: (a) verification of identity and completion of KYC in accordance with Applicable Law; (b) assessment of eligibility and creditworthiness, and determination of the amount, tenure and pricing of any Loan offer, including through automated models applied in conjunction with the credit policy of the Lending Partner; (c) facilitation of disbursement, servicing, collection and recovery of Loans, including the issuance of reminders; (d) detection, prevention and investigation of fraud, identity theft and misuse of the Platform; (e) resolution of queries and grievances; (f) maintenance, improvement and security of the Platform, using aggregated or de-identified data wherever practicable; and (g) compliance with Applicable Law, including directions of the RBI, anti-money-laundering obligations, tax laws, and lawful requests of regulators, courts and law enforcement agencies.

6.2 Transactions that appear suspicious shall be reported to the appropriate authority as required under the Prevention of Money-laundering Act, 2002 and the rules framed thereunder.

6.3 The Company shall not Process Personal Data for any purpose other than those set out in this Clause without obtaining fresh Consent, save as permitted under Applicable Law.

7. Disclosure of Personal Data

7.1 The Company does not sell Personal Data.

7.2 The Company may disclose Personal Data, to the extent necessary for the purposes set out in Clause 6, to: (a) the Lending Partner; (b) Credit Information Companies, including for the reporting of credit information as mandated under Applicable Law; (c) Service Providers, including providers of KYC, verification, electronic signature, payment, cloud hosting, data analytics and communication services; (d) recovery agents engaged in respect of overdue Loans, limited to such Personal Data as is necessary for contacting the Data Principal in respect of such Loan, who shall be bound by the Fair Practices Code and the directions of the RBI on recovery; and (e) regulators, courts, law enforcement agencies and other authorities, where required under Applicable Law.

7.3 Every Service Provider shall Process Personal Data only on the documented instructions of the Company or the Lending Partner, as the case may be, under a written contract containing obligations of confidentiality, purpose limitation and security not less protective than those set out in this Policy. The Company shall remain responsible for Processing undertaken by Data Processors on its behalf, in accordance with the DPDP Act.

8. Storage and security

8.1 Personal Data shall be stored on servers located within the territory of India.

8.2 The Company shall implement reasonable security safeguards to prevent Personal Data Breach, including encryption of data in transit and at rest, role-based access controls restricting access to personnel with a need to know, logging of access and activity, and periodic review of security practices. All personnel with access to Personal Data shall be bound by obligations of confidentiality. The Company shall not store any debit or credit card number or card verification value.

8.3 In the event of a Personal Data Breach, the Company shall intimate the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the DPDP Act, together with the measures taken to mitigate the risk.

9. Retention

9.1 Personal Data shall be retained only for so long as is necessary to fulfil the purposes for which it was collected, or as required under Applicable Law.

9.2 Without prejudice to the generality of Clause 9.1: (a) records of identity, KYC and Loan transactions shall be retained for a period of not less than five years from the cessation of the relationship between the Data Principal and the Company or the Lending Partner, as required under the Prevention of Money-laundering Act, 2002 and the rules framed thereunder; (b) device data under Clause 5.2(e) shall be retained for so long as is necessary for the prevention and investigation of fraud and the servicing of any Loan, and information relating to the use of the Platform under Clause 5.4 shall be retained for a shorter period, save where required for the investigation of a security incident or fraud; and (c) Personal Data of a Data Principal who does not avail a Loan shall be erased or de-identified once it is no longer required for the specified purpose.

10. Automated decision-making

10.1 Loan applications are assessed in part by automated models using the Personal Data described in Clause 5. A Data Principal who believes that a decision concerning them is erroneous may request a review of such decision by a natural person by writing to the Company in the manner set out in Clause 15.

11. Rights of the Data Principal

11.1 Subject to the DPDP Act, every Data Principal shall have the right to: (a) obtain a summary of the Personal Data being Processed and the Processing activities undertaken, and the identities of all Data Fiduciaries and Data Processors with whom such Personal Data has been shared; (b) correction, completion and updating of inaccurate, incomplete or outdated Personal Data; (c) erasure of Personal Data, save where retention is necessary for the specified purpose or for compliance with Applicable Law; (d) withdraw Consent at any time, with the same ease with which it was given; (e) nominate any other individual to exercise these rights in the event of death or incapacity; and (f) readily available means of grievance redressal.

11.2 Requests under this Clause shall be made in writing to support@suvron.in from the email address registered with the Company. The Company may require verification of identity before acting on any request. The Company shall endeavour to respond within seven days of receipt, and in any event within the period prescribed under the DPDP Act.

11.3 A Data Principal shall, in exercising these rights, comply with the duties imposed under Section 15 of the DPDP Act, including the duty not to furnish false particulars or suppress material information.

12. Communications

12.1 The Company and the Lending Partner may communicate with the Data Principal by SMS, email, WhatsApp, application notification and telephone in connection with Loan applications and the servicing of Loans, including sanction, due-date and repayment communications, which shall be treated as transactional.

12.2 Promotional communications shall be sent only with Consent and in accordance with the regulations of the Telecom Regulatory Authority of India on commercial communication, including registered preferences. The Data Principal may opt out of promotional communications at any time through the Platform or in writing, and may disable application notifications through device settings, provided that this may result in the Data Principal not receiving reminders relating to an outstanding Loan.

13. Children

13.1 The Platform is intended solely for individuals who have attained eighteen years of age. The Company does not knowingly Process the Personal Data of any child, and shall erase any such Personal Data upon becoming aware of its collection.

14. Cookies

14.1 The website does not deploy advertising or tracking cookies. Details are set out in the Cookie Policy.

15. Grievance redressal

15.1 Queries, requests and grievances relating to this Policy or the Processing of Personal Data may be addressed to support@suvron.in.

15.2 Where a grievance is not resolved to the satisfaction of the Data Principal, it may be escalated to the Grievance Redressal Officer of the Company, Ms. Ekta G, at gro@suvron.in or 9971373543. The escalation framework, including recourse to the RBI, is set out in the Grievance Redressal Policy.

15.3 A Data Principal shall exhaust the grievance redressal mechanism of the Company before approaching the Data Protection Board of India, in accordance with the DPDP Act.

16. Amendment

16.1 The Company may amend this Policy from time to time to reflect changes in its practices or in Applicable Law. Material amendments shall be notified to the Data Principal through the Platform or by email prior to their taking effect, and where any amendment requires fresh Consent, such Consent shall be sought. The version number and effective date set out above shall indicate the operative version of this Policy.

17. Governing law and jurisdiction

17.1 This Policy shall be governed by and construed in accordance with the laws of India. Subject to Clause 15 and the jurisdiction of the Data Protection Board of India under the DPDP Act, the courts at Bengaluru shall have exclusive jurisdiction in respect of any dispute arising hereunder.

Schedule: Personal Data, purposes and recipients