Privacy Policy

CapVestIQ Services Pvt Ltd ("CapVestIQ", "we", "us", or "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (www.capvestiq.com) or use our platform, mobile application, and related services (collectively, the "Platform"). Please read this Privacy Policy carefully. If you disagree with its terms, please discontinue use of the Platform immediately. This policy applies to all users including lending agents, lenders, DSA partners, channel partners, and borrowers who access our services.

Registered Name: CapVestIQ Services Pvt Ltd Registered Office: 7th Floor, Blob Co-working, 86 Golaghata Road, Jamuna Apartment, Kolkata – 700048, West Bengal, India Email: hello@capvestiq.com Phone: +91 20 1234 5678 For any privacy-related queries or grievances, please contact our Grievance Officer at the address mentioned above or write to us at privacy@capvestiq.com.

We collect information that you provide directly to us, information collected automatically, and information from third parties. 3.1 Information You Provide • Personal Identification Information: Full name, date of birth, gender, photograph. • Contact Information: Mobile number, email address, residential and office address, city, state, pin code. • Identity & KYC Documents: PAN card number, Aadhaar number, Voter ID, Passport, Driving Licence, and copies thereof. • Financial Information: Bank account details (account number, IFSC, bank name), income details, credit score, loan application details, disbursement information. • Professional Information: Occupation, employer details, years of experience, AMFI/IRDAI registration numbers (where applicable), existing lender empanelments. • Registration Information: Username, password, referral code, agency/DSA code. 3.2 Information Collected Automatically • Device information including IP address, browser type, operating system, and device identifiers. • Usage data such as pages visited, time spent, clicks, and navigation paths. • Location data (with your consent) to match you with nearby lenders or agents. • Cookies and similar tracking technologies (see Section 9 for details). 3.3 Information from Third Parties • Credit bureaus (e.g., CIBIL, Experian) for credit score and bureau reports. • Lender partners for loan status updates and disbursement confirmations. • KYC verification providers and government databases for identity authentication. • Referral partners who provide your contact details when they refer you to our Platform.

We use the information we collect for the following purposes: 4.1 Platform Operations • To register and authenticate your account on the Platform. • To process and submit loan applications to lender partners on your behalf. • To track application status, approvals, disbursements, and rejections. • To calculate, process, and disburse commissions and referral payouts to agents and partners. • To enable the Lender Marketplace by matching agents with appropriate lender products. 4.2 KYC and Compliance • To conduct Know Your Customer (KYC) verification as required under applicable laws. • To comply with Anti-Money Laundering (AML) and Prevention of Money Laundering Act (PMLA) obligations. • To fulfill reporting obligations to regulatory authorities including the Reserve Bank of India (RBI). 4.3 Communication • To send transactional alerts including application updates, commission credits, and account notifications via SMS, WhatsApp, email, or push notifications. • To send periodic newsletters, product updates, and promotional communications (which you may opt out of at any time). • To respond to your queries, complaints, and support requests. 4.4 Analytics and Improvement • To analyse usage patterns and improve our Platform's features, design, and performance. • To conduct internal research, generate aggregated and anonymised reports, and develop new products. 4.5 Legal and Security • To detect, prevent, and investigate fraud, identity theft, and other illegal activities. • To enforce our Terms & Conditions and other agreements. • To comply with legal obligations, court orders, or requests from government and regulatory authorities.

We do not sell your personal data to third parties. We may share your information in the following circumstances: 5.1 Lender Partners Your loan application data and KYC information is shared with the lender(s) you select or that we match you with, solely for the purpose of processing your loan application. 5.2 Service Providers We engage trusted third-party service providers for cloud hosting, data storage, payment processing, KYC verification, credit bureau checks, SMS/email delivery, and analytics. These providers are contractually bound to process your data only as instructed by us and to maintain appropriate security standards. 5.3 Regulatory and Legal Authorities We may disclose your information to government authorities, law enforcement agencies, courts, or regulators when required by law or to protect our legal rights. 5.4 Business Transfers In the event of a merger, acquisition, restructuring, or sale of assets, your information may be transferred to the successor entity. You will be notified via email or a prominent notice on our website before such transfer and the new entity will be bound by this Privacy Policy. 5.5 With Your Consent We may share your information with any third party when you explicitly consent to such sharing.

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements. • Account and KYC data: Retained for a minimum of 8 years after the closure of the account or the last transaction, as required under PMLA regulations. • Loan application data: Retained for 7 years from the date of the last activity on the application. • Communication logs: Retained for 3 years. • Cookie and analytics data: Retained for up to 24 months. When data is no longer needed, we securely delete or anonymise it in accordance with applicable laws.

Subject to applicable law, you have the following rights regarding your personal data: • Right to Access: You may request a copy of the personal data we hold about you. • Right to Correction: You may request correction of inaccurate or incomplete personal data. • Right to Deletion: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. • Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. • Right to Portability: You may request a machine-readable copy of your personal data that you have provided to us. • Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. To exercise any of the above rights, please write to us at privacy@capvestiq.com. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, alteration, or disclosure. These include: • AES-256 encryption of data at rest and TLS 1.2/1.3 encryption of data in transit. • Secure cloud infrastructure hosted in ISO 27001-certified data centres located in India. • Multi-factor authentication (MFA) for all Platform accounts and internal systems. • Role-based access controls ensuring staff access only the data they need for their specific function. • Regular security audits, vulnerability assessments, and penetration testing. • Strict vendor due diligence and data processing agreements with all third-party service providers. While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong passwords and keep your login credentials confidential.

We use cookies and similar tracking technologies to enhance your experience on our Platform. Types of cookies we use: • Essential Cookies: Necessary for the Platform to function and cannot be switched off. They are usually set in response to actions you take such as logging in or filling out forms. • Performance Cookies: Help us understand how visitors interact with the Platform by collecting anonymised information such as page views and traffic sources. • Functional Cookies: Enable the Platform to remember your preferences such as language, region, and display settings. • Targeting/Marketing Cookies: Used to deliver relevant advertisements and track the effectiveness of our marketing campaigns. These are only set with your consent. You can control cookie settings through your browser preferences. Disabling cookies may affect certain features of the Platform. For more details, please refer to our Cookie Policy.

Our Platform is not intended for use by individuals under the age of 18 years. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@capvestiq.com and we will take steps to delete such information.

Our Platform may contain links to third-party websites, lender portals, or partner platforms. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices or content of such external websites.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the revised policy on this page with an updated "Last Revised" date. Where required by law, we will obtain your consent for material changes. We encourage you to review this Privacy Policy periodically.

This Privacy Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and any other applicable data protection legislation. Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the courts located in Kolkata, West Bengal, India.

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the name and contact details of the Grievance Officer are provided below: Name: Grievance Officer Designation: Data Privacy Officer Company: CapVestIQ Services Pvt Ltd Address: 7th Floor, Blob Co-working, 86 Golaghata Road, Jamuna Apartment, Kolkata – 700048, West Bengal, India Email: privacy@capvestiq.com Response Time: We will acknowledge your complaint within 24 hours and resolve it within 30 days of receipt.