PRIVACY POLICY

This PRIVACY POLICY (“Policy”) has been drafted in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.

SAYYAM INVESTMENTS PRIVATE LIMITED, a Company registered under the Companies Act, 1956, having its registered office at Agyathuri, Chamajali, Amingaon Guwahati Kamrup AS 781031 IN (hereinafter shall be referred to as “Sayyam” or "Company" or "us" or "we") is a Non-Banking Financial Company registered with the Reserve Bank of India (“RBI”) and is the Licensed owner of the mobile application named PayRupik ("App") and website at sayyaminvestments.in ("Website") (App and Website are hereinafter together referred to as the "Platform").

THIS POLICY DESCRIBES OUR POLICIES AND PROCEDURES FOR THE COLLECTION, USE, STORAGE, PROCESSING, DISCLOSURE AND PROTECTION OF ANY INFORMATION, INCLUDING, BUT NOT LIMITED TO, BUSINESS OR PERSONAL INFORMATION PROVIDED BY YOU AS A USER (“YOU/YOUR” or “USER”) WHILE USING THE PLATFORM. USER SHALL MEAN ANY PERSON/ PERSONS, WHO VISITS, USES, DEALS WITH AND/ OR TRANSACTS THROUGH THE PLATFORM OR AVAILS OUR SERVICES AND INCLUDES A BROWSER. .

THIS POLICY CONSTITUTES A LEGAL AGREEMENT BETWEEN YOU, AS THE USER OF THE PLATFORM, AND THE COMPANY, AS THE LICENSED OWNER OF THE PLATFORM. YOU MUST BE A NATURAL PERSON WHO IS AT LEAST 20 YEARS OF AGE.

BY VISITING/ ACCESSING THE PLATFORM, THROUGH THE WEBSITE OR THE APP AND/OR VOLUNTARILY PROVIDING US WITH INFORMATION (PERSONAL AND/OR NON- PERSONAL) FOR THE PRODUCTS OR OTHERWISE, YOU ARE CONSENTING TO OUR USE OF IT IN ACCORDANCE WITH THIS POLICY. THIS POLICY DOES NOT APPLY TO THIRD-PARTY WEBSITES / APPLICATIONS THAT ARE CONNECTED VIA LINKS TO THE PLATFORM. IF YOU DO NOT AGREE WITH THE TERMS AND CONDITIONS OF THIS POLICY, PLEASE DO NOT PROCEED FURTHER TO USE/ ACCESS THIS PLATFORM.

YOUR USE OF THE PLATFORM WILL BE GOVERNED BY THIS POLICY AS APPLICABLE TO THE PLATFORM TOGETHER WITH ALL POLICIES, NOTICES, GUIDELINES, DISCLAIMERS THAT ARE PUBLISHED AND SHARED WITH YOU FROM TIME TO TIME WHICH ARE INCORPORATED HEREIN BY WAY OF REFERENCE INCLUDING BUT NOT LIMITED TO OUR TERMS & CONDITIONS AND SUCH OTHER TERMS AS MAY BE APPLICABLE TO YOU IN YOUR CAPACITY AS A USER OF THE WEBSITE. THIS POLICY SHALL BE ENFORCEABLE AGAINST YOU IN THE SAME MANNER AS ANY OTHER WRITTEN AGREEMENT.

THIS POLICY IS A PART OF THE TERMS & CONDITIONS OF THE PLATFORM AND ALL CAPITALIZED TERMS UNDER THIS POLICY THAT HAVE NOT BEEN SPECIFICALLY DEFINED HEREIN SHALL HAVE THE MEANING AS ASCRIBED TO IT UNDER THE PLATFORM TERMS & CONDITIONS.

YOU READ, UNDERSTAND, ACKNOWLEDGE AND UNCONDITIONALLY AGREE TO BE BOUND BY THE TERMS AND CONDITIONS OF THIS PRIVACY POLICY.

IF YOU DO NOT AGREE TO THIS POLICY OR ANY PART THEREOF, PLEASE DO NOT USE/ACCESS/DOWNLOAD/INSTALL THE PLATFORM/APPLY FOR SERVICES OR ANY PART THEREOF.

WE MAY UPDATE THIS POLICY FROM TIME TO TIME. YOU MUST PERIODICALLY REVIEW THE POLICY FOR THE LATEST INFORMATION ON OUR PRIVACY PRACTICES.

1. COLLECTION OF INFORMATION

During your use of the Platform, we will collect information and data including but not limited to your personal information and sensitive personal information/data (“SPD & I”) as defined under the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011. The purpose of this is to provide you a secure, efficient, smooth, and specialized experience and Services which permits us to provide services and features that meet your needs, and to customize our Platform to make your experience smoother and easier and to enhance the Services provided by us. You hereby provide us explicit consent to collect the following data from you as a data provider which also includes SPD & I:

Collection of Non-Personal Information:

We track certain information about you which we use to do internal research on our Users' interests and behavior to better understand, protect, and serve our users and to improve our services.

Collection of Personal Information:

You explicitly provide us consent to collect Your Personal Information which is shared by You such as name, address, phone number, email address, and other details mentioned in this Policy. We will collect your personal information when you register on our Platform and procure our Services.

Cookies:

Cookies are small data files that a Website/App stores on Your device. We will use cookies on our App similar to other lending websites/apps and online marketplace websites/apps. This helps us identify You in order to make our App more user-friendly. We retain this information as necessary to resolve disputes, provide customer support, and troubleshoot problems as permitted by law.

INFORMATION WE COLLECT FROM YOUR REGISTRATION AND USAGE OF OUR SERVICES:

1. Your name, address, date of birth, contact information (email ID and phone number), marital status, PAN number, name of the bank where you have your primary account, bank statements, pay slips, etc.
2. Details regarding your employment, including years of experience, details of income, name of the current employer, and details of the office address.
3. Credit-related information that is collected from other sources like the credit bureau.
4. Know Your Customer (KYC) data such as valid address proof, PAN, photo, etc.
5. Your unique identifiers such as username and password, preferences information, and transaction history.
6. Any other information that is required to be collected as per specific mandates from the Reserve Bank of India or as a requirement under applicable law in India.
7. Information from you electronically, such as the pages viewed, how you navigate through the Platform, and interact with the Platform, etc.

The information collected from you will assist us in providing our Services to you and to personalize, maintain, and improve our Services.

4. Camera

During the usage of the Services, we will ask you to authorize us one-time camera access for the purpose of taking photos for uploading Know Your Customer (KYC) documents, taking photos of the user for security verification, and also for the purpose of raising user grievances and feedbacks.

Data storage of camera information: Details of camera information will be encrypted and uploaded to our server through HTTPS.

5. Microphone

During the usage of the Services, we will ask you to authorize us one-time microphone access for the purpose of raising user grievances, feedbacks, and enabling two-way communication between our authorized agents and you in order to perform and complete your video KYC service.

Data storage of microphone information: Details of microphone information will be encrypted and uploaded to our server through HTTPS.

6. Photo Library

During the usage of the Services, we will request access to the photo library to allow you to easily capture and upload the selected documents for KYC purposes.

Data storage of photo library: Details will be encrypted and uploaded to our server through HTTPS. For the purpose of access and storage of photo library media provided by you, we shall only access and store the documents specifically selected by you and we shall abide by the relevant guidelines and laws issued by the Government of India in this behalf.

7. File

We will request authorization for file access to allow you to securely download and store required documents on your device, and corresponding documents for KYC purposes can be uploaded to provide better loan application Service.

Data storage of File: Details of files will be encrypted and uploaded to our server through HTTPS. For the purpose of access and storage of documents provided by you, we shall only access and store the documents specifically selected by you and we shall abide by the relevant guidelines and laws issued by the Government of India in this behalf.

8. App Data

During the use of the service, we will collect data of the applications currently installed in your device, including the application name and application package name. The collected application data is used for credit risk analysis and fraud identification, which helps to quickly approve applications and accurately provide services. We will also use this data to ensure that there are no non-Google trusted applications or virus applications installed on your device, as these may affect the security of your funds.

Data storage of application data: The details of the application data will be encrypted and uploaded to our server via HTTPS. No data will be shared with third parties.

9. Usage Data

We collect data about your interactions with our application Services during the usage of the application. This includes data such as Service access times, logs of app Service crashes, etc. This data is used for customer support and improving the usage experience and automated fraud risk analysis.

Data storage of Usage data: Data storage of Usage data will be encrypted and uploaded to our server through HTTPS. No data shared with third parties.

10. Battery Level

We collect the battery power information of the device when You use the application to optimize the application performance, reduce the number of good points, and extend the life of user equipment.

Data storage of Battery level: Battery level data will be encrypted and uploaded to our dedicated server through HTTPS. No data shared with third parties.

11. Network Data:

We monitor the network status of your device when you use the application. This data is used to improve the delay of network requests, avoid possible data hazards during use, and provide you with a better user experience.

Data Storage of Network Data:Network data will be encrypted and uploaded to our dedicated server through HTTPS. No data will be shared with third parties.

As detailed above, we also collect your personal information, including financial information, from the registration or other completed forms/questionnaires that you provide to us. We will also receive your personal information, including financial information, from documents that you may provide to us and/or from documents like the credit report that you authorize us to obtain on your behalf from credit information companies.

The information we collect about you will depend on the products and services we offer on an ongoing basis. The information collected from you will be used in order to effectively provide services to you. If you do not allow us to collect all the information, we may not be able to deliver the services effectively. You hereby provide us explicit consent to use the data specified above as per the terms of this Policy.

You further understand and consent to the fact that we may also supplement the information we collect from you with information we receive from other companies or third parties. For example, we may use marketing segments developed by us or other companies to customize certain services or offer more products to you.

We undertake that the Platform shall strictly abide by this Policy.

2. USE OF INFORMATION

Personal information of individual users will not be disclosed, sold, or otherwise transferred to unaffiliated third parties except for providing our services to you and with your approval.

RESTRICTED USAGE OF PERSONAL INFORMATION AND DATAWe agree to restrict our usage of Personal Information and Data as follows: : (i) we may use or disclose in any form for any of our internal business purposes and for the purpose of providing Servicesto You in our complete discretion in accordance with this Policy; (ii) wemay otherwise only disclose Public Information and data to a third party in a form that is not anonymized to provide Servicesto you and for no other purpose.

You hereby provide explicit consent to us for the use of Your information provided (including SPD & I) provided by You to us (as specified above) and to share such information with third parties for the following purposes:

1. Create and update the Loan account.
2. Monitor, improve, and administer our Platform.
3. Manage our risks, including the risk of fraud that may be committed against us or our partners.
4. To analyze loan eligibility and loan parameters.
5. Analyze how the Platform is used, diagnose Service or technical problems, and maintain security.
6. Send communications, notifications, and information regarding the products or Services requested by You or process queries and applications that you have made on the Platform, including marketing and promotion of our Services or our Platform by way of tele-messages, emails, or calls.
7. Manage our relationship with you and provide You with or inform you about other products or Services we think you might find useful.
8. Conduct data analysis in order to improve the Services provided to You.
9. Use the User information in order to comply with country laws and regulations.
10. To conduct KYC based on the information shared by the User for the provision of Services and availing the Product. This includes conducting analysis of your creditworthiness, loan eligibility, KYC documents, current employment verification, and the terms of your loans. We may directly or through third parties conduct the KYC on its customers. In the event the KYC is conducted by third-party Service providers, We shall share Your relevant information with such third-party Service providers for availing the said Services in accordance with the applicable rules and guidelines.
11. To provide customer support, including resolving your concerns from the use of the Services.
12. To market the Platform and our Services, which includes sharing your feedback, ratings, and screen names for purely promotion and marketing purposes. Such promotion and marketing may be done, inter alia, via calls, SMS, emails, and other means.

13. Use Your information in other ways permitted by law.
14. Use the information obtained from Your Device to control risk, detect fraud, and provide better Services to You.
15. We will use and retain Your information to the extent required and for such periods as necessary to comply with our legal obligations, court orders, government authorities, law enforcement authorities, resolve disputes, enforce our agreements, or by other legal processes, or where it becomes necessary to do so to protect the rights or property of the Company.

3. DISCLOSURE OF INFORMATION

You hereby provide explicit consent to the disclosure of your information (including SPD & I) by us to our Affiliates, employees, and to third parties as per the terms of this Policy. You provide us explicit consent to share Your information with third parties only in such manner and for the purposes as described below:

1. We may disclose Your information to other financial Service providers, banks, and our third-party partners, Payment Gateways, Aggregators, and Service providers for providing the Services and offering the Products as detailed under the Terms & Conditions.
2. We may share the details of the Product and Your information with our third-party partners and Service providers in order to conduct data analysis for the purpose of improving the Services and analyzing Your use of the Platform, and to Service you better.
3. We may share details of Your contact information and loan details with our Lending Service Providers (collection agencies) for the purpose of recovery of loans.
4. We may also disclose Your information to our third-party Service providers for fraud detection, risk assessment, and/or for sending promotional tele-messages and emails.
5. We contract with third-party advertising networks, publishers, and other entities to advertise our Products and Services on Platforms which are not affiliated with us. We shall share the information provided by You, and the same shall not be used for any purpose other than to assist us in our advertising efforts.
6. We may disclose Your information, without prior notice, if we are under a duty to do so in order to comply with any legal obligation or an order from the government and/or a statutory authority, or in order to enforce or apply our terms of use or assign such information in the course of corporate divestitures, mergers, or to protect the rights, property, or safety of us, our users, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.
7. We may disclose Your information as required by the Reserve Bank of India to the Credit Information Companies in accordance with Reserve Bank of India guidelines.
8. We may share Your information with third parties under a confidentiality agreement for the provision of Services, which inter alia restricts such third parties from further disclosing the information unless such disclosure is for the purpose as detailed under that confidentiality agreement. However, we are not responsible for any breach of security or for any actions of any third parties that receive Your personal information.
9. We shall share your information with third parties only on a need basis and only for the purpose of providing Services to you, as per the applicable laws. We share information with third parties strictly to the extent required for the performance of Services.
10. Disclosure to Credit Information Companies (CICs): We furnish accurate, complete data and information, including credit information assured and received by You, to CICs through a secured medium in a prescribed format.
11. You hereby confirm to ensure the accuracy and completeness of the data submitted and shall submit revised data and information in the event of changes in data.

We will use and retain Your information for such periods as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Details of the third parties we share your information with are set out below:

We also provide the details of the Lending Service Providers engaged with us for the recovery of loans in the Key Fact Statement (KFS) provided to You in the event that you avail our Services. In lieu of any changes in our Lending Service Providers, we shall strive to update the same in the KFS and this Policy at the earliest instance.

4. DATA ACCURACY AND COMPLETENESS

We take appropriate and necessary steps to ensure that the data, information, and credit information we maintain about You is accurate, complete, and updated. We are committed to the following practices:

• Data Verification: We regularly verify the accuracy and completeness of the data, information, and credit information provided.
• Data Updates: We do timely updates whenever we receive the new or updated information from You. Hence, You shall keep us informed in the event of any changes in the information and data submitted.

5. STORAGE AND SECURITY OF INFORMATION

We store and process only such information, including the information received from Your Device, as required for the purpose of providing Services and for legal, statutory, and regulatory compliances on Amazon Cloud Servers and other secure cloud Service providers.

All information received by us, either directly from You or through Your Device, is protected and secured by us. We adopt multiple safeguards to protect the security of the information and data provided by You, such as firewalls and data encryption using Secure Sockets Layers (SSL), and information access authorization controls.

We value your trust in providing us your information and hence we use reasonable safeguards to preserve the integrity and security of Your information against loss, theft, unauthorized access, disclosure, reproduction, use, or amendment. To achieve the same, we use reasonable security practices and procedures as mandated under applicable laws for the protection of Your information. We implement reasonable physical, administrative, and technical safeguards to help us protect your information from unauthorized access, use, and disclosure. Information You provide to us is stored on our secure servers located in India.

We aim to protect Your information from unauthorized access and/or disclosure by providing security features like OTP verification to help you protect your account; transmission of data through encryption; review of our information collection, storage, and processing practices, including physical security measures, to prevent unauthorized access to our systems; compliance with Regulations and applicable laws; and restriction of access to personal information to our employees, contractors, and third-party service providers only for the purpose of providing the Services.

The collection, usage, and sharing of information by us shall be in compliance with the Information Technology Act, 2000 and other applicable rules and laws made thereunder.

In addition, the application and the website have been certified for the following security certifications:

• ISO 27001 (formally known as ISO/IEC 27001:2005) is a specification for an information security management system (ISMS) and the suggested level of certification required under the Information Technology Act, 2000. An ISMS is a framework of policies and procedures that includes all legal, physical, and technical controls involved in an organization's information risk management processes.

However, you understand and accept that there is no guarantee that data transmission over the Internet will be completely secure and that any information that You transmit to us is at Your own risk. While it is always our endeavor to take all reasonable steps to prevent disclosure of information, no method of transmission, whether in physical form or over the internet, or method of electronic storage is 100% secure and may be subjected to unintentional risks, due to reasons beyond our control.

By accepting this Privacy Policy, you accept that such transmission of your personal information is done at your own risk.

6. STANDARDS FOR HANDLING SECURITY BREACH

The security of your Information is of utmost importance to us. We take all physical, technical, and operational measures to improve the integrity and security of information that we collect and maintain as required by applicable laws.

Our database is limited to a specific IP address and external networks cannot access the database. Further, the database has multiple backup strategies and supports fast recovery of data in the event of loss of data. We use the basic DDOS protection function provided by cloud vendors to defend against DDOS attacks of certain traffic. We regularly review this Policy regarding the collection, storage, and processing of Your information to prevent alteration, loss, or fraudulent or unauthorized access of Your information.

7. PHISHING

"Phishing" usually occurs when users of a website are induced by an individual/entity into divulging sensitive personal data by using fraudulent websites and/or e-mail addresses. In the event of You providing information to a website or responding to an e-mail which does not belong to us or is not connected with Us in any manner, You will be a victim of Phishing. We do not send e-mails requesting a user for payment information, user name, or passwords. However, We may verify the user name, password, etc., provided by You from time to time.

8. DATA RETENTION AND DESTRUCTION PROTOCOL

We shall store and retain Your information to facilitate the fulfillment of Services. The retention period is determined with regard to compliances required under the applicable laws. We also retain data to improve and personalize our Services; to provide customer service; to personalize our advertising and marketing communications; and to prevent, detect, mitigate, and investigate fraudulent or illegal activities. We do not retain your personal data beyond the period required for compliance with legal obligations and applicable laws.

In accordance with applicable laws and as per our policies, you can exercise the following rights by contacting our customer service at the mail ID and/or the phone number mentioned on the Platform and this Policy:

1. Review or Rectify your provided Information: You have the right to request us to rectify your Information which You have provided to us in the time frame as specified under applicable laws.
2. Right to deny consent: You have the option to deny consent for use of specific data and data retention. However, if you exercise this right, it may impair or restrict our ability to provide Services to you.
3. Right to restrict disclosures to Third Parties: You have the right to request for restriction of disclosure to third parties. However, You may not be able to use our Services post such restriction.
4. Right to revoke consent: This enables you to withdraw consent already granted to collect personal data. We shall comply with such request, subject to applicable laws and the terms of the loans sanctioned through the Platform. However, if you exercise this right, it may impair or restrict our ability to provide Services to you.
5. Request the Platform to delete/forget Your personal data: You may request us to delete or remove Your personal data.

These rights may affect our ability to process or enable your Information which may lead to the discontinuation of those Services for which this Personal Information is required, at our sole discretion.

These rights are limited to the extent wherein we are legally bound to process or retain your Information. We retain required information about you to provide a consistent and ideal experience, to detect, mitigate, prevent, and investigate fraudulent or illegal activities during the course of the Services, and to contact you in the event of any grievance. We may also retain and use your basic personal information such as name, contact number, transactional details, and address details as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements which shall always be in accordance with applicable laws.

9. SEVERABILITY AND EXCLUSION

We have taken every effort to ensure that this Policy adheres to the applicable laws. The invalidity or unenforceability of any part of this Policy shall not prejudice or affect the validity or enforceability of the remainder of this Policy. This Policy does not apply to any information other than the information collected by us through the Platform. This Policy shall be inapplicable to any unsolicited information You provide Us through the Platform or through any other means.

This includes, but is not limited to, information posted in any public areas of the Platform. All unsolicited information shall be deemed to be non-confidential and the Company shall be free to use and/or disclose such unsolicited information without any limitations.

10. GOVERNING LAW AND DISPUTE RESOLUTION

This Policy shall be governed by and construed in accordance with the laws of the Republic of India. The courts at Bengaluru, Karnataka, India shall have exclusive jurisdiction in relation to any disputes arising out of or in connection with this Policy.

11. NO WAIVER

The rights and remedies available under this Policy may be exercised as often as necessary and are cumulative and not exclusive of rights or remedies provided by law. It may be waived only in writing.

Delay in exercising or non-exercise of any such right or remedy does not constitute a waiver of that right or remedy, or any other right or remedy.

12. CONTACT US

If You require any information or clarification or have any grievances regarding the use of Your personal information or this Privacy Policy, you can contact us at compliant@sayyaminvestments.in.