1. Introduction
This Privacy Policy explains what we do with your personal data when you visit our platform, website or landing page, when your organisation registers as a member with us, and when we provide services to your organisation through our platform.
It describes how we collect, use and process your personal data, and how we comply with our legal obligations to you, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("the Sensitive Information Rules") and, where applicable, the GDPR. The company responsible for your personal data is Finexa Capital.
If you agree to the collection and use of Sensitive Personal Data or Information (SPDI) as set out here, you provide your consent by digitally accepting the terms of this Privacy Policy and Finexa Capital's Borrower Consent. If you do not agree, Finexa Capital may not be in a position to process your loan application.
2. What kind of personal information do we collect?
If your organisation registers to use the Services, we collect information about you or individuals at your organisation in relation to your loan application. This is likely to include Sensitive Personal Data or Information (SPDI) under the Sensitive Information Rules, including some or all of:
- Names, and business activities, of directors, executives or founders of your organisation
- Your name, telephone number, email address and IP address
- KYC documents, income tax filings and GST filings
- Financial accounts and bank statements
- Bureau score, where available
3. How we collect your personal data
We collect personal data in two primary ways.
Data you give to us
Where your organisation registers with our platform, or uploads information about itself to our platform.
Data we receive from other sources
We may seek further information about your organisation from other sources, generally by way of due diligence or market intelligence, including research and analysis of your organisation's filed accounts.
4. Why we use your personal data
- To carry out our obligations under any contract entered into between us and you or your organisation
- To provide the analysis and reports requested by you or your organisation
- To verify your identity and protect against unauthorised use and access of the platform
- To better understand your preferences and tailor suggestions for your lending or financing needs
- To improve your experience of using our platform
- To notify you about, and market, our products and services, including by email, phone, SMS or post
- To administer our platform, including troubleshooting, testing, research and statistical analysis
- To assess your suitability for a loan: conducting a credit assessment, and complying with Finexa Capital's and any potential lender's KYC and documentation requirements
- For market research purposes, and to customise the platform to your interests
5. Who do we share your personal data with?
Unless you specify otherwise, we may share your information with:
- Lenders who will consider your loan application, and borrowers who may be given a lender contact's details
- Members of our group company, where necessary for credit assessment or otherwise, and in accordance with data transfer laws
- Tax, audit or other authorities, where the law requires it
- Third-party service providers performing functions on our behalf: auditors, accountants, technical support and IT consultants
- Outsourced IT providers, under an appropriate data processing agreement
- Other third parties associated with you who may wish to market related products or services
- A new owner, should Finexa Capital merge with or be acquired by another business, with notice to you
6. How do we safeguard your personal data?
We take all reasonable and appropriate steps to protect the personal information we hold from misuse, loss or unauthorised access, through technical and organisational measures including encryption and disaster-recovery planning.
If you suspect any misuse, loss of, or unauthorised access to your personal information, contact us immediately at info@finexacapital.com and we will investigate and update you on next steps.
7. How long do we keep your personal data for?
We do not keep your personal data longer than necessary for the purpose it was collected, unless the law requires us to preserve it. When retention is no longer necessary, we delete the data from our systems; where some data may persist briefly pending overwrite, it is put beyond use and our employees do not access or use it again.
8. What are my rights?
You have the following rights over the data we hold about you. To exercise any of them, contact info@finexacapital.com. We respond without undue delay, and within one month subject to lawful extensions.
- Right to object to processing based on our legitimate interests, public-interest tasks, direct marketing, or research and statistical purposes
- Right to withdraw consent at any time, for activities such as marketing, where consent was our legal basis
- Right of access to a copy of the information we hold about you, generally free of charge
- Right to erasure where the data is no longer necessary, consent is withdrawn, processing was unlawful, or you object and we cannot show overriding grounds
- Right to restrict processing, for example while you dispute the accuracy of your data
- Right to rectification of inaccurate or incomplete personal data
- Right to data portability, to receive your data in a machine-readable format or have it transferred directly
- Right to complain to your local supervisory authority, or directly to Finexa Capital
9. Who is responsible for processing your personal data?
Finexa Capital is responsible for processing your personal data. Finexa Capital is located at Office No 250, The Boulevard, Near Pratham Circle, Pal, Surat 395009. Your information is stored via secure database by Finexa Capital and/or its affiliated technology partners.
10. How do we store and transfer your data internationally?
Data we collect may be stored and transferred both within and outside India, including the European Economic Area (EEA). We only transfer data outside India where compliant with applicable data protection legislation and where adequate safeguards apply, for example standard contractual clauses, an equivalent cross-border framework, a jurisdiction found adequate by the European Commission, or your explicit consent. Where a destination does not maintain adequate protection standards, we take all reasonable steps to keep your data secure and treated in line with this policy.
11. Legal bases for processing your data
Legitimate interests
Including internal platform administration, understanding you better to provide relevant services, keeping our systems secure, and driving commercial value, balanced against not causing you unwarranted prejudice.
Your consent
Sought when you register with our platform: given freely, informed, one matter at a time, and through a clear affirmative action. You may withdraw consent at any time.
Performance of our contract with you
For example, holding your email address so we can send you reports and analysis you have requested.
By using our platform or submitting an enquiry, you acknowledge that you have read and understood this Privacy Policy, and consent to your information, including any SPDI, being collected, handled and stored as set out here.