Privacy Policy

At Mukut Finvest & Properties Private Limited ("we", "our", "us"), we value your trust and are committed to protecting your privacy. This Privacy Policy outlines how we collect, use, share, and safeguard your personal data when you interact with us through our website, mobile application, and services.

1. PURPOSE AND COMMITMENT

MUKUT FINVEST AND PROPERTIES PRIVATE LIMITED, a Private Limited Company incorporated and registered under the Companies Act, 2013, holding a license to carry on business as a Non-Banking Financial Company, having our registered office at 304, 3rd Floor, Ratan Jyoti Building 18, Rajendra Place Delhi-110008, (hereinafter referred to as "MUKUT FINVEST").

Mukut Finvest is acting as an RE (Regulated Entity) for the LSP (Lending Service Provider) named Third Unicorn Private Limited which has a DLA (Digital Lending Application) called ZeroPe. This venture is created as per the Reserve Bank of India (Digital Lending) Directions, 2025 (DOR.STR.REC.19/21.07.001/2025-26) issued on May 08, 2025. ZeroPe is solely used for the purpose of identification of borrowers and promotion and marketing of its loan product.

This Privacy Policy ("Policy") outlines how we collect, process, store and protect the personal data of our users, including borrowers, prospective borrowers and visitors (hereinafter collectively referred to as “Borrowers” or “Users”).

This Policy affirms our unwavering dedication to data privacy, confirming our alignment with:

The Digital Personal Data Protection Act, 2023 (DPDP Act, 2023)
The Information Technology Act, 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("IT Rules")
Reserve Bank of India (Digital Lending) Directions, 2025, dated May 08, 2025 (and subsequent amendments)
Other applicable laws and regulations in India.

This Policy is pertinent to all personal data that we collect, process or store and is applicable to all employees, contractors and third parties who are entrusted with the processing of this data on our behalf.

2. BORROWER'S ACKNOWLEDGEMENT AND CONSENT

i. Your Consent: By accessing or using the Platform to access all or part of our services, you expressly acknowledge, understand and consent to the collection, maintenance, usage, handling and disclosure of your information, including sensitive personal data, by Mukut Finvest in accordance with this Policy. The purpose of obtaining your consent will be clearly disclosed at each stage of your interaction with the Platform.

ii. Option to Decline: You acknowledge that you have the option not to provide or agree to the collection of certain information. However, if you choose not to agree with this Policy or do not provide necessary consent, you may not be entitled to avail the financial services offered by Mukut Finvest through the Platform.

iii. Third-Party Links: The Platform may contain links to other websites or applications. Please note that these external sites are not operated by Mukut Finvest. We strongly advise you to review the privacy policies of these third-party websites/external links. Mukut Finvest has no control over and assumes no responsibility for the content, privacy policies or practices of any third-party sites or services.

3. DATA PROTECTION PRINCIPLES (As per DPDP Act, 2023)

We strictly adhere to the following data protection principles:

i. Lawfulness, Fairness and Transparency: We are committed to processing all personal data in a lawful, fair and transparent manner. Every data processing activity is executed with your legal consent (e.g., your consent while applying for the loan and while signing the loan agreement). We maintain transparency by providing clear, accessible and understandable information about how your data is being used and ensuring your rights can be easily exercised.

ii. Purpose Limitation: We collect personal data strictly for identified, explicit and legitimate purposes related to providing loans. Data is not further processed in any manner incompatible with those purposes. We clearly inform you of these purposes at the point of collection to ensure informed consent and understanding.

iii. Data Minimization: We adhere to the principle of data minimization, ensuring that only data necessary for the intended purposes is collected and processed. This minimizes privacy risks and ensures no excessive data is retained. We continually review our processes to uphold this principle.

iv. Accuracy: Accuracy of personal data is paramount. We have mechanisms in place to ensure that inaccurate or outdated data is amended or deleted promptly. We encourage and facilitate you to update your data periodically to ensure it remains accurate and current.

v. Storage Limitation: We retain personal data for a limited period, only as long as necessary to fulfill the purposes for which the data was collected or to comply with legal, regulatory (including RBI guidelines) or policy requirements. We have established clear data retention policies and procedures to ensure data is securely deleted, anonymized or archived after the retention period.

vi. Integrity and Confidentiality: Personal data is protected by suitable security measures designed to prevent unauthorized access, alteration, disclosure or destruction. These include technological organizational and procedural measures such as encryption, access controls, masking/redaction and staff training to ensure the confidentiality and integrity of data.

4. COLLECTION OF INFORMATION

When you use the Platform, we collect and store information that you provide to us from time to time. Any data collection by us is need-based and with your prior and explicit consent.

Important Note (as per RBI Digital Lending Guidelines): Mukut Finvest does not access mobile phone resources such as file and media, contact list, call logs, telephony functions, etc. at any point in time. One-time access is taken for camera (for selfie verification) and location (for address verification) necessary for the purpose of onboarding requirements only with your explicit consent. You will be provided with an option to give or deny consent for the use of specific data, restrict disclosure to third parties, data retention and revoke consent already granted to collect your personal data. While you can browse certain parts of the Platform without revealing personal information, to avail loans and other services, you must provide us with certain necessary information. Mukut Finvest collects various types of information from and about Borrowers of the Platform, including but not limited to the following:

A. Personal Data and Information collected directly:

i. Personal Information: We do not store biometric data (e.g., fingerprints, facial scans) in systems, unless specifically allowed under extant statutory guidelines. We may be taking the following information, depending upon the type of loan you are applying:

Phone number (for all loans) and e-mail address (in some category of loans): For account creation
Address proof: If the current address/communication address is different from the Aadhar address
Payslips or/and Offer Letter and/or ITR Copy of the previous year: When the borrower is not able to provide the bank statement through the Account Aggregator ecosystem
And other details shared via application form, email or any other medium

ii. Financial Information: We collect your financial information necessary for loan assessment and disbursement, which may include:

Bank account details/Payment card details/UPI ID: For setting up mandate, refunds and transferring loan amount in certain categories of loans.
Transaction data (e.g., from bank statements): For creditworthiness assessment.
Bureau data collected from Credit Information Companies (TransUnion CIBIL Limited, Experian, CRIF High Mark and Experian).

By submitting these details, you expressly consent to the sharing of this information with third-party payment processors, payment gateways, payment aggregators and other service providers for loan processing and repayment facilitation.

B. Personal Data from Third Parties:

i. Credit Reports: When you apply for a loan, we collect your credit reports from CICs. In this regard, you:

Authorize us to request and receive your credit score/report from credit information companies.
Further understand that the purpose of this credit score/report is to enable us to make informed lending decisions effectively and enable faster processing of credit applications.

ii. PAN and Aadhar data: As a part of our onboarding process, we access your PAN and Aadhar details, after receiving your consent, from Technology Service Providers (TSP):

PAN: Pan number, DOB and Full name
Aadhar: Masked Aadhar number, DOB, Full name, Address, Photograph and Gender

iii. Bank Statement: We use third parties to seek your bank statement after seeking your informed consent

5. USE OF BORROWERS' INFORMATION

By submitting your information to Mukut Finvest, you expressly acknowledge and consent to the use of such information in a manner specified under this Policy and consistent with the DPDP Act, 2023 and RBI Digital Lending Guidelines.

Your information may be used for various purposes including, but not limited to, the following: i. Verifying your identity and conducting KYC. ii. Facilitating your usage of the services. iii. To obtain credit reports and evaluate your creditworthiness for availing loans from Mukut Finvest. iv. For the extension, disbursement and management of loans and financial services. v. To ensure compliance with all legal obligations of Mukut Finvest, including Know-Your-Customer (KYC), Prevention of Money Laundering (PMLA), Aadhar Act (2016) and CKYC requirements. vi. For fraud prevention and detection. vii. To send you surveys and marketing communications that Mukut Finvest believes may be of your interest (only with your explicit consent where required). viii. To analyze, conduct internal reviews, surveys and understand user preferences to improve the content and features of our services. ix. To prepare reports, conduct reviews and file as per applicable laws and regulatory requirements. x. To increase/improve the products/services offered by Mukut Finvest on the Platform.

6. DISCLOSURE OF INFORMATION

We will share your information with third parties to facilitate the provisioning of services by us to you only in such manner as described below, ensuring adequate safeguards as per the DPDP Act, 2023 and RBI Digital Lending Guidelines.

i. Third-Party Service Providers: We may disclose your information to our third-party service providers (Data Processors) for providing the Services as detailed under the Terms & Conditions (e.g., payment gateways, payment aggregators, credit bureaus, collection agencies and KYC TSPs). Such sharing will only be under a valid contract that ensures the Data Processor adheres to our data protection and privacy requisites and the provisions of the DPDP Act, 2023. ii. Legal and Regulatory Requirements: We may disclose your information, without prior notice, if required under any law, regulation (including RBI guidelines) or if we are under a duty to do so in order to comply with any legal obligation, a court order, government directive or an order from a statutory authority. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction. iii. Corporate Transactions: We may share your information with another business entity should we (or our assets) merge with or be acquired by that business entity or during re-organization, amalgamation or restructuring of business for continuity of business. In such cases, the acquiring entity will be bound by this Privacy Policy or a similar privacy policy that offers an equivalent level of protection for your personal data.

Except as required under applicable laws or pursuant to a court/government order, any information or data shared by us with third parties shall be disclosed pursuant to a confidentiality agreement which, inter alia, restricts such third parties from using the said data only for the purpose of provisioning the services to us to enable us to provide services to you and also restricts further disclosure of the information unless such disclosure is for the purpose as detailed under that confidentiality agreement.

8. THIRD PARTIES WITH WHOM INFORMATION IS SHARED

We may share your information with the following categories of third parties in connection with the loan applied/sanctioned. This list is illustrative and may be updated from time to time. We ensure that any third party with whom your data is shared adheres to data protection standards equivalent to those prescribed by the DPDP Act, 2023 and RBI Digital Lending Guidelines.

Credit Information Companies (CICs): For credit score inquiries and submission of your loan performance (TransUnion CIBIL, Experian, CRIF High Mark and Equifax).
KYC and Verification Service Providers: For digital KYC, Aadhaar-based e-sign, PAN verification, Offline Aadhar KYC, CKYC search and ID details, passive liveness of image check, face match, name and address verification (Signzy and Decentro).
Payment and Banking Partners: For bank verification via penny drop, e-mandate registration, payment links, loan disbursements and collection services (Razorpay and Yes Bank).
Bank Statements: For bank statements and consent-based bank statement evaluation/monitoring (Signzy and Account Aggregators – Finvu, NADL, OneMoney, Saafe and others).
SMS and Communication Gateways: For sending SMS and WhatsApp communications for EMI reminder and the rest (Gupshup Technology India Private Limited and Surepass Technologies Private Limited).
Logging and Push Notification Services: (e.g., Firebase (Google services)).
Cloud Service Providers: For secure data storage and email services (e.g., Amazon Web Services, Inc.).
Collection Services: (Third Unicorn Private Limited).

9. DATA PROTECTION, RETENTION and STORAGE

Pursuant to the DPDP Act, 2023, IT Act, 2000, IT Rules, 2011 and RBI Guidelines on Digital Lending, Mukut Finvest endeavors to protect your sensitive personal and personal information and data.

i. Data Retention: We shall store your information and/or data for such period as may be required by Mukut Finvest to (i) enforce its legal rights and obligations against you; (ii) to ensure compliance with its obligations and responsibilities under applicable laws in the capacity of an NBFC regulated by the Reserve Bank of India. You understand and agree that repayment of a loan/financial facility does not automatically rescind the consents you have provided to us under this Privacy Policy, nor does deletion of your account with the Platform, particularly where retention is necessary for compliance with any law for the time being in force (e.g., PMLA, RBI guidelines). Unless retention is necessary for compliance with any law, we shall: a. Erase personal data upon you withdrawing your consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier. b. Cause our Data Processors to erase any personal data that was made available by Mukut Finvest for processing to such Data Processor. c. The purpose shall be deemed to no longer be served if you do not approach Mukut Finvest for the performance of the specified purpose and do not exercise any of your rights in relation to such processing, for such time period as may be prescribed by the DPDP Act rules.

ii. Storage Location: We store and process your personal information on secure cloud servers located within India, as mandated by RBI Digital Lending Guidelines.

iii. Security Safeguards: We use reasonable safeguards to preserve the integrity and security of your information against loss, theft, unauthorized access, disclosure, reproduction, use or amendment.

iv. Data Deletion/Anonymization: Upon completion of the retention period for each category of personal data as described above, we shall delete or destroy, to the extent technically possible, personal data in our possession or control or render the personal data into anonymized data, so that it no longer constitutes personal data. All other details will be deleted or rendered into anonymized data upon the request of the customer for the deletion of the data, provided there is no active loan or service being availed by you. However, in some instances, we will be unable to facilitate requests for the deletion of your data in compliance with legal obligations or in accordance with applicable laws, which may require us to store data for longer periods of time.

10. DATA PRINCIPAL RIGHTS (As per DPDP Act, 2023)

We respect your rights as a Data Principal and have mechanisms in place to facilitate their exercise:

i. Right to Access Information about Personal Data (Section 11): You have the right to obtain from Mukut Finvest, upon making a request in the prescribed manner: a. A summary of personal data being processed by us and the processing activities undertaken. b. The identities of all other Data Fiduciaries and Data Processors with whom your personal data has been shared, along with a description of the data shared. c. Any other information related to your personal data and its processing, as may be prescribed. Note: This right may not apply in cases of data sharing authorized by law for prevention, detection, investigation of offences or for prosecution/punishment of offences.

ii. Right to Correction and Erasure of Personal Data (Section 12): You have the right to correct, complete, update and erase your personal data. Upon receiving a request for correction, completion or updating, we will: a. Correct inaccurate or misleading personal data. b. Complete incomplete personal data. c. Update the personal data. Upon receiving a request for erasure, we shall erase your personal data unless retention is necessary for the specified purpose or for compliance with any law.

iii. Right of Grievance Redressal (Section 13): You have the right to have readily available means of grievance redressal provided by Mukut Finvest. We shall respond to your grievances within such period as may be prescribed from the date of its receipt. You shall exhaust the opportunity of redressing your grievance under this section before approaching the Data Protection Board of India.

iv. Right to Nominate (Section 14): You have the right to nominate any other individual, who shall, in the event of your death or incapacity, exercise your rights as a Data Principal in accordance with the provisions of the DPDP Act, 2023. "Incapacity" means inability to exercise your rights due to unsoundness of mind or infirmity of body.

11. DUTIES OF DATA PRINCIPAL (As per DPDP Act, 2023)

As a Data Principal, you also have certain duties: i. To comply with the provisions of all applicable laws while exercising your rights under the DPDP Act. ii. To ensure not to impersonate another person while providing your personal data for a specified purpose. iii. To ensure not to suppress any material information while providing your personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities. iv. To ensure not to register a false or frivolous grievance or complaint with Mukut Finvest or the Data Protection Board of India. v. To furnish only such information as is verifiably authentic, while exercising the right to correction or erasure.

12. OBLIGATIONS OF SIGNIFICANT DATA FIDUCIARY (if applicable)

Mukut Finvest acknowledges that the Central Government may notify it as a "Significant Data Fiduciary" based on factors such as volume and sensitivity of personal data processed, risk to Data Principal rights and potential impact on India's sovereignty. If classified as such, Mukut Finvest will comply with additional obligations, including: i. Appointment of a Data Protection Officer (DPO): Who shall be based in India, responsible to the Board of Directors and be the point of contact for grievance redressal. ii. Appointment of an Independent Data Auditor: To carry out data audits and evaluate compliance with the DPDP Act. iii. Periodic Data Protection Impact Assessments (DPIA): To assess and manage risks to Data Principals' rights. iv. Periodic Audits: To ensure ongoing compliance.

16. TRAINING AND AWARENESS

Employees receive periodic training as per the information security and privacy awareness policy and we foster awareness regarding data privacy and protection throughout the organization.

18. REVIEW AND REVISION

This Policy is subject to annual review or updates upon significant changes in data processing activities or relevant laws and regulations. In case of any material changes to the Policy, you will be notified by means of a notice on the Platform prior to the change becoming effective. You are encouraged to periodically review this page for the latest information on Mukut Finvest’s privacy practices.

19. GOVERNING LAW AND DISPUTE RESOLUTION

This Policy shall be governed by and construed in accordance with the laws of India. Any matter/dispute arising from this Policy shall be subject to the exclusive jurisdiction of the courts in Delhi.

20. DISCLAIMER

Neither Mukut Finvest nor any of its contractors, partners or employees shall be liable for any direct, incidental, consequential, indirect or punitive damages arising out of access to or use of our services. Further, Mukut Finvest is not liable for any kind of damages, losses or action arising directly or indirectly due to your use of our services or any part thereof, save and except for any breaches arising directly from our failure to comply with this Policy and applicable laws.

21. GRIEVANCE REDRESSAL OFFICER / CONTACT INFORMATION

In accordance with the relevant provisions of the Information Technology Act, 2000 and Rules made thereunder and the DPDP Act, 2023, Mukut Finvest has designated a Grievance Redressal Officer. For any queries, concerns, complaints or to exercise your rights regarding the handling, storage or disclosure of your Personal Data, you can contact:

Grievance Officer Name: Shubham Jain Email address: grievance@mukutfinvest.com Customer Service Helpline: +91 11 4248 1577

The Grievance Officer can be contacted between 11:00 a.m. to 5:00 p.m. from Monday to Friday, except on public holidays.

22. CONCLUSION

Mukut Finvest is committed to upholding the highest standards of data privacy and security, with continuous improvements to align with legal and regulatory requirements and industry best practices. Your trust and privacy are paramount to us.