This Privacy Policy explains how we collect, use, store, process, disclose, and safeguard your personal and sensitive personal data in compliance with:

• Section 43A of the Information Technology Act, 2000
• IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Digital Personal Data Protection Act, 2023 (DPDP)
• RBI Digital Lending Guidelines, 2025, and other applicable Indian laws

Personal information refers to any data that pertains to an individual and can directly or indirectly identify that person, either on its own or in conjunction with other information we have or may have access to.

Sensitive Personal Information includes any personal details relating to financial data such as bank accounts, financial history, credit history, credit or debit card details, passwords, biometric data, sexual orientation, physical, physiological, and mental health conditions, as well as medical records and history.

Below are the categories of Personal Information and Sensitive Personal Information that we may collect about you:

• Identity and Account Login Information: Includes full name(s), title, age, user ID, gender, and date of birth
• Contact Information: Personal details such as bank account numbers, e-NACH, NEFT, IMPS, and UPI ID details, credit or debit card information (including card number, type, expiry date, and cardholder name), financial history, credit history, salary, and income details
• Identification Information: KYC documents, proofs of identity and address, photograph, PAN (Permanent Account Number), GST Number, etc.
• Payment Information (Transactional Information): Details like payment gateway ID, issuing bank name, merchant details, product or service identifiers, payment mode, transaction date, currency, amount, transaction status
• Usage and Technical Information: IP addresses, device/browser type, versions/configurations, operating systems, device brand/model, time zone settings, geo-location data, content accessed, unique identifiers associated with your device(s)
• Credit and Lending Information: Credit-related details, income information, employment contract, salary details, employer name, income tax returns, bank statements, income statements, balance sheets, cash flow statements, credit scores
• Marketing and Communications Information: Customer service communications, behavioural data, details about promotions, surveys, promotional campaigns
• Device/Phone Data: SMS data, camera usage, microphone usage, location data, media/files, or other device facilities used for onboarding/KYC purposes related to loan or credit applications

We collect your Personal Information through various methods:

Direct Collection from You:

• Providing your Contact Information for communication about our services and products
• Entering into a contract or verifying your identity through email, phone, or electronic means
• Submitting your Personal Information on our Apps, Websites, Platforms to register for our services
• Applying for our products or services, either directly or through business partners
• Participating in competitions, promotions, or surveys
• Sending support requests for our products or services

Collection from Third Parties:

• Receiving information from merchants, banks, payment partners, credit information companies
• Obtaining information from group entities or independent third parties for credit checks
• Collecting data from social platforms and networks when you grant permission
• Acquiring information from financial institutions and fraud prevention agencies
• Receiving credit information from companies like TransUnion, CIBIL Limited
• Collecting data from publicly available sources in compliance with applicable Indian laws

Our mobile application requires certain permissions to function effectively and provide you with our services:

• SMS: We may read the headers of all SMS to check the type of sender. We only read the indicative SMS content from 6-digit alpha numerical number for verification purposes. We do not read or analyze personal or OTP messages, except OTP messages sent by us. This data may be used to verify financial statistics such as income, spending patterns which help us in credit evaluation and fraud detection & prevention.
• Apps: We collect metadata about installed and system applications on your device—including application name, package name, install/update time, installer source, version name, and version code. The data is securely uploaded to our trusted device intelligence partner, Credeau (via https://devicesync.credeau.com) to support identity verification, fraud detection, underwriting, and offering tailored credit limits.
• Location: Fatafatloan seeks one time permission to collect and monitor the information about the location of customers device to provide serviceability of loan application, to reduce risk associated with the loan application and to provide pre-approved customized loan offers.
• Device: Fatafatloan collects limited device-related information to enhance user safety, prevent fraud, and ensure secure digital lending operations. This may include details such as device model, operating system version, available RAM/storage. We do not collect permanently identifiable information such as IMEI or serial numbers.
• Phone State: Fatafatloan requests Phone State permission strictly to verify the devices active SIM and network status at the time of onboarding and disbursement, helping us ensure that the transaction corresponds to the rightful customer and is not spoofed.
• Camera: Camera access is required for completing eKYC. This allows you to scan or capture identification details and documents digitally, making the process faster and reducing manual errors.

We do not collect or store biometric data. Fatafatloan App is hosted in India and we ensure that every data or information that we collect from you is stored in servers located in India in compliance with all statutory/regulatory obligations.

We process your Personal Information, including Sensitive Personal Information, for the following purposes:

• Verification and Authentication: To verify, authenticate, and authorize your use of our products or services, including creating login credentials, establishing account-based relationships, conducting KYC evaluations, and performing risk assessments
• Transaction Processing: To provide products or services, collect specific Personal Information for credit and repayment transactions
• Service Provision: To deliver the products or services offered by us, our group companies, or business partners, and improve your experience on our platforms
• Internal Risk Assessments and Analysis: For risk assessments, KYC checks, service improvements, fraud reduction, and risk model development
• Business Protection and Legal Compliance: To comply with applicable laws, regulations, standards, and codes, protect against identity theft and fraud, and fulfill reporting obligations
• Relationship Management: To inform you about our products or services, notify you of service interruptions, request feedback, and provide customer support
• Marketing: To market our products and services, including those of our business partners, inform you about events, offers, and campaigns
• Research and Development: For research to gain market insights and develop technologies, products, and services using machine learning and artificial intelligence techniques

We may share your Personal Information, including Sensitive Personal Information, in the following scenarios:

• Support and Technical Services with business partners, third parties, and service providers
• Research and Analytics to contribute to research, data analytics, and studies
• Product and Service Offerings to offer you products and services from our partners
• Phone Data Sharing with Partner Lenders to assess your eligibility for loans or credit facilities
• Credit Information Sharing for evaluating applications, conducting credit assessments, onboarding, and due diligence
• Other Third Parties and Financial Institutions to enable marketing and understand usage patterns
• CKYC (Central KYC Registry) as required by Indian law
• Authorized Financial Institutions and Banking Partners for collaboration
• Third-Party Service Providers or Vendors for business operations, KYC processes, eligibility checks
• Legal and Regulatory Requirements when required by law enforcement, government officials, or court orders
• Mergers and Acquisitions with companies we plan to merge with or be acquired by

Fatafatloan may share information with individuals and body corporate in the course of normal business operations. We share your information only with regulated partners and third parties under strict confidentiality agreements.

Your personal data is shared only with: Regulated lending partners (Banks/NBFCs), Credit Information Companies (e.g., CIBIL, Experian), Third-party service providers (e.g., e-KYC, e-sign, payment gateways, alternate data providers), and Government/regulatory bodies as mandated by law (e.g., RBI, tax authorities, law enforcement).

We will not voluntarily disclose your personal information to any non-connected third party but may do so if required by court order, Government Authorities, law enforcement authorities, statutory authorities or other legal processes.

The list of third parties collecting Information through the App is available on our website (https://www.fatafatloans.com/thirdparties), which will be updated from time to time, for your reference.

You may receive marketing communications from Fatafatloan or other business partners or third parties about products and services. These communications may come via messages, email, or other digital modes on Platforms, Websites, Apps, or social media platforms.

You have the right to opt-out of receiving such marketing communications by clicking the opt-out link (if available), unsubscribing through the provided link, or writing to us at help@fatafatloans.com.

Fatafat loan shall not retain personal information longer than is necessary to fulfil the purposes for which it was collected and as permitted by applicable law. However, the Lending partners will retain your personal information as needed during the tenure of loan and even after termination of account to comply with our legal and regulatory obligations, resolve disputes, conclude any activities related to the cancellation of an account, investigate, or prevent fraud and other inappropriate activity, enforce our agreements, and for other business reasons.
Your data may also be retained temporarily in backup systems to ensure disaster recovery, system restoration, or legal hold purposes, although access will be restricted, and deletion will be scheduled in accordance with our internal retention protocols.
By continuing to use our services, you agree to this data retention policy. You may contact our Grievance Officer at any time to exercise your right to access, correct, or request deletion of your personal data.
Grievance Redressal Officer: Mr. Romel Kumar
Mobile: +91 9589393499
Email: romelkumar@fatafatloan.com

For more information on this, please visit https://www.fatafatloans.com/account-deletion.

We are committed to enabling you to exercise your privacy rights under applicable laws and our internal policies. You can exercise the following rights:

• Review, Correct, or Rectify: You can request that we review, correct, or change any inaccurate Personal Information we process about you
• Right to Access: You may request a record of your Personal Information that we are processing, upon verification of your identity

To exercise any of the above rights, please submit a request at help@fatafatloans.com

Please note that you do not have an unqualified right to delete your Personal Information under applicable laws. If you wish to delete your Personal Information, you will need to cease using the loan or credit facility immediately and settle all outstanding dues related to the loan or credit facility provided by Fatafatloan or its Partner Lenders.

If you wish to revoke or withdraw your consent to collect, store, use, process, or share any Personal Information, please inform Fatafatloan by writing to help@fatafatloans.com and immediately cease using the loan or credit facility. You must also settle all outstanding dues related to the loan or credit facility.

We prioritize the security of your Personal Information and Sensitive Personal Information. We implement a range of physical, technical, managerial, and operational measures designed to protect the integrity and security of the information we collect and maintain, as required by applicable laws. All Personal Information and Sensitive Personal Information are stored on servers located in India.

Fatafatloan routinely reviews its policies on the collection, storage, and processing of your Personal Information. We have procedures in place to address any breaches of Personal Information and will notify you, along with any relevant regulators or authorities, if required by law.

Fatafatloan does not intentionally collect, use, or disclose Personal Information of minors, according to the minimum age equivalent in the relevant jurisdiction, without prior consent from a parent or guardian. Our services are not designed to attract minors. If we discover that we have inadvertently collected Personal Information from a minor without verifiable parental consent, we will take reasonable steps to delete that information in accordance with applicable Indian laws as soon as possible.

The Fatafatloan Privacy Statement may be updated or amended over time. The most current version of this Privacy Policy will be published on our Website, App, or Platform, as applicable. We encourage you to periodically review this page to stay informed about any changes.

By continuing to use our services after any amendments, you accept the revised Privacy Statement. If you disagree with the terms of the updated Privacy Statement, you should stop using our services and notify us. It is crucial that the Personal Information and Sensitive Personal Information we have about you is accurate and up to date.

By submitting your data to us or our agent, or by using the Website or App, you consent to our use of your data in the manner and for the purposes described in this Privacy Policy.