This Privacy Policy (“Policy”) is prepared in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Guidelines on Digital Lending issued by the Reserve Bank of India (RBI), 2022, and other applicable laws and regulations. It explains how We collect, use, store, share, and protect information about individuals (“You”, “Your”, “User”) who visit or use Our Platform (defined below), and describes the rights and choices available to You.

Birmecha Securities Pvt. Ltd., a Non‑Banking Financial Company (NBFC) registered with the Reserve Bank of India (“RBI”), together with its affiliates, successors, and assigns (collectively “Birmecha Securities”, “We”, “Us”, or “Our”), is committed to protecting Your information in accordance with this Policy and applicable RBI directions.

Birmecha Securities owns and operates the website available at https://birmechasecurities.com and the mobile application titled “Finotive” (together, the “Platform”), through which We offer Our regulated lending and allied services.

This Policy is a legally binding agreement between You, as a User of the Platform, and Birmecha Securities, as the owner and RBI‑registered NBFC operating the Platform. The term “User” includes any person who visits, uses, or transacts on the Platform. You may use the Services on the Platform only if You are a natural person, an Indian citizen, and at least twenty‑one (21) years of age, and otherwise competent to contract under applicable law.

This Policy supersedes all prior communications on the subject. It does not apply to any third‑party websites, applications, or app stores that may be linked to or from the Platform, including the stores from which You download the Birmecha Securities mobile application. You are encouraged to carefully review the terms and conditions and privacy policies of such third parties before using them. Birmecha Securities does not control and is not responsible for the practices, omissions, or content of any third‑party websites, applications, or stores.

By accessing or using the Platform and voluntarily providing information (including personal and sensitive personal data), You acknowledge that Birmecha Securities is an RBI‑registered NBFC and expressly consent to the collection, use, storage, and disclosure of such information in accordance with this Policy and applicable law.

IF YOU DO NOT AGREE WITH THE TERMS OF THIS POLICY, OR DO NOT WISH YOUR INFORMATION TO BE PROCESSED AS DESCRIBED HEREIN, PLEASE DO NOT ACCESS OR USE THE PLATFORM.

This Policy is enforceable against You in the same manner as any other written and signed agreement.

We may amend or update this Policy at any time to reflect changes in legal or regulatory requirements (including RBI directions) or in Our practices. You should periodically review this Policy to stay informed about Our current privacy practices. Any changes will be effective when posted on the Platform. Your continued use of the Services after any update constitutes Your acceptance of the revised Policy.

1. Services

Birmecha Securities is engaged in various business activities, including providing the following services (“Services”):

• Digital Lending: Offering fully digital, paperless personal and business loans through the Platform, including onboarding, eligibility assessment, underwriting, documentation, disbursal, and repayment management.
• Credit Evaluation and Risk Assessment: Assessing Your creditworthiness using information You provide, information obtained from credit bureaus, and other lawful data sources, in line with applicable RBI guidelines.
• Loan Servicing and Collections: Managing Your loan account throughout its lifecycle, including repayment tracking, reminders, statements, refunds (where applicable), restructuring (if offered), and closure.
• Customer Support: Providing assistance related to applications, KYC, disbursals, repayments, grievances, and general queries through phone, email, in‑app chat, or any other support channels made available on the Platform.
• Value‑Added and Ancillary Services: Facilitating or enabling services related to credit, such as financial literacy content, repayment planning tools, offers, rewards, and any other allied services that may be introduced from time to time.
• Regulatory and Compliance‑Related Activities: Performing activities necessary to comply with applicable laws, RBI directions, and contractual obligations, including KYC verification, reporting to regulators, and fraud prevention measures.

Any new product, feature, or functionality introduced on the Platform that relates to or supports the above activities will also form part of the Services and will be governed by this Policy, as may be updated from time to time.

2. Information We Collect

When You access or use the Platform, We may collect, receive, and process different types of information about You. The information We collect depends on how You interact with the Platform and the Services You choose to use. Broadly, We collect the following categories of information:

• Information You Provide Directly:
  • Basic details such as Your name, date of birth, gender, residential and mailing address, email address, mobile number, and other contact information.
  • Identity and KYC information, including PAN, Aadhaar or other officially valid documents (OVDs), photographs, and any documents or details submitted for verification, onboarding, or regulatory compliance.
  • Employment, income, and financial details that You share while applying for or availing any loan or related Services, such as occupation, employer details, salary, business information, and bank statements.
  • Information and documents submitted through forms, uploads, in‑app fields, or during interactions with Our customer support (including call recordings, emails, and chat transcripts, where permitted by law).
• Information Collected Automatically:
  • Technical data related to Your device and connection such as device type, operating system, browser type, device identifiers, IP address, language settings, network information, and app version.
  • Usage information about how You interact with the Platform, including pages viewed, features used, time spent, dates and times of access, clicks, and other diagnostic or analytical data generated through cookies, SDKs, pixels, and similar technologies.
  • Performance and crash data, logs, and related diagnostics that help Us maintain, secure, and improve the Platform.
• Information from Third Parties and Public Sources:
  • Credit‑related information obtained from credit information companies / credit bureaus and other regulated entities, in accordance with applicable law and with Your consent, for assessing eligibility, underwriting, and ongoing credit monitoring.
  • KYC, identity, and verification information received from authorised KYC agencies, payment partners, banks, or other regulated intermediaries to comply with RBI directions and other legal requirements.
  • Information received from service providers, business partners, or referral partners (for example, lead‑generation partners or financial marketplaces) where You have consented to such sharing.
  • Information available from publicly accessible sources, government databases, or regulators, where permitted by law and necessary for providing the Services or for compliance and fraud‑prevention purposes.
• Sensitive Personal Data or Information:

  For certain Services, We may collect “sensitive personal data or information” as defined under applicable law (such as financial information, passwords, or authentication details), strictly for lawful purposes connected with a function or activity of Birmecha Securities and only with Your express consent, wherever required.

We limit the collection of information to what is necessary for specified, lawful purposes in connection with the Services and for compliance with applicable laws and RBI directions. Where required, We will obtain Your specific consent before accessing or collecting particular data elements, and You may withdraw such consent in the manner described in this Policy, subject to legal and contractual restrictions.

3. How We Use Your Information

We process the information described above only for lawful, specific, and limited purposes connected with Our business as an RBI‑regulated NBFC. In particular, We may use Your information for the following purposes:

• Providing and Operating the Services: To register You on the Platform, create and maintain Your user profile, process loan applications, perform credit appraisal, underwrite and sanction loans, execute loan and related documentation, disburse funds, and service Your loan or other products availed through the Platform.
• KYC, Verification, and Compliance: To verify Your identity and contact details, carry out KYC and other due‑diligence checks, confirm eligibility under internal policies and RBI directions, detect and prevent fraud, and comply with legal, regulatory, and reporting requirements.
• Credit Assessment and Monitoring: To obtain and analyse credit information, determine credit limits and pricing, monitor repayment behaviour, manage portfolio risk, and make decisions on renewal, top‑ups, restructuring, or other credit actions in accordance with applicable law.
• Communication and Support: To contact You (through SMS, calls, emails, in‑app notifications, or other channels) regarding application status, KYC, disbursals, repayments, reminders, alerts, security notices, account statements, and to respond to queries, requests, or grievances raised by You.
• Improvement, Research, and Analytics: To understand how the Platform is used, diagnose technical issues, enhance security and performance, improve user experience, develop new products or features, and perform analytics, modelling, and other internal research (using de‑identified or aggregated data where feasible).
• Personalisation and Offers: To present content, products, and features that are more relevant to You, and to inform You (where permitted by law and with appropriate consent) about offers, rewards, promotions, or value‑added services from Us or Our partners that may be of interest.
• Legal, Regulatory, and Contractual Purposes: To enforce Our terms and policies, manage disputes, recover dues, cooperate with lawful investigations, meet obligations to regulators, auditors, or other authorities, and protect the rights, property, and safety of Birmecha Securities, Our Users, and the public.

Where We rely on consent as the basis for processing specific categories of information (including sensitive personal data or information), You may withdraw such consent at any time by contacting Us through the channels specified in this Policy. However, withdrawal of consent may affect Your ability to use some or all of the Services, and We may be required to retain certain information to comply with legal or regulatory obligations.

4. How We Share Your Information

We do not sell, rent, or trade Your personal information to third parties. However, We may share Your information with certain categories of third parties in the following circumstances:

• Group Companies and Affiliates: We may share Your information with Our holding company, subsidiaries, associates, or other group entities that support Us in providing the Services, complying with regulations, or offering related products, subject to appropriate contractual safeguards.
• Service Providers and Partners: We may share information with third‑party vendors, technology providers, analytics partners, payment aggregators, banks, collection partners, customer support providers, and other entities that process data on Our behalf for purposes such as KYC, underwriting, disbursal, payments, communications, and operational support. Such parties are required to use the information only in accordance with Our instructions and applicable law.
• Banks, Financial Institutions, and Credit Bureaus: We may share information with partner banks, NBFCs, financial institutions, and credit information companies for assessing Your creditworthiness, reporting repayment behaviour, complying with contractual arrangements, and meeting regulatory requirements prescribed by RBI and other authorities.
• Regulators, Law Enforcement, and Authorities: We may disclose information to RBI, other regulators, governmental or judicial authorities, law‑enforcement agencies, or authorised third parties when required by law, regulation, legal process, or to respond to valid requests in connection with investigations, enforcement, or regulatory reporting.
• Professional Advisors: We may share limited information with Our auditors, legal counsel, consultants, or other professional advisors who are bound by confidentiality obligations and who need the information to provide services to Us.
• Business Transfers: In connection with any merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction involving Birmecha Securities, Your information may be transferred to another entity, subject to such entity continuing to comply with applicable privacy and data‑protection requirements.
• With Your Consent: We may share information with any other third party when You explicitly authorise or consent to such sharing, including where You choose to access a third‑party service or offer through the Platform.

Whenever We share Your information with third parties, We endeavour to ensure that such sharing is limited to what is necessary for the relevant purpose, is done under appropriate contractual and security safeguards, and is in line with applicable laws and RBI directions.

5. Data Security and Retention

We implement commercially reasonable technical and organisational measures, consistent with applicable law and RBI directions, to protect Your information against unauthorised access, alteration, disclosure, or destruction. These measures include, where appropriate, encryption, access controls on a need‑to‑know basis, secure storage, firewalls, regular monitoring, and internal policies on data handling and confidentiality.

While We strive to use industry‑standard safeguards, no method of transmission over the Internet or method of electronic storage is completely secure. Accordingly, We cannot guarantee absolute security of Your information and You understand that You share information with Us at Your own risk. You are also responsible for maintaining the security of Your devices, login credentials, OTPs, and any other authentication factors used to access the Platform.

We retain Your information only for as long as necessary to fulfil the purposes outlined in this Policy, to provide the Services, to comply with legal, regulatory, accounting, or reporting obligations (including those prescribed by RBI and other authorities), to resolve disputes, and to enforce Our agreements. The specific retention period may vary depending on the nature of the information and the requirements of applicable law.

Once information is no longer required for the purposes stated above, We will delete, anonymise, or aggregate it in a manner that does not personally identify You, unless retention is required or permitted for a longer period by applicable law, regulation, or legitimate business needs.

6. Your Rights and Choices

Subject to applicable law, You may exercise the following rights in relation to Your information that We hold:

• Access and Review: You may request details of the information that We hold about You and seek a copy of certain information, subject to reasonable limitations and verification of Your identity.
• Correction and Updating: You may request that inaccurate, incomplete, or outdated information be corrected or updated. We may seek supporting documents before making certain changes (for example, to KYC details).
• Withdrawal of Consent: Where processing is based on Your consent (including for specific sensitive personal data or information or for marketing communications), You may withdraw such consent at any time. This will not affect prior processing, but may impact Your ability to use some or all of the Services.
• Restriction and Objection: In limited circumstances permitted under law, You may request that We restrict certain processing activities or object to specific uses of Your information, subject to Our legal and contractual obligations.
• Deletion: You may request deletion of certain information, subject to Our need to retain it for legal, regulatory, accounting, dispute‑resolution, or legitimate business purposes as permitted under applicable law and RBI directions.
• Managing Communications: You may opt out of receiving non‑essential marketing or promotional communications from Us by following the instructions in such communications or by contacting Us. However, We may still send You important transactional or service‑related messages.

To exercise any of the above rights or to raise questions about this Policy, You may contact Us using the details provided in the “Contact Us / Grievance Redressal” section of the Platform. We may take reasonable steps to verify Your identity before responding to a request and may decline requests that are manifestly unfounded, excessive, or prohibited under applicable law.

7. COOKIES

Cookies are small text files that are placed on Your device when You visit or use the Platform. They help Us recognise Your browser or device, remember Your preferences, and understand how You interact with Our Services.

We may use the following types of cookies and similar technologies:

• Essential Cookies: Necessary for the operation of the Platform, enabling core functions such as page navigation, secure login, and access to protected areas. The Platform cannot function properly without these cookies.
• Preference Cookies: Used to remember Your settings and choices (for example, language, time zone, or previously entered information) so that Your experience is more convenient and personalised.
• Analytics and Performance Cookies: Used to collect information about how Users access and use the Platform, such as pages visited, time spent, and errors encountered. This helps Us measure and improve the performance, usability, and content of the Platform.
• Marketing and Communication Cookies: Used, where permitted by law and with appropriate consent, to deliver relevant offers, measure the effectiveness of campaigns, and avoid showing You the same advertisements repeatedly.

Most web browsers and devices allow You to manage or disable cookies through their settings. If You choose to block or delete certain cookies, some features of the Platform may not function as intended and Your overall experience may be affected.

By continuing to use the Platform without changing Your cookie settings, You agree to Our use of cookies and similar technologies as described in this Policy and in accordance with applicable law.

8. Contact Us / Grievance Redressal

If You have any questions, concerns, or requests regarding this Policy or Our privacy practices, please contact Us at:

Company Name: Birmecha Securities Pvt. Ltd.

Address: PODDAR COURT, GATE - 4, ROOM NO - 110, 18, RABINDRA SARANI , KOLKATA, West Bengal, India - 700001

Phone: 1800 123 4567

Email: support@birmechasecurities.com

We will endeavour to respond to Your inquiry or grievance as soon as reasonably possible.

For unresolved grievances, You may escalate the matter to the Grievance Redressal Officer (“GRO”) of Birmecha Securities at the coordinates given below:

Name: Grievance Redressal Officer

Address: PODDAR COURT, GATE - 4, ROOM NO - 110, 18, RABINDRA SARANI , KOLKATA, West Bengal, India - 700001

Contact: 1800 123 4567

Email: grievance@birmechasecurities.com