Privacy Policy

1. Introduction

Welcome to Capex Credit Circle Private Limited ("Company," "we," "us," or "our"). We are a technology company that builds software and a capital-facilitation platform for the growth-capital ecosystem. We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.capexcreditcircle.in and use our services. We process personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

This Privacy Policy should be read together with our Terms of Service and our Payment & Refund Policy. If you do not agree with this Privacy Policy, please do not access the site or use our services.

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide to us when you:

• Register for an account on our platform
• Apply for funding or financial services
• Subscribe to our newsletter or communications
• Contact us through our website or customer support
• Participate in surveys, promotions, or other activities

This information may include:

• Name, email address, phone number, and postal address
• Business information (company name, registration details, GST number)
• Financial information (bank statements, income details, credit history)
• Identity documents (PAN card, Aadhaar, passport)
• Account credentials and authentication information

2.2 Automatically Collected Information

When you access our website, we automatically collect certain information, including:

• Device information (device type, operating system, browser type)
• IP address and geolocation data
• Usage data (pages visited, time spent, navigation patterns)
• Cookies and similar tracking technologies

2.3 Derived and Inferred Information

We also generate or receive information derived from your activity and from our partners, including:

• Risk scores, creditworthiness indicators, and behavioural profiles
• Aggregated and statistical analytics
• Information received from Partner Lenders, credit bureaus, KYC registries, and verification providers

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To process funding applications, manage accounts, and provide our services
• Communication: To send you updates, notifications, and respond to your inquiries
• Credit Assessment: To evaluate your eligibility for funding products (QuickCap, PostPay, Assisted Capital) and facilitate Partner Lender decisions
• Compliance: To comply with legal obligations, including KYC (Know Your Customer) and AML (Anti-Money Laundering) requirements
• Security: To protect against fraud, unauthorized access, and other security threats
• AI & Product Development: To train, fine-tune, evaluate, and improve our artificial-intelligence and machine-learning models, analytics, and products (see Section 3.1)
• Marketing: To send promotional communications (with your consent)

3.1 Use of Data for AI/ML Model Training

As a technology company, the development of artificial-intelligence and machine-learning models is core to our services. We store and use your information to train, fine-tune, evaluate, and improve these models in two ways:

• De-identified / aggregated data: We use anonymised or aggregated data — which no longer identifies you — for analytics, research, and AI/ML model development. This use may continue on an ongoing basis.
• Identifiable data with consent: Where you have given your consent, we also use information that can identify you to train and improve models that personalise and enhance your experience and outcomes.

Our legal basis for this processing is your consent and the legitimate uses permitted under the DPDP Act. You may withdraw your consent for the use of identifiable data for AI/ML training at any time (see Section 9), without affecting processing already carried out or our continued use of de-identified or aggregated data.

4. Consent and Legal Basis

We process your personal data on one or more of the following legal bases recognised under the DPDP Act:

• Your consent, which is free, specific, informed, unconditional, and unambiguous;
• Performance of a contract or service you have requested;
• Compliance with a legal or regulatory obligation; and
• Certain legitimate uses permitted by law.

Where processing relies on consent, you may withdraw it at any time, and we will stop the relevant processing unless we are required or permitted by law to continue. Withdrawing consent may limit or prevent our ability to provide certain services.

5. Information Sharing and Disclosure

We may share your information in the following circumstances:

• Partner Lenders & Financial Partners: With banks, NBFCs, and lending partners for credit assessment and disbursement
• Service Providers: With third-party vendors who assist in operating our platform (payment processors, cloud services, analytics)
• Legal Requirements: When required by law, regulation, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Credit Bureaus: For credit reporting and verification purposes

We do not sell your personal information to third parties for marketing purposes.

6. Cross-Border Data Transfer

We may process or store your personal data on servers located outside India, or transfer it to service providers and partners outside India, subject to the conditions of the DPDP Act and applicable RBI requirements. Where we do so, we require equivalent safeguards to protect your data.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit and at rest (AES-256, TLS 1.3)
• Secure access controls and authentication
• Regular security assessments and penetration testing
• Employee training on data protection practices
• Incident response procedures for data breaches

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your personal information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal obligations (typically 7-10 years for financial records)
• Resolve disputes and enforce our agreements

De-identified, anonymised, or aggregated data that we derive for analytics and AI/ML model training may be retained indefinitely, as it no longer identifies you. Financial and KYC records are retained for the periods required by the RBI and our Partner Lenders (typically 7-10 years), even after a relationship ends.

When retention is no longer required, we securely delete or anonymize your information.

9. Your Rights as a Data Principal

Under the DPDP Act and other applicable laws, you have the following rights:

• Access: Request a summary of the personal data we process about you
• Correction & Updation: Request correction, completion, or updating of inaccurate or incomplete data
• Erasure: Request deletion of your personal data, subject to legal and regulatory retention requirements
• Grievance Redressal: Have your grievances addressed by us (see Section 15)
• Nomination: Nominate another individual to exercise your rights in the event of your death or incapacity
• Withdraw Consent: Withdraw consent for processing, including the use of identifiable data for AI/ML training

Because our AI/ML training datasets use de-identified or aggregated data, a request to erase identifiable data applies to records that still identify you; it does not require us to unwind anonymised or aggregated datasets that no longer identify you. To exercise these rights, please contact us at [email protected].

10. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience. These include:

• Essential Cookies: Required for basic site functionality
• Analytics Cookies: Help us understand how visitors use our site
• Marketing Cookies: Used to deliver relevant advertisements

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect site functionality.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

12. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

13. Regulatory Framework

We operate within India's financial and data-protection ecosystem. While Capex Credit Circle Private Limited is a technology provider and not itself a regulated lender, our Partner Lenders, Capital Partners, Insurance Providers and Distributors and/or other regulated entities are regulated by authorities including the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), and the Insurance Regulatory and Development Authority of India (IRDAI), as applicable. Our data practices are designed to align with:

• the Digital Personal Data Protection Act, 2023;
• the Information Technology Act, 2000, and rules thereunder;
• the Credit Information Companies (Regulation) Act, 2005; and
• applicable RBI, SEBI, and IRDAI directions as they relate to our partners.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date.

15. Grievance Officer and Escalation

In accordance with the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000, the name and contact details of our Grievance Officer are provided below. If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India.

16. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: