Data Access & Privacy Policy

Introduction

At Instaclaus Fintech Private Limited (hereinafter referred to as "us", "we", "our" or "Instaclaus"), we are committed to protecting the privacy of our users (hereinafter referred to as "you" or "User") and safeguarding your personal information. This Data Access and Privacy Policy ("Policy") outlines how we collect, use, disclose, and protect information pertaining to you.

By using our Services (defined below) and interacting with our platform, you agree to the terms outlined in this Policy. This Policy is applicable to all the existing customers, prospective customers and persons who visit the office, branch and / or any website / mobile application belonging to Instaclaus. This Policy is only applicable to any website / mobile application owned by Instaclaus and not to other business applications and websites that you may access through Instaclaus' application or website, each of which may have separate data collection, storage, and use policies that are different from our Policy. As on date, Instaclaus owns a website 'instaclaus.com' (https://instaclaus.com/) and the 'Instaclaus' mobile application available on the Google Playstore and the iOS Appstore.

The objective of this Policy is to cultivate an organization-wide privacy culture to protect the rights and privacy of our Users, by introducing and implementing privacy principles and controls into the information security systems of Instaclaus. All employees of Instaclaus will adhere to and comply with this Policy. Instaclaus will adopt all necessary and reasonable security practices and procedures to protect the confidentiality of the User's data and its transmission. Instaclaus adheres to the provisions of the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Sensitive Personal Data and Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023.

The Policy shall be subject to the prevailing laws and regulations in effect, as applicable and amended periodically. This Policy should be read alongside, and in addition to the Terms of Use ("Terms") and any separate product or service agreement or terms and conditions entered between us from time to time.

This Policy sets out the rules and procedures relating to the processing of Personal Data by Instaclaus in India. Reference to any applicable law under this Policy (legislative or regulatory), will be a reference to such applicable law as may have been amended, modified or superseded from time to time.

Definitions

"Instaclaus" means Instaclaus Fintech Private Limited.

"NBFC(s)" means Oriental Finstock Services Private Limited and / or any other non-banking financial company registered with the RBI, which has engaged Instaclaus as a Lending Service Provider to inter alia provide Digital Lending services including, but not limited to, customer acquisition, assistance with KYC verification, servicing, monitoring and recovery of loans.

"RBI" means the Reserve Bank of India.

"Services" means the services as detailed under paragraph 3 (About us) and shall include any other service that Instaclaus may provide to you in future.

"User" or "you" means any person who has consented to become a user of our website(s) or our mobile application(s) or has availed any of the Services.

In addition to the above, the terms "Data Fiduciary", "Data Processor", "Personal Data" and "processing" shall have the meaning ascribed to the terms under the Digital Personal Data Protection Act, 2023; and the terms "Digital Lending", "Lending Service Provider" and "Digital Lending Application" shall have the meaning ascribed to the terms under the RBI's Guidelines on Digital Lending dated September 2, 2022.

About Us

Instaclaus provides a payroll financing platform by entering into direct arrangements with certain select entities ("Corporate Employers") and the NBFC(s) and facilitating short term loans to the employees of the Corporate Employers (the Users) in a simple and secure manner. Instaclaus provides the services through inter alia its website 'instaclaus.com' (https://instaclaus.com/) and the 'Instaclaus' mobile application available on the Google Playstore and the iOS Appstore. The website(s) and / or mobile application(s) offer onboarding, verification, loan application services, PAN authentication, document verification, bank account validation, seamless disbursements, customer care services and automated payment services, which may be provided by Instaclaus or other third party service providers, and which the User may opt to avail. The website(s) and mobile application(s) also act as a Digital Lending Application.

Processing of User Information

Instaclaus acts as a Lending Service Provider to the NBFC(s). In doing so, Instaclaus processes Users' Personal Data on behalf of the NBFC(s) based on the consent and authorisation obtained from the User. The NBFC(s) are the Data Fiduciaries who determine the purpose and means of processing Users' Personal Data, and Instaclaus is the Data Processor authorised to process the data with respect to such services. For any queries related to the processing of your data by the NBFC(s) or to exercise your rights in respect of such services, please reach out to the relevant NBFC.

Through its website(s) and / or mobile application(s), Instaclaus helps you apply for loans through the Corporate Employer in a simple and secure manner. For such Services, Instaclaus is the Data Fiduciary and collects and processes your Personal Data with your consent in accordance with this Policy.

Data We Collect

We collect Personal Data and Data (defined below) / information to provide you with our financial products and the Services and to improve your experience on our website or application. This may include:

Name, address, signatures, date of birth, copies of identity cards (ID), contact details including email id and phone number, address, previous names, maiden names, marital status, relatives information, medical condition, domicile, origin, citizenship, nationality, residence, any legal or other identifiers like Permanent Account Number (PAN) / Taxpayer Identification Number (TIN) / Aadhaar Number and other linked details / masked Aadhaar / proof of possession of Aadhaar Number / national ID / social security number / or its equivalent, photograph and gender; Data that identifies (whether directly or indirectly) a particular individual, such as information you provide on any forms, surveys, online applications or similar online fields.

Bank account details, investments history, credit / debit card details, UPI handles, income details, salary details, pay-slips, including historical information in relation to these; Employment / occupational information such as name of Corporate Employer, employee ID, employee status, date of joining, pay grade, designation, department, attendance details, pay-out date, pay group, employment type, loss of pay status, last working day and net monthly salary; Residential status under banking, general and tax laws; Spending / saving / investing / payments / receipts / borrowing history; Risk profile, financial objectives, financial knowledge and experience, preferences and any other information to assess the suitability of the Services to you; Information collected when you make or receive payments.

Data about you is obtained from other sources with your consent, such as email service providers, public databases, joint marketing partners, social media platforms, as well as from other third parties as appropriate. This includes information from credit information companies / credit reference agencies, risk management and fraud prevention agencies, national and government databases.

Information about your internet activity collected using cookies; your digital and electronic device information including location (with your specific permission), IP address, information about your use of the website or mobile app (including device type, operating system, screen resolution); unique device identifiers such as IMEI number, technical usage data, contact lists (where specific permission is obtained); and generation and storing of password or PIN in encrypted form.

In addition to the above, Instaclaus may with your consent collect your know-your-customer documents including all proofs of identity and address, photographs, parents' names, video and audio recordings, geographical location, PAN, personal bank account numbers, bank account data, IFSC code and access transactional SMS data from your phone to facilitate a seamless in-app experience.

Any of the aforesaid data, information, know your customer related data, any derivative thereof ("Derivative Data") like any credit scores or behavioural projections, profiling, analytical results, reports (prepared by us or others) including through any algorithms, analytics, software, automations, profiling etc., and whether such derivative is from the information collected from you or in combination with any other information sourced from any other person, database or source whether by us or others, shall collectively be referred to as "Data".

When and How Your Data Is Collected?

Your Data may be collected or processed through any of the following:

• When you submit the Data to us including when you request for certain Services.
• When you use the Services.
• During the course of transactions.
• When you apply for the Services, make enquiries or engage with us or with any other person where we are involved for any other person in the transaction concerning you.
• Data collected during credit assessment, risk assessment, fraud checks, fraud detections, processes undertaken for fraud prevention, detecting malpractices or discrepant documents or information, prevention of misuse, assessment of credit worthiness, evaluation of financial standing, due diligence, background check, physical and other inspections, verifications, KYC / anti money laundering checks, monitoring, collections, recovery, customer service etc.
• When you use our website and online Services provided by us (including mobile applications) and visit our branches or offices.
• When you email or call or respond to our emails / phone calls or during meetings with our staff or representatives.
• When you or others give the Data verbally or in writing. This Data may be on application forms, in records of your transactions or if you make a complaint.
• From information publicly available about you.
• During or as a result of derivation, from any person possessing the same or sourcing any Data.
• Data collected through cookies.

By accepting this Policy or by applying for or availing any Services, you agree that any person who submits any Data or part thereof to us or from whom we source the same (including derivation), shall be deemed to have been authorised by you to submit such Data to us and you hereby further authorise the processing of any such Data by us or for us, for any of the purposes mentioned in this Policy.

How We Use Your Information?

Whether we're using it to confirm your identity, to help in the processing of an application for any Services or to improve your experiences with us, your Data is always handled with care and the principles outlined in this Policy are always applied. The processing of the Data may be done by us or any of the Data Processors for any of the following purposes, and you agree and consent to the same:

• To provide you with the Services and manage relationships with you.
• For enabling your use of the Services and processing or executing transactions.
• For enabling any applications / requests for any Service, processing any such applications / requests, performing any contract pursuant thereto.
• To perform activities such as data analysis, audits, usage trends to determine the effectiveness of our campaigns and as input into improving the Services.
• For credit scoring, credit analysis, risk analysis, obtaining any reports, credit scores, credit information, scrubs, for assessing and undertaking / evaluating financial standing, fraud check, fraud probability, reference checks, due diligence, inspections, etc.
• To contact you or to establish contact with you.
• To allow you to utilize features on platforms / apps by granting us access to Data from your device.
• For security, business continuity and risk management.
• For system or product development and planning, audit and administrative purposes.
• To personalize your platform / app experience and improve customer / User experience.
• To inform you about important information regarding our Services, changes to terms, conditions, and policies and / or other administrative information.
• Where processing is necessary because of a legal or regulatory obligation that applies to us.
• Where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party.
• To enable NBFC(s) to use the Data to analyse your creditworthiness, loan eligibility, KYC documents, current employment verification and the terms of your loans.

You agree that Instaclaus may engage any third-party Data Processor, for any of the aforesaid purposes or part thereof for any incidental or ancillary purposes, and may accordingly share Data with any of them and allow them to further process / share the same, for the said purposes.

Automated Processing

The way your personal information is analysed in relation to the Services including applications, credit decisions, determining your eligibility for the Services, may involve automated profiling and decision making. This means that your Data may be processed using software that is able to evaluate your personal aspects and predict risks or outcomes as also where the decision making may be automated.

We may also carry out automated anti-money laundering, transaction monitoring and sanctions checks. This means that we may automatically decide that you pose a fraud or money laundering risk if the processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, is inconsistent with your previous submissions, or you appear to have deliberately hidden your identity.

Who We Share Your Data With?

We may share the Data with the following persons and / or in the following circumstances:

• With service providers, vendors, agents etc. who perform services for us or assist us to operate our business or provide the Services.
• Entities or persons with whom we have tie-ups for the co-branded services, products or programs, any rewards programs, any benefits, offers, features or any similar arrangements.
• With co-originators, collaborators, and persons with whom Instaclaus may have a tie-up for any Services.
• Other third parties to comply with legal requirements such as the demands of applicable warrants, court orders; to verify or enforce our terms of use; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties.
• We may share your Data, without obtaining your consent or without intimating you only (a) with governmental, statutory, regulatory, executive, law-enforcement, investigating or judicial / quasi-judicial authorities, departments, instrumentalities, agencies, institutions, boards, commissions, courts, tribunals, who ask for such Data including by way of an order, direction, etc; or (b) with any person, where disclosure is necessary for compliance of any legal or regulatory obligation.
• Credit information companies, bureaus, fintech entities or service providers for the purposes of obtaining any reports, credit scores, credit information, scrubs, financial standing, fraud check, fraud probability, reference checks, due diligence, inspections, risk analysis etc.

Cookies

Cookies are small data files that a website stores on your computer / electronic device. We and / or our affiliate entities or service providers may use cookies and similar tracking technologies to enhance your online experience, analyse usage patterns, and improve our Services. You can manage your cookie preferences through your browser settings.

While cookies have unique identification numbers, Personal Data shall not be stored on the cookies. Instaclaus may: use persistent cookies which are permanently placed on the User's computer to store non-personal and profiling information; use information stored in the cookies to improve User experience by throwing up relevant content where possible; and use the cookies to store User preferences to ease your navigation on the website(s) / mobile application(s).

Website & Links to Other Sites

Instaclaus' website(s) / mobile application(s) may contain links to other websites. If you click on a third-party link, you may be directed to such third-party websites. It may be noted that such external websites are not operated by Instaclaus and are beyond the control of Instaclaus. Therefore, Instaclaus strongly advises the User to review the privacy terms / policy of such external websites / electronic applications. Instaclaus has no control over and assumes no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Data Security and Training

Securing the User's information is of paramount importance to Instaclaus. We implement industry-standard security measures to protect your information from unauthorized access, disclosure, alteration, or destruction. We use encryption, firewalls, and access controls to safeguard your data. Following are some of the initiatives by Instaclaus for ensuring security and privacy of your information:

• Instaclaus has reasonable management, technical and administrative measures in place to protect data stored by Instaclaus.
• Preventing any un-authorized data input, disclosure, uploading, transmission / transfer of Personal Data.
• Preventing any un-authorized person from having access to any computer systems processing Personal Data, and especially un-authorized reading, copying, alteration, deletion or removal of Personal Data.
• We keep a record of which Personal Data have been shared / transferred, when and to whom.
• We ensure that Personal Data processed on behalf of a third party (including the NBFC(s)) can be processed only in the prescribed manner.
• Immediately, on becoming aware, report and notify any vulnerabilities and privacy related breach / security breaches (including potential risks).
• Attend mandatory and voluntary trainings on security and data privacy including e-learnings and online sessions.
• Sound technical controls around Data and underlying systems are in place.
• Instaclaus has adopted all reasonable safeguards as mandated by the applicable law in order to protect your data. The data provided by you is stored only in the servers of India. We shall not transfer your Personal Data to any foreign jurisdiction.
• The Information is processed by Instaclaus in strict accordance with the Indian Information Technology Act, 2000, and the rules notified thereunder.
• Updates on information security position is updated at regular intervals to senior management of Instaclaus.

In all contractual arrangements, we require Instaclaus employees, third party agencies / service providers to comply with appropriate compliance standards including obligations to protect any information and applying appropriate measures for the use and transfer of information.

We value your trust in providing your Personal Data to Instaclaus. Despite our best practices of safeguarding your data, you understand and accept that data transmission may entail certain inherent risks. Instaclaus assumes no liability for any disclosure of Data due to errors in transmission issues, any unauthorised third-party access to our website(s) / mobile application(s) and databases or other acts of third parties or acts or omissions beyond our reasonable control and you shall not be entitled to hold Instaclaus responsible for any breach of security except in case of wilful negligence on the part of Instaclaus.

Responsibility of User

It shall be the responsibility of the User to provide Instaclaus with accurate, not misleading, updated and complete Personal Data and up-date Instaclaus as and when such Personal Data provided earlier becomes incorrect or out of date, by providing new details.

The User represents and warrants that they are above 18 (eighteen) years of age. Our Services are not meant to be used by children, and we do not knowingly solicit or collect personal information from persons under the age of 18 (eighteen). If we find out that a child has given us Personal Data, we will take steps to delete that information and terminate the relevant User account.

User acknowledges the following:

• Instaclaus and / or its employees / agents will not contact the User directly for disclosure of any sensitive and personal information. The User is solely responsible to exercise proper due diligence to verify the identity of the individual(s) contacting before disclosing any Personal Data.
• Instaclaus will not be liable / responsible for any breach of privacy owing to User's own negligence or when the User makes Data about themselves publicly available on their social media accounts.
• The User must only use the official website / links of Instaclaus for availing the Services by inputting the domain information of Instaclaus in the address bar.
• The User is completely aware about the potential risk of any data or privacy breach.

You agree that you shall exercise utmost caution to ensure that your Personal Data is not shared / stored / made accessible through any physical or electronic means by taking the following precautions:

• Always check if "https" appears in any website's address bar before making any online transaction.
• Avoid using third-party extensions, plug-ins or add-ons on your web browser.
• Always type the information and not use the auto-fill option on web-browser and mobile apps.
• Do not access darknet, unauthorized / suspicious websites, suspicious online platforms, or download information from unreliable sources.
• Ensure to disable cookies before accessing any domain / website, to ensure that your personal information is not tracked by any third-party, unless otherwise consciously permitted.
• Do not respond to any generic emails from an unknown / unidentified source.
• Always verify and install authentic web / mobile applications from reliable sources on all your electronic devices.
• Do not access any unidentified weblinks or any other electronic links shared over any electronic platform.

Your Choices

You have the following rights with regard to your data, and you can exercise these rights by using tools and mechanisms Instaclaus provides you to manage your Data on our website and application.

Instaclaus understands that you may want to review the data provided by you from time to time. To do so, you may visit the website and / or the mobile application, where your Data will be displayed.

If you become aware of inaccuracies in your Data, please reach out to us for correction. Please notify us without undue delay for any changes to the Data that you have provided to us.

You may withdraw consent given to us for processing of your Data. In such cases, Instaclaus reserves the right to stop providing you our Services for which your Personal Data was sought. Your withdrawal will become effective when you receive an acknowledgment from us. You understand that despite your request to withdraw consent, Instaclaus may still need to retain some data about you to comply with applicable laws.

When you no longer wish to avail our Services or use our website / mobile app, you can discontinue by deleting your data. Instaclaus provides you with an option to delete your Data by writing to us at support@instaclaus.com. However, please note that in case of your choice to delete information might affect our ability to provide you with some Services and is subject to regulatory guidelines.

You can choose not to provide certain information. Note that this might affect our ability to provide you with some of the Services, subject to regulatory guidelines.

You can manage your communication preferences and opt-out of certain types of communication.

Retention of Information

We only retain your Data to facilitate your smooth and uninterrupted use of our Services. As a Data Fiduciary, when you choose to use the website(s) or mobile application(s), Instaclaus stores your Personal Data as long as you use the website(s) / mobile application(s) and as long as you continue to have any outstanding monetary liabilities to the NBFC(s), whichever is later. However, Instaclaus will retain and use the information collected as necessary to comply with our obligations under applicable laws or contractual agreements or to resolve any disputes or as necessary for the legitimate business interests of Instaclaus and the NBFC(s), such as fraud detection and prevention and enhancing safety.

Post deletion, Instaclaus may continue to use your anonymised data, which is aggregated or combined with anonymised data of other Users. Instaclaus uses this for analytics, research, and other business purposes. In the event you do not wish for us to process your data, you can delete your data by writing to us at support@instaclaus.com.

Retention of Information will be as per applicable law / regulatory requirements in India. Information may be retained for an extended period: (a) in case of requirement of any investigations under law or as part of any requirement before courts, tribunals, forums, commissions etc; (b) to enhance the Services; (c) for initiating, exercising or defending legal claims, or (d) in accordance with specific consents from the User.

Changes to This Policy

Instaclaus may occasionally update this Policy. In case Instaclaus changes this Policy in a manner that changes the processing and management of User data, Instaclaus will notify and give you an opportunity to review the revised Policy before you choose to proceed with availing our Services. Instaclaus also encourages you to periodically review this Policy for the latest information on the data practices followed by Instaclaus.

Contact Us

Please reach out to us using the below contact information to redress any grievances or queries that you may have in relation to this Policy or our data practices:

Mr. Mukesh Desai Grievance Redressal Officer / Data Protection Officer mukesh.desai@instaclaus.com 8, Noble Residency Vrundav, Thaltej, Ahmedabad – 380 059, Gujarat, India

Please note that Instaclaus' grievance redressal mechanism addresses only the issues related to the way Instaclaus processes and manages your data on our website, our application or otherwise while processing your Data in connection with our Services. Instaclaus, in no way, can address the issues that you may have with the NBFC(s), any Data Processor or any other third party.

If your complaint is not resolved within the 30 (thirty) days, you can lodge a complaint over the Complaint Management System portal hosted by the RBI under the Reserve Bank – Integrated Ombudsman Scheme, 2021. As per the Digital Personal Data Protection Act, 2023, you may also make a complaint to the Data Protection Board as and when established through a notification by the Government of India and in a manner as may be prescribed.

By using Instaclaus' Services, you acknowledge that you have read and understood this Policy and agree to its terms.