SHANKAR FININVEST PRIVATE LIMITED

PRIVACY POLICY

ℹ This Privacy Policy explains how Shankar Fininvest Private Limited, operating the PennyDrop Platform, collects, uses, stores, shares, and protects your personal data. It is compliant with the Digital Personal Data Protection Act 2023 (DPDPA), the IT (SPDI) Rules 2011, RBI Digital Lending Guidelines 2022, RBI KYC Master Directions 2016, PMLA 2002, and all other applicable Indian laws.

This Privacy Policy (“Policy”) governs the collection, use, storage, sharing, and protection of personal data by Shankar Fininvest Private Limited(“Company,” “we,” Us,” or “our”) in connection with the PennyDrop digital lending platform, accessible at www.pennydrop.in and through the PennyDrop mobile application (collectively, the “Platform”).

This Policy applies to all persons who visit, access, register on, or use the Platform in any manner (“Users,” “you,” or “your”). By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the terms of this Policy. If you do not agree, you must immediately discontinue use of the Platform.

This Policy must be read in conjunction with our Terms and Conditions, the Key Fact Statement (KFS) applicable to your Loan, and the Loan Agreement executed between you and the Lender. Capitalised terms not defined herein have the meanings ascribed to them in the Terms and Conditions.

1. IDENTITY AND CONTACT DETAILS OF DATA FIDUCIARY

Under the Digital Personal Data Protection Act 2023 (“DPDPA”), the Company acts as the Data Fiduciary in respect of personal data collected through the Platform. Details of the Data Fiduciary:

2. SCOPE AND APPLICABILITY

This Policy applies to all personal data processed by the Company in connection with:

• The PennyDrop website (www.pennydrop.in) and all sub-pages;
• The PennyDrop mobile application (Android and/or iOS);
• All Services facilitated by the Company as a Lending Service Provider (LSP), including loan application facilitation, KYC verification, credit assessment support, repayment facilitation, and customer support;
• All interactions between the User and the Company through any channel (phone, email, in-App, or otherwise).

This Policy does NOT apply to:

• The data processing activities of the Lender (Regulated Entity) under the Loan Agreement, which are governed by the Lender's own privacy policy;
• Third-party websites or applications linked from the Platform (see Section 14);
• Anonymised or aggregated data that cannot be used to identify an individual.

3. KEY DEFINITIONS

For the purposes of this Policy, the following definitions apply:

• “Consent Artefact” means the structured electronic record capturing a User's specific, informed, and revocable consent for a defined purpose of data processing, as required under applicable law and the Account Aggregator framework.
• “Data Fiduciary” means the entity that determines the purpose and means of processing personal data — in this case, Shankar Fininvest Private Limited.
• “Data Principal” means the individual to whom the personal data relates — i.e., you, the User.
• “Data Processor” means any entity that processes personal data on behalf of the Data Fiduciary (e.g., KYC verification agencies, cloud service providers).
• “Digital Personal Data” means personal data in digital form, as defined under the DPDPA 2023.
• “DPDPA” means the Digital Personal Data Protection Act, 2023, and all rules, regulations, and guidelines issued thereunder.
• “Personal Data” means any data about an individual who is identifiable by or in relation to such data, whether directly or indirectly.
• “Processing” means any operation or set of operations performed on Personal Data, including but not limited to: collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, dissemination, erasure, or destruction.
• “Sensitive Personal Data or Information” or “SPDI” means personal data consisting of: financial data (bank account, credit card, payment instrument details), biometric data, health data, caste or tribe, religious or political beliefs, and passwords, as defined under the IT (SPDI) Rules 2011.
• “Purpose Limitation” means the principle that personal data may only be collected and processed for specific, explicit, and legitimate purposes disclosed to the User.
• “Data Minimisation” means the principle that only the minimum personal data necessary for the stated purpose shall be collected.

4. CATEGORIES OF PERSONAL DATA COLLECTED

We collect and process the following categories of personal data, subject always to the principles of purpose limitation and data minimisation:

4.1 Identity and KYC Data

• Full legal name;
• Date of birth and age;
• Gender;
• Photograph (for KYC face match and liveness verification);
• Permanent Account Number (PAN);
• Aadhaar number — only the last 4 digits are stored; the full Aadhaar number is NOT stored by us; accessed via UIDAI e-KYC only with your explicit, specific, and revocable consent per Aadhaar Act 2016 and UIDAI regulations;
• Other government-issued identity documents (Voter ID, Passport, Driving Licence) as applicable and accepted by the Lender.

4.2 Contact and Address Data

• Registered mobile number (primary identifier; used for OTP-based authentication);
• Email address;
• Current and permanent residential address;
• Proof of address documents (utility bills, bank statements showing address, etc.).

4.3 Financial and Employment Data

• Bank account number and IFSC code (for disbursement and NACH mandate registration);
• Bank statements (last 3 to 6 months) for income and cash-flow assessment;
• Salary slips or proof of income;
• Form 16 or Income Tax Returns (ITR);
• Name of employer or nature of self-employment/business;
• Employment type (salaried / self-employed / business owner);
• Monthly income or net take-home salary.

4.4 Credit and Financial History Data

• Credit bureau reports and scores from one or more Credit Information Companies (TransUnion CIBIL, Experian, Equifax, CRIF HighMark) — accessed with your explicit, prior, informed consent;
• Details of existing loans, liabilities, and repayment history;
• NACH mandate details and repayment records for your PennyDrop Loan.

4.5 Device and Technical Data

• Device type, model, and manufacturer;
• Operating system version;
• Device identifiers (e.g., Android Advertising ID or IDFA) — only where legally permitted and with your consent;
• IP address and approximate network location;
• Browser type and version;
• App version;
• Time zone and language settings.

4.6 Behavioural and Usage Data

• Pages visited, features accessed, and navigation patterns within the Platform;
• Duration of sessions and interaction frequency;
• Search queries and in-App actions;
• Error logs and crash reports (used solely for improving Platform performance).

4.7 Location Data

• Approximate device location (city/area level) — collected ONLY with your explicit, prior consent for the limited purposes specified in Section 6.5;
• Location data is NOT collected for recovery purposes and is NOT shared with recovery agents.

4.8 Communication Data

• Records of communications between you and the Company (calls, emails, chat logs, in-App messages);
• Complaint and grievance records.

4.9 Data We Do NOT Collect

⛔ PennyDrop does NOT collect, access, or process the following without a separate, specific, purpose-limited consent, and will NEVER collect the following for lending purposes: phone contact lists, call logs, SMS messages, gallery or photos, social media profiles or content, microphone recordings. This is in strict compliance with RBI Digital Lending Guidelines (Sep 2022).

5. HOW WE COLLECT PERSONAL DATA

5.1 Data Provided Directly by You

We collect data that you provide directly when you:

• Register and create an account on the Platform;
• Complete the loan application form;
• Submit KYC documents;
• Contact our customer support team;
• Respond to our communications or surveys.

5.2 Data Collected Automatically

We automatically collect certain technical and usage data when you access the Platform, including device information, IP address, and usage behaviour, using cookies and similar tracking technologies (see Section 15).

5.3 Data from Third-Party Sources

We may collect or verify data from the following third-party sources, always with your explicit prior consent:

• UIDAI e-KYC Service: For Aadhaar-based identity verification, accessed only with your explicit, specific, and revocable consent as required by the Aadhaar Act 2016;
• Central KYC Registry (CKYCRR): For KYC verification and record submission as required under RBI KYC Master Directions 2016;
• Credit Information Companies (CIBIL, Experian, Equifax, CRIF HighMark): For credit bureau reports, accessed with your explicit consent;
• Account Aggregator (AA) Framework (RBI-licensed): For digital access to bank statements and financial data, governed by a Consent Artefact that you review and approve;
• KYC Verification Agencies (including Surepass, Ongrid, Novel Pattern): For PAN verification, face match, liveness detection, and document verification;
• Payment Gateways and Banks: For NACH mandate registration and payment verification.

⚠ We will always inform you clearly about the source of data we collect about you from third parties, and obtain your specific consent before accessing such data.

6. PURPOSES FOR WHICH WE PROCESS YOUR DATA

We process your personal data only for the following specific, explicit, and legitimate purposes. We will not process your data for any purpose not listed herein without obtaining your fresh, explicit consent.

6.1 Account Registration and Authentication

Legal Basis: Consent and contract performance.

We use your mobile number, name, email, and device data to create and manage your PennyDrop account, verify your identity via OTP, and secure your account.

6.2 KYC Verification and AML Compliance

Legal Basis: Legal obligation (PMLA 2002, RBI KYC Master Directions 2016).

We collect and process identity documents, Aadhaar data, PAN, and CKYC records to fulfill our mandatory Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations under applicable law. This processing cannot be refused or withdrawn as a condition of legal compliance.

6.3 Loan Application Processing and Credit Assessment

Legal Basis: Consent and contract performance.

We process your financial data, income information, bank statements, and credit bureau data to assess your creditworthiness on behalf of the Lender and to process your loan application.

6.4 Loan Disbursement and Repayment

Legal Basis: Contract performance.

We process your bank account details and NACH mandate information to facilitate loan disbursement by the Lender and to process your EMI repayments.

6.5 Location Data (Limited Purposes Only)

Legal Basis: Consent.

We process location data ONLY for:

• Verifying your residential address against KYC records;
• Fraud detection and prevention;
• Compliance with geolocation-based regulatory requirements.

⛔ Location data is NEVER used for loan recovery. It is NEVER shared with recovery agents. Use of location data for recovery or harassment purposes is strictly prohibited under RBI Digital Lending Guidelines and applicable law.

6.6 Fraud Detection and Prevention

Legal Basis: Legitimate interest and legal obligation.

We process behavioural, device, and financial data to detect, prevent, and investigate fraud, identity theft, and financial crime, including using automated risk-scoring models.

6.7 Legal and Regulatory Compliance

Legal Basis: Legal obligation.

We process and retain your data to comply with obligations under PMLA 2002, DPDPA 2023, IT Act 2000, Income Tax Act 1961, RBI guidelines, court orders, and requests from regulatory authorities and law enforcement agencies.

6.8 Grievance Redressal and Customer Support

Legal Basis: Legal obligation and contract performance.

We process your data to address your queries, complaints, and disputes, including maintaining records of communications for quality assurance and regulatory compliance.

6.9 Platform Improvement

Legal Basis: Legitimate interest.

We use anonymised and aggregated (non-identifiable) usage data to understand how our Platform is used and to improve its features, performance, and security. Individual users are NOT identifiable from such data.

6.10 Marketing and Promotional Communications (Optional)

Legal Basis: Separate, optional consent (opt-in).

We may send you information about new products, features, or offers from PennyDrop or its partners ONLY if you have separately opted in to receive such communications. Marketing communications are entirely optional and are NOT a condition of availing the Services. You may opt out at any time. See Section 11.

✅ We will NEVER combine your lending data with third-party data for advertising profiling without your separate, explicit, purpose-specific consent.

7. LEGAL BASIS FOR PROCESSING

Under the DPDPA 2023 and applicable laws, we process your personal data on the following legal bases:

8. HOW WE SHARE YOUR PERSONAL DATA

We do NOT sell, rent, or trade your personal data to third parties for commercial gain. We share your data only in the following circumstances and with the following categories of recipients, all of whom are bound by appropriate contractual or legal obligations:

8.1 Sharing with the Lender (Regulated Entity)

We share your KYC data, financial data, and credit assessment data with the Lender (NBFC/Bank partner) for the sole purpose of processing your loan application, sanctioning the Loan, and managing the Loan Agreement. The Lender's processing of your data is governed by its own privacy policy and RBI regulations.

8.2 Sharing with KYC Verification Agencies

We share identity data with UIDAI (for Aadhaar e-KYC), the Central KYC Registry (CKYCRR), and KYC verification technology providers (including Surepass, Ongrid, Novel Pattern) for the sole purpose of identity verification and KYC compliance.

8.3 Sharing with Credit Information Companies

We share your identity and financial data with Credit Information Companies (TransUnion CIBIL, Experian, Equifax, CRIF HighMark) to:

• Obtain your credit bureau report for creditworthiness assessment (with your explicit consent); and
• Report your loan account, repayment history, Default, or settlement as required under the Credit Information Companies (Regulation) Act 2005 and RBI guidelines.

⛔ Your loan account and repayment performance WILL be reported to credit bureaus. Defaults and settlements are recorded and can negatively affect your credit score for up to 7 years.

8.4 Sharing with Account Aggregators

Where you consent, we access your financial data through the RBI-licensed Account Aggregator (AA) framework, governed strictly by a Consent Artefact. You may revoke AA consent at any time through the relevant AA.

8.5 Sharing with Payment and Collection Partners

We share your bank account and NACH mandate details with payment gateway partners and the NPCI for the purpose of processing EMI repayments and NACH mandate registration.

8.6 Sharing with Recovery Partners

In the event of Default on your Loan, the Lender may engage authorised recovery partners (including Credgenics, GoCredit) for loan recovery. Any data shared with recovery partners shall be:

• Limited to contact details (name, registered mobile number, registered email, and registered address) necessary for recovery communication;
• Subject to strict data usage agreements complying with RBI recovery guidelines;
• NOT inclusive of location data, contact lists, or any other sensitive data.

⛔ Recovery partners are PROHIBITED from accessing your location, contact list, photos, or any other device data. Any such attempt is unlawful and must be reported to nodal.officer@pennydrop.in and the RBI Ombudsman.

8.7 Sharing with Regulatory and Law Enforcement Authorities

We may disclose your personal data to:

• The Reserve Bank of India (RBI), Securities and Exchange Board of India (SEBI), Financial Intelligence Unit-India (FIU-IND), Income Tax Department, or any other regulatory authority, as required under applicable law;
• Courts, tribunals, or law enforcement agencies under lawful order, subpoena, or legal process;
• The Data Protection Board of India (upon establishment) in connection with data breach notifications or regulatory proceedings.

8.8 Sharing in Connection with Business Restructuring

In the event of a merger, acquisition, demerger, or sale of all or substantially all of the Company's assets, your personal data may be transferred to the successor entity, provided that:

• The successor entity is bound by this Policy or a policy providing equivalent protection;
• You are notified of such transfer in advance with an opportunity to opt out; and
• Your data is used only for the same purposes for which it was originally collected.

8.9 No Commercial Data Sharing

✅ We do NOT share your personal or financial data with advertisers, data brokers, or any third party for commercial profiling, advertising, or marketing purposes without your separate, explicit, purpose-specific consent.

9. DATA RETENTION AND DELETION

9.1 Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention obligations:

9.2 Post-Retention Deletion and Anonymisation

Upon expiry of the applicable retention period, personal data shall be:

• Securely deleted or destroyed, using methods that prevent recovery; or
• Anonymised or aggregated such that individual identification is no longer possible.

Anonymised or aggregated data may be retained indefinitely for statistical and analytical purposes without constituting personal data processing.

9.3 Data Localisation

All personal data and financial data of Indian customers is stored and processed exclusively on servers and data centres located within India, in strict compliance with RBI data localisation requirements applicable to regulated digital lending entities and payment service providers.

10. DATA SECURITY

10.1 Security Measures

We implement and maintain comprehensive technical, organisational, and administrative security measures to protect your personal data from unauthorised access, disclosure, alteration, use, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using industry-standard TLS/SSL protocols;
• Encryption at rest: Sensitive personal data and financial data stored on our servers is encrypted at rest using AES-256 or equivalent;
• Access controls: Access to personal data is restricted on a strict need-to-know basis; all access is logged and audited;
• Multi-factor authentication: All administrative and developer access to production systems requires multi-factor authentication;
• Regular security audits: We conduct periodic vulnerability assessments, penetration testing, and security audits;
• Data masking: Sensitive data fields (e.g., full Aadhaar number, full bank account number) are masked in all interfaces and logs;
• Incident response: We maintain a documented data breach response plan with defined escalation procedures.

10.2 Limitations

While we implement industry-standard security measures, no system of data transmission or storage is completely impenetrable. We cannot guarantee absolute security of data transmitted over the internet. You are advised to:

• Keep your account credentials (username, password, OTP) strictly confidential;
• Not share your OTP with any person, including persons claiming to be Company representatives;
• Log out of the Platform when using a shared or public device;
• Immediately report any suspected unauthorised access to care@pennydrop.in.

⚠ The Company will NEVER ask you for your password, OTP, or full card/bank details via phone, SMS, or email. If you receive such a request, do not comply and report it immediately.

10.3 Breach Notification

In the event of a personal data breach that is likely to result in harm to you, we shall:

• Notify you via your registered mobile number or email as soon as practicable;
• Notify the Data Protection Board of India (upon its establishment) within the timelines prescribed under DPDPA 2023;
• Take immediate steps to contain the breach and mitigate harm;
• Provide you with details of the breach, data affected, and steps taken, as required by applicable law.

11. YOUR RIGHTS AS A DATA PRINCIPAL

Under the Digital Personal Data Protection Act 2023 and other applicable Indian laws, you have the following rights with respect to your personal data. To exercise any right, contact us at care@pennydrop.in or nodal.officer@pennydrop.in.

11.1 Right of Access and Summary

You have the right to:

• Obtain confirmation of whether your personal data is being processed by us;
• Access a summary of the personal data we hold about you;
• Know the identities of the third parties with whom your data has been shared.

We shall respond to access requests within 30 (thirty) days of receipt, unless a longer period is permitted by applicable law.

11.2 Right to Correction and Completion

You have the right to request that we correct inaccurate, incomplete, or outdated personal data we hold about you. Corrections shall be effected within 30 days of your verified request. You may update certain information directly through the Platform or by contacting care@pennydrop.in.

11.3 Right to Erasure

You have the right to request erasure of your personal data in the following circumstances:

• The data is no longer necessary for the purpose for which it was collected;
• You have withdrawn your consent and there is no other legal basis for processing;
• The processing was unlawful.

Erasure requests are subject to our legal retention obligations (see Section 9.1). We cannot erase data that we are legally required to retain, but we will restrict its further processing to the extent possible.

11.4 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal shall not affect the lawfulness of processing before withdrawal. To withdraw consent, contact care@pennydrop.in. Note that withdrawal of certain consents (e.g., credit bureau consent) may prevent us from processing your loan application.

11.5 Right to Grievance Redressal

You have the right to have any grievance relating to our data processing practices addressed. See Section 16 for our full Grievance Redressal Mechanism.

11.6 Right to Nominate

Under DPDPA 2023, you have the right to nominate an individual to exercise your data rights in the event of your death or incapacity. To register a nominee, contact care@pennydrop.in.

11.7 Right to Opt Out of Marketing

You have the right to opt out of receiving marketing and promotional communications at any time by:

• Clicking the unsubscribe link in any marketing email;
• Replying STOP to any marketing SMS;
• Updating your communication preferences in the Platform under Settings; or
• Contacting care@pennydrop.in with the subject line “Marketing Opt-Out.”

Opting out of marketing does not affect transactional or service-related communications, which are essential for your account and loan management.

11.8 How to Exercise Your Rights

To exercise any of the above rights, submit a request to:

• Email: care@pennydrop.in (subject: Data Rights Request)
• Email (Escalation): nodal.officer@pennydrop.in
• Address: Data Rights Team, Shankar Fininvest Private Limited, 160, First Floor, Gaffar Market, Karol Bagh, New Delhi, 110005

We may request identity verification before fulfilling any data rights request to protect against unauthorised access. We shall respond within 30 days of verifying your identity. Complex requests may take up to 60 days, in which case we will notify you.

12. CONSENT MANAGEMENT FRAMEWORK

12.1 How We Obtain Consent

We obtain consent for data processing in the following manner:

• At registration: through the in-App consent screen, you are presented with a clear, plain-language summary of data we collect and why; consent is recorded with a timestamp and device identifier;
• Before accessing credit bureau data: a separate, specific consent screen is presented with the name(s) of the CIC(s) to be accessed;
• Before Aadhaar e-KYC: a separate, specific consent screen is presented, meeting all UIDAI requirements for explicit and informed consent;
• Before using the Account Aggregator framework: a Consent Artefact is generated and presented for your review and approval;
• For marketing communications: a separate, optional opt-in checkbox is presented; this is NOT pre-ticked.

12.2 Records of Consent

We maintain auditable records of all consent obtained, including: the specific consent sought, the date and time of consent, the version of the privacy policy in force at the time, the channel through which consent was given, and any subsequent withdrawal of consent.

12.3 Withdrawal of Consent

You may withdraw any consent at any time as described in Section 11.4. We maintain records of consent withdrawals alongside original consent records. Withdrawal of consent for legally mandated processing (KYC/AML) is not possible but will be explained to you clearly.

12.4 Consequences of Withholding or Withdrawing Consent

If you withhold or withdraw consent for certain data processing activities, the specific consequence shall be communicated to you at the time of the consent request. For example:

• Withholding KYC consent: We cannot process your loan application;
• Withholding credit bureau consent: We cannot perform a credit assessment and the Lender cannot sanction the Loan;
• Withdrawing NACH mandate consent: Your scheduled EMIs will not be auto-debited; you must make manual repayments to avoid Default;
• Withdrawing marketing consent: You will stop receiving promotional communications; your loan account and services remain unaffected.

13. AUTOMATED DECISION-MAKING AND PROFILING

Credit assessment and fraud detection on the Platform involve the use of automated processes, including algorithmic credit-scoring models. Such automated processing may result in decisions that affect your ability to obtain a Loan.

In compliance with applicable law and RBI guidelines:

• You have the right to request human review of any automated decision that significantly affects you (e.g., loan rejection based solely on automated credit scoring);
• You may request an explanation of the factors considered in any automated credit decision by contacting care@pennydrop.in;
• The final credit sanctioning decision rests with the Lender (Regulated Entity) and involves human oversight.

⚠ Loan rejection or credit limit decisions are made by the Lender and may be based on credit bureau data, income assessment, and other factors. You have the right to access your credit bureau report and dispute inaccuracies directly with the relevant Credit Information Company.

14. THIRD-PARTY WEBSITES AND LINKS

The Platform may contain links to third-party websites, applications, or services (including social media platforms and partner websites). This Policy applies ONLY to the PennyDrop Platform. We do not control, and are not responsible for, the privacy practices or content of any third-party websites.

We strongly advise you to review the privacy policy of any third-party website you visit. We expressly disclaim all liability arising from your interaction with or reliance on any third-party website linked from our Platform.

15. COOKIES AND TRACKING TECHNOLOGIES

15.1 Types of Cookies Used

We use the following categories of cookies and similar technologies on the Platform:

15.2 Third-Party Cookies

Third-party service providers (such as analytics providers) may set their own cookies when you use the Platform. We do not control these cookies and recommend reviewing the privacy policies of such third parties. We disclaim liability for third-party cookie practices.

15.3 Cookie Management

You can manage your cookie preferences through:

• The cookie consent banner displayed when you first visit the Platform;
• Your browser's cookie settings (please note that disabling strictly necessary cookies may impair Platform functionality);
• The Privacy Settings section within the Platform (for registered Users).

Cookies do not access any personal data stored on your device beyond what you have consented to share with us.

16. USE BY MINORS AND INCOMPETENT PERSONS

The Platform and Services are intended exclusively for individuals who are:

• At least 21 years of age; and
• Legally competent to enter into binding contracts under the Indian Contract Act 1872.

The Platform is NOT intended for use by minors (persons below 18 years of age), un-discharged insolvents, persons of unsound mind, or any person otherwise legally incompetent to contract. We do not knowingly collect personal data from minors. If we become aware that personal data of a minor has been collected without verifiable parental consent, we shall promptly delete such data.

If you are a parent or guardian and believe your minor child has provided personal data to us, please contact us immediately at care@pennydrop.in.

17. CHANGES TO THIS PRIVACY POLICY

We reserve the right to update, amend, or replace this Policy at any time to reflect changes in applicable law, regulatory requirements, our Services, or our data practices. Changes shall be:

• Published on the Platform with a clear indication of the effective date and a summary of material changes;
• Notified to registered Users via SMS, email, or in-App notification at least 30 (thirty) days before the effective date for material changes;
• Effective immediately for minor or non-material changes upon posting.

Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy. If you do not agree to any material change, you must discontinue use and contact care@pennydrop.in to exercise your data rights (including erasure, subject to legal retention obligations).

18. GRIEVANCE REDRESSAL AND DATA COMPLAINTS

We are committed to addressing privacy and data-related complaints fairly and efficiently. The following escalation mechanism applies:

18.1 Step 1 — Customer Support

For any privacy or data-related query or complaint, first contact:

• Email: care@pennydrop.in
• Subject line: Data Privacy Complaint
• Hours: 09:00 AM to 06:00 PM, Monday to Saturday (excluding public holidays)

We shall acknowledge within 2 business days and endeavour to resolve within 10 business days.

18.2 Step 2 — Nodal / Grievance Officer

If unresolved within 10 business days or not satisfactory, escalate to the Nodal Officer:

18.3 Step 3 — Regulatory Escalation

If your complaint remains unresolved, you may approach:

• Data Protection Board of India (upon establishment): as prescribed under DPDPA 2023;
• RBI Ombudsman (for loan-related data complaints): https://cms.rbi.org.in | Toll-Free: 14440 | crpc@rbi.org.in;
• Consumer Disputes Redressal Commission: under Consumer Protection Act 2019, at District, State, or National level.

19. REGULATORY AND LEGAL FRAMEWORK

This Policy has been prepared in compliance with the following laws, regulations, and guidelines:

20. CONTACT US

ACKNOWLEDGEMENT

By continuing to use the PennyDrop Platform, you confirm that:

1. You have read and understood this Privacy Policy in its entirety;
2. You consent to the collection, use, storage, sharing, and processing of your personal data as described herein;
3. You are aware of and understand your rights as a Data Principal under the DPDPA 2023 and other applicable laws;
4. You understand that certain data processing activities are mandated by law and cannot be refused or withdrawn;
5. You acknowledge that this Policy is subject to change and that continued use of the Platform after any update constitutes acceptance of the revised Policy.