Privacy Notice

CapitalXB Finance Private Limited [CIN: U64990MH2023PTC412687] is a Non-Banking Financial Company (NBFC) registered with the Reserve Bank of India.

CapitalXB acknowledges the expectations of its customers regarding the privacy, confidentiality, and security of their personal information. Safeguarding customer data and ensuring it is used solely for legitimate business purposes, while preventing any misuse, remains a top priority for CapitalXB.

We collect only such personal data as is necessary for the specified and lawful purposes. Consent is obtained explicitly for usage of data.

(a) Data You Provide Directly

• a. Name, mobile number, email address, date of birth, gender, and address
• b. Login credentials and account details
• c. Identity and address verification data (PAN, Aadhaar-based verification)
• d. Financial and employment details (income, employer, bank account details)
• e. Information shared during communication through the Platform

(b) Data Collected with Your Consent

• a. Credit information from registered Credit Information Companies (CICs)
• b. Device and technical data (IP address, device ID, operating system)
• c. Transactional SMS data, limited strictly to loan-related verification
• d. Location data, only where required and expressly permitted
• e. Cookies and similar technologies for platform functionality

We do not access contacts, media files, call logs, biometric data, or non-essential device data, in compliance with applicable laws.

Your personal data is processed for the following purposes, which is expressly communicated to you:

• a. Digital onboarding, KYC, and identity verification
• b. Creditworthiness assessment and loan processing
• c. Facility disbursal, loan servicing, repayment, and customer support
• d. Regulatory/ credit bureau reporting and compliance with RBI and statutory requirements
• e. NACH mandate registration and debit processing
• f. Sharing with other lenders
• g. Recovery and collection management
• h. Audit and legal compliance
• i. Fraud prevention, cyber-security, and platform integrity

Personal data will not be used for any purpose incompatible with the above unless fresh consent is obtained.

We collect personal data:

• a. Directly from you – through loan application forms, KYC documents, mobile app, web portal, or branch interactions;
• b. From third parties — credit bureaus, account aggregators, employers, co-applicants, guarantors, and reference checks;
• c. From public sources — MCA21, GST portal, CERSAI, court records (for due diligence)
• d. Through automated means — cookies, device identifiers, location services (where consent is obtained)

Consent under this Platform is:

• a. Free, specific, informed, unconditional, and unambiguous
• b. Collected through a clear affirmative action
• c. Granular, allowing you to permit or deny specific data uses
• d. Withdrawable at any time, with ease comparable to giving consent

Withdrawal of consent may affect the continuation of services, but will not affect processing already lawfully undertaken.

Your personal data may be shared strictly on a need-to-know basis and only for the stated purposes with:

• a. RBI-regulated banks, NBFC partners, and co-lenders
• b. Lending Service Providers (LSPs) engaged under written agreements
• c. Credit Information Companies and verification agencies
• d. IT, cloud, and analytics service providers supporting the Platform
• e. Government or regulatory authorities where legally required

All personal data collected through the Platform is:

• a. Stored securely on servers located in India
• b. Protected using reasonable security safeguards as mandated by law

No payment or financial data is stored or permanently processed outside India and is maintained in accordance with the applicable RBI data localisation requirements.

Personal data is retained only for as long as necessary to:

• a. Provide services
• b. Comply with RBI, legal, regulatory, and audit requirements
• c. Resolve disputes or grievances

Data is securely deleted or anonymised once retention is no longer required.

• a. In the event of a personal data breach that affects your personal data, CapitalXB will, to the extent required under applicable law, notify you without undue delay using the contact details available to us, such as through your registered email address, phone number, or user account on the Platform.
• b. We will also notify the Data Protection Board of India and any other competent authority, where required under applicable laws. CapitalXB takes reasonable security safeguards and incident-response measures to prevent, detect, investigate, and remediate personal data breaches in accordance with applicable law.

You have the right to:

• a. Access information about your personal data
• b. Request correction or erasure of inaccurate or outdated data
• c. Withdraw consent at any time
• d. Register grievances and receive timely redressal

You may also nominate a person to exercise your rights in accordance with the DPDP Act.

In accordance with the DPDP Act and RBI Directions, we have appointed a Nodal Grievance Officer.

You also retain the right to file a complaint with the Data Protection Board of India, if you do not receive a response from us within 30 days or if you are not satisfied with the resolution provided. Complaints may be filed through the dpdpa-grievance.gov.in portal or other mechanism notified by the Data Protection Board, or through any other mode as prescribed under applicable data protection laws.

This Privacy Notice may be updated to reflect changes in law, regulation, or business practices. The latest version will always be available on the Platform and will become effective upon publication on the Platform.

We want you to know first about any new products and/or services from us and any offers from us or our partners. We may share these offers with you only with your prior consent. You can unsubscribe from receiving these offers by e mailing us. Please note, if you don’t choose to receive this information, we will be unable to keep you informed of new services, products, events or special offers that may interest you.

The Platform may contain links to other sites. If you click on a third party link, you ay be directed to that site. The external sites are not operated by us and is beyond our control. Therefore, we request you to please review the privacy terms and policy of such external websites before you use those sites. We assume no responsibility for the content or privacy of data shared in any such third party sites or services.

While visiting and using the Platform, you agree not to indulge in any means (including hacking, cracking or defacing any portion of the Platform or website) in illegal/ unauthorised activities, including:

• (a) Restrict or inhibit any authorised user from accessing the Platform;
• (b) Use the Platform for unlawful purposes;
• (c) Collect information about application or Platform users without their express consent;
• (d) Engage in spamming or flooding;
• (e) Transmit any software or other materials containing virus or other harmful or disruptive component;
• (f) Permit or help anyone without access to use the Platform with your username and credentials.

User acknowledges the following:

• (a) User will use only the official website and Platform for availing products and services from Us;
• (b) User is completely aware of the potential risk of data/ privacy breach and shall be fully responsible for any authorised disclosure of personal information or user ID or credentials etc. We will not be liable to the User for any loss to the User due to User’s conduct.
• (c) User shall exercise utmost caution while using the Platform and sharing any information, including personal data/information.
• (d) User shall not use any third-party extensions, plug-ins or add-ons on the web-browser or Platform, this may result in tracking or staling of Users’ credentials.
• (e) User will type the information and not sue auto-fill option to present risk of storage of information.
• (f) User shall not access any darknet, unauthorised/suspicious/malicious website or online Platforms or download information from unreliable sources.

For any privacy related requests, guidance or complaints: