Privacy Policy

MBOX Capital Advisory Private Limited

This Privacy Policy explains how MBOX Capital Advisory Private Limited ("MBOX", "we", "us" or "our"), CIN [Company Identification Number], having its registered office at Prakruthi, 25/1, 1st Floor, Shama Rao Compound, Mission Road, P, Kalinga Rao Rd, Bengaluru, Karnataka 560027, collects, uses, shares, stores and protects personal information when you use:

• the MBOX Capital mobile application on the Google Play Store (the "App");
• our web application at https://app.mboxcapital.com (the "Web App");
• our website at https://mboxcapital.com (the "Website"); and
• any other channel through which you apply for or enquire about a financial product through MBOX, including through our channel partners, referral partners and Direct Selling Agents,

together, the "Services".

This Privacy Policy should be read together with the MBOX Master Customer Declaration, Consent, Privacy Notice and Terms of Use (the "Master Consent"), which you review and accept when you submit an application. The Master Consent also contains the terms of use, declarations, limitation of liability, indemnity and dispute-resolution terms that apply to you. The version you accept is recorded electronically, and you may request a copy of it at any time (see Section 19).

This Privacy Policy is available in English and, on request, in other languages listed in the Eighth Schedule to the Constitution of India as made available by MBOX.

1. About MBOX and Our Role

MBOX operates as a Loan Service Provider (LSP), Direct Selling Agent (DSA), sourcing partner, referral partner, distributor, facilitator, technology platform and service provider for financial products and services. We introduce, source, support and process applications for loans, credit cards, insurance, mutual funds, investment, wealth and other financial products offered by banks, Non-Banking Financial Companies (NBFCs), housing finance companies, co-lending institutions, insurance companies, asset management companies and other regulated institutions ("Partner Institutions").

MBOX is not a lender and does not presently operate as a lender. We do not guarantee approval, sanction, issuance or availability of any financial product. All decisions on approval, pricing, tenure, limits, terms, issuance or rejection are made solely by the relevant Partner Institution.

Our current lending Partner Institutions are: [List of partner banks / NBFCs].

Future regulated entities: MBOX may in the future establish or acquire regulated lending or financial-services entities. If it does, and those entities are lawfully authorised, your information may be processed through them for assessment, servicing and product offerings, subject to applicable law and this Privacy Policy as updated at that time.

2. Whose Information This Policy Covers

This Privacy Policy applies to every individual whose information is provided to MBOX in connection with a financial product, including the applicant, co-applicant, guarantor, proprietor, partner, director, authorised signatory and beneficial owner (each, a "Customer"), and to users of our Services.

If you give us information about another person, such as a co-applicant, guarantor, family member, employer contact or reference, you confirm that you have their permission to share it and that you have told them how it will be used as described in this Privacy Policy.

3. Information We Collect

We collect only the information reasonably needed to provide the Services, evaluate and facilitate your application, and meet our legal and regulatory obligations. Collection is need-based, purpose-specific and done with your consent. Information may be collected and processed electronically, digitally, manually or through automated systems.

3.1 Information you provide

Personal and contact information:

• Name, title, gender, date of birth and marital status
• Father's name and mother's name
• Mobile numbers (primary and alternate) and email addresses (personal and official), verified by OTP
• Current and previous residential address, duration of stay, and other identification details

Identity and KYC information:

• PAN and a copy of your PAN card
• Aadhaar number and a copy of your Aadhaar card, where legally permissible (see Section 8)
• CKYC records
• Passport, driving licence, voter ID, utility bills and other officially valid documents where required

Financial information:

• Income, salary, gross and net take-home salary, other income and salary mode
• Existing EMIs and financial obligations
• Bank account details, bank statements, account transaction data and financial statements
• Credit history and credit score information
• Payment mandate details (such as e-NACH, ECS, standing instructions or UPI AutoPay) where you set these up

Employment and business information:

• Employment type, employer name, designation, industry, employment status, date of joining and work experience
• For self-employed applicants and businesses: business type, ownership, year of establishment, GST registration and information, business registrations, business financial statements and business banking information

References and related persons:

• Names and contact details of personal, professional, trade or business references
• Details of co-applicants, guarantors and other related persons, where applicable

Application information:

• Product applied for, loan amount and tenure, preferred branch and referral source
• Application status, history and documents submitted

Communication information:

• Emails, chats, customer-service interactions and call records (see Section 15)

3.2 Verification information

Where required for verification, and with your consent:

• Live photographs, face-match and liveness-check results
• Video KYC and other audio, video or screen recordings
• Geo-tagging data captured during verification
• Employment, business, reference, residence, office and field verification reports

3.3 Information collected automatically

• IP address, device information, browser information and app version
• Session information, log information, crash and diagnostic data and technical identifiers
• Consent records: the date and time of acceptance, IP address, device reference, OTP verification reference, application reference number and the version of the Master Consent you accepted

3.4 Information from third parties

With your consent, and only as needed, we or our Partner Institutions may obtain information about you from:

• Credit Information Companies (see Section 7);
• The CKYC registry, DigiLocker, government and regulatory databases, verification service providers and authorised data repositories;
• Account Aggregators, under a separate consent you give within the Account Aggregator framework (see Section 10);
• Employers, accountants, auditors, references and verification agencies (see Section 9);
• Sanctions, politically exposed person (PEP), adverse media and watchlist sources (see Section 12); and
• Channel partners, referral partners and DSAs, where you apply through them (see Section 14).

3.5 Information we derive

We generate analytical outputs from the information above, such as eligibility and affordability assessments, risk and fraud indicators, risk scores, propensity scores and product-matching results (see Section 11).

3.6 Information we do NOT collect

We do not access, collect or store your mobile phone's contact list, call logs, SMS, media files, photo gallery or telephony functions. We do not collect or store Aadhaar biometric information. When you upload a document, we receive only the specific file you choose.

4. App Permissions

The App currently does not request any device permissions. It uses internet access only to connect to our servers, which is granted automatically by your device and does not give the App access to your personal data on the device.

If a future version of the App needs a device permission, it will be limited to one-time access where operationally required, for example camera access to capture KYC documents or location for onboarding due diligence, in line with RBI digital lending directions. Before such a version is released, we will update this Privacy Policy, and the App will ask for your explicit prior consent before the permission is used. You can manage permissions in your device settings at any time.

5. How We Use Your Information

We use your information for:

• Account and onboarding: creating and managing your account, verifying your mobile number and email, and authenticating you;
• Identity verification and KYC: customer due diligence and KYC compliance;
• Credit assessment and eligibility: assessing creditworthiness, repayment capacity and eligibility, and supporting underwriting by Partner Institutions;
• Product recommendation and matching: identifying suitable loans and, where legally permissible, evaluating your suitability for insurance, investment and other non-lending financial products;
• Application processing: submitting your application to one or more Partner Institutions and tracking its status;
• Alternative lender routing: where an application is rejected, withdrawn or expires, a product is unavailable, or a more suitable product may be available, evaluating it with other Partner Institutions using information and documents you have already provided;
• Servicing, collections and recovery: supporting the servicing of financial products, including payment mandates you set up, and communications by Partner Institutions and their authorised agents about repayment, overdue amounts, collections, recovery, settlement and restructuring;
• Portfolio monitoring and risk management: ongoing monitoring during the application, customer-relationship and servicing lifecycle;
• Fraud prevention and AML compliance: preventing, detecting and investigating fraud, identity theft, document manipulation, money laundering and other unlawful activity (see Section 12);
• Customer support: responding to your requests, queries and grievances;
• Analytics and reporting: analysing and improving our Services and producing internal reports;
• Compliance, audit and disputes: meeting legal, regulatory and audit requirements, regulatory reporting, and resolving disputes; and
• Marketing and cross-sell: sending you communications about financial products, only if you have opted in (see Section 16).

6. Consent

We process your information on the basis of the consent you give through the Master Consent and, where applicable, for purposes permitted by law, such as compliance with legal obligations.

The Acceptance and Consent Matrix in the Master Consent separates your consents into:

• Required consents: needed to process your application, including customer declaration, KYC and verification, financial data, analytics, fraud prevention, multi-lender sharing, servicing, electronic records, and credit bureau enquiry, refresh and monitoring; and
• Optional consents: which you may decline without affecting your application, such as marketing communications and sharing with future group entities (see Section 16).

7. Credit Information

With your consent, MBOX, our Partner Institutions and authorised service providers may obtain, access and use your credit information and credit reports from one or more Credit Information Companies registered under the Credit Information Companies (Regulation) Act, 2005. This is used for eligibility assessment, credit evaluation, product recommendation, underwriting support, risk assessment, fraud prevention, portfolio monitoring, servicing and regulatory compliance.

• Enquiries may be recorded by the Credit Information Company and may form part of your credit history.
• Credit information may be periodically obtained, refreshed and reviewed throughout the application, customer-relationship and servicing lifecycle, and for as long as reasonably required for lawful purposes, including collections and regulatory compliance.
• Relevant application information may be shared with Credit Information Companies where required by law, regulation or contract.

8. PAN and Aadhaar

• PAN and Aadhaar details and documents are used only for lawful identity verification, KYC, compliance and onboarding, and records are maintained as required by law.
• Submitting Aadhaar may be voluntary in some cases, and other officially valid documents may be accepted where permitted.
• Aadhaar is verified only through legally permissible mechanisms. Nothing we do is intended to permit any activity prohibited by Aadhaar-related laws, regulations or directions.
• PAN and Aadhaar numbers and documents are stored in encrypted form, and Aadhaar numbers are masked or redacted in stored records in accordance with UIDAI requirements.
• PAN, Aadhaar, date of birth and parents' names are not displayed on your dashboard or profile screens in the App or Web App.

9. KYC and Verification Methods

With your consent, MBOX, Partner Institutions and authorised verification agencies (including field investigators, tele-verifiers and data providers) may:

• Verify PAN, CKYC records, Aadhaar (where permissible), passport, driving licence, voter ID, utility bills, GST records, business registrations and other government-issued documents;
• Retrieve information from government databases, regulatory databases, CKYC systems, DigiLocker and authorised data repositories, where legally permissible;
• Conduct Video KYC, digital KYC, live photograph capture, face-match and liveness checks, electronic document verification and geo-tagging where required;
• Verify employment, business and references, including by contacting employers, accountants, auditors and references; and
• Conduct residence, office and business verification, tele-verification, physical verification, field investigation and site visits where reasonably required.

Verification may be done electronically, digitally, physically or through third-party agencies. Verification records, including Video KYC recordings, are kept for compliance, audit, fraud-prevention and evidentiary purposes.

10. Bank Statements and Account Aggregator

With your consent, we and Partner Institutions may access your bank statements, account transaction data, financial statements, GST information, cash-flow information and banking relationships through documents you upload, the Account Aggregator framework, banking APIs, electronic statements or other lawful consent-based methods.

This information is used for income estimation, eligibility determination, credit assessment, fraud detection, risk scoring, underwriting support, regulatory compliance and portfolio monitoring. Account Aggregator access is governed by the separate consent artefact you approve within that framework.

11. Analytics, Derived Insights and Automated Processing

We, our service providers and Partner Institutions may use technology-enabled systems, including rule engines, decision engines, bank statement analysers, credit scoring and risk models, machine learning, artificial intelligence, fraud detection systems, recommendation engines and workflow automation, to:

• Categorise transactions and analyse income and expenditure patterns;
• Assess repayment capacity, affordability and eligibility;
• Identify risk and fraud indicators and suspicious activity;
• Generate risk scores, propensity scores and eligibility assessments;
• Carry out customer segmentation, behavioural analysis and financial profiling; and
• Match you with and recommend potentially suitable products.

These assessments assist decision-making and do not guarantee approval of any product. If you have a question or concern about a decision supported by automated systems, you can raise it through our grievance process (Section 20).

The analytical models, algorithms, methodologies and derived outputs created by MBOX are MBOX's proprietary and confidential information. Your right to access information about you (Section 19) covers the personal information we hold, but does not transfer ownership of these proprietary materials to you.

12. Fraud Prevention and Anti-Money Laundering

To prevent and detect fraud, identity theft and money laundering, MBOX, Partner Institutions and authorised service providers may carry out document authentication, risk management, suspicious-activity review and cybersecurity monitoring, and may conduct sanctions, politically exposed person (PEP), adverse media and watchlist screening as required by law and compliance policies.

Where fraud, forgery, impersonation, identity theft, document manipulation, misrepresentation or other unlawful conduct is identified or reasonably suspected, MBOX may:

• Decline the application, or suspend or terminate the relationship;
• Restrict access to products and services;
• Maintain internal fraud-prevention and risk-management records; and
• Share relevant information with Partner Institutions, verification agencies, Credit Information Companies, other financial institutions, regulators, law enforcement agencies and competent authorities, as permitted by law.

13. How We Share Your Information

We do not sell your personal information. We share it only where needed for the purposes described in this Privacy Policy and the Master Consent:

• Partner Institutions: banks, NBFCs, housing finance companies, co-lending institutions, insurance companies, asset management companies, mutual fund entities and distributors, wealth management platforms and other regulated institutions, for eligibility assessment, product matching, credit evaluation, underwriting, issuance, servicing and compliance. Your information may be shared with more than one institution where reasonably needed to identify a suitable product.
• Credit Information Companies (see Section 7).
• Verification agencies and KYC providers (see Section 9).
• Technology and service providers: cloud hosting, data storage, SMS, email and OTP delivery, analytics and customer-support tools that process data on our behalf under confidentiality and data-protection obligations.
• Channel partners, referral partners and DSAs (see Section 14).
• Co-lenders, assignees and related parties: where a Partner Institution assigns, transfers, co-lends, securitises or sells a financial product or its receivables, information may be shared with participating lenders, assignees, transferees, investors, trustees and servicing providers involved, as permitted by law.
• Collection agencies and servicing partners appointed by Partner Institutions, in line with applicable fair practices codes.
• Auditors and legal advisors.
• Regulators, courts, tribunals, law enforcement and government authorities, where required by law.
• Group entities: present and future affiliates, subsidiaries and group entities of MBOX, only if you have opted in (see Section 16).

Information and documents may be exchanged digitally, through API and loan-origination-system integrations, secure portals, encrypted channels and email, or physically, through scanned copies, physical document movement and courier, as reasonably needed to process, verify or service your application.

14. Channel Partners, Referral Partners and DSAs

Your application may be introduced, referred, sourced or supported by our channel partners, referral partners, DSAs, business correspondents, sales representatives and other authorised intermediaries. These parties may collect your information and submit it to MBOX solely to facilitate financial products and services, including helping with documents, application support, servicing and communication.

Information and documents submitted on your behalf by such an authorised party are treated as submitted with your knowledge and consent. Where you applied through a DSA, that DSA can view the status of the application they submitted for you.

15. Communications and Recordings

We, our group entities, authorised partners and service providers may contact you about your application, servicing, compliance and support by phone, SMS, email, WhatsApp, in-app or push notifications, video calls, chat platforms and post, using the contact details you provide. This includes requests for additional information, status updates and coordination with Partner Institutions.

Telephone calls, customer-service interactions, audio and video recordings, screen recordings, Video KYC sessions and digital interactions may be recorded for compliance, quality assurance, fraud prevention, customer service, employee training, internal audits, process improvement, operational monitoring, dispute resolution, legal evidence and regulatory purposes. Recordings are retained as required by law. Marketing communications are covered separately in Section 16.

16. Optional Consents: Marketing and Group Entities

The Consent Matrix in the Master Consent asks you separately about two optional items. You can decline either one without affecting your application, and withdraw it at any time (see Section 19):

• Marketing, cross-sell and upsell communications: about present and future financial products, including loans, credit cards, insurance, investment, wealth, financial planning, protection and savings products. If you opt in, this is treated as express consent for commercial communications under the TRAI Telecom Commercial Communications Customer Preference Regulations, even if your number is registered on the Do-Not-Disturb (DND) registry, until you withdraw it.
• Sharing with future affiliates, subsidiaries and group entities: of MBOX, such as associate companies, joint ventures, technology or distribution entities and future lending entities, where reasonably needed for servicing, compliance, risk management, analytics, product facilitation or operations, and only as permitted by law.

17. Data Storage and Security

Storage location: Data relating to lending activities is stored on servers located in India, in accordance with RBI directions. Information may be processed, stored, archived and backed up through secure technology infrastructure, cloud service providers, data centres and disaster-recovery environments engaged by MBOX, in line with legal, contractual and information-security requirements.

Security: We use reasonable security practices, including encryption of data in transit and at rest, role-based access controls and security monitoring. Access to personal information is limited to authorised personnel and service providers who need it to perform their duties.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify you and the relevant authorities as required by law.

18. Data Retention

We retain information, documents, communications and verification records only for as long as necessary for business purposes, regulatory compliance, audit, legal obligations, fraud prevention, risk management, customer servicing, business continuity and dispute management, or longer where required by applicable law, including the Prevention of Money Laundering Act, 2002 and RBI directions. After that, information is erased or anonymised in accordance with our data retention policy and applicable data protection law.

Our obligations relating to privacy, confidentiality, fraud prevention, data retention, regulatory reporting and evidentiary records continue after your application is rejected, withdrawn, closed or completed, to the extent permitted by law.

19. Your Rights

Subject to applicable law, you may:

• Access: request a summary of the personal information we hold about you and how it is processed;
• Correct: request correction, completion or updating of inaccurate or incomplete information;
• Erase: request erasure of personal information that is no longer necessary for the purpose for which it was collected, subject to retention required by law (see also Section 21);
• Withdraw consent: withdraw your consent at any time. Withdrawal is as easy as giving consent. It does not affect processing already carried out, and it may affect our ability to process or service your application. We may continue to retain information where required by law, regulation, contract, audit, fraud prevention, dispute resolution, legal proceedings or regulatory reporting;
• Nominate: nominate another person to exercise your rights in the event of your death or incapacity;
• Get a copy of your consent: request a copy of the consent record and the version of the Master Consent you accepted;
• Raise a grievance: complain to us, and escalate unresolved privacy grievances to the Data Protection Board of India (see Section 20); and
• Exercise any other rights available under applicable law.

To exercise any of these rights, email info@mboxcapital.com or contact our Privacy Officer (Section 20). We may need to verify your identity before acting on a request.

20. Grievance Redressal

We will acknowledge your grievance promptly and try to resolve it within 30 days of receipt, or any shorter period prescribed by regulation.

If a grievance about a digital lending transaction is not resolved within this period, you may escalate it to the concerned Partner Institution's nodal grievance redressal officer, and then to the Reserve Bank of India under the Reserve Bank – Integrated Ombudsman Scheme, 2021, through the RBI Complaint Management System at https://cms.rbi.org.in. Unresolved privacy grievances may be escalated to the Data Protection Board of India.

21. Deleting Your Account

You can request deletion of your MBOX account and associated personal data at any time.

Send an email to info@mboxcapital.com from your registered email address with the subject "MBox Account Deletion Request", including your registered mobile number, registered email address and full name. You can also start this request from Profile → Delete account in the App, or visit https://app.mboxcapital.com/delete-account/.

To protect your account, we will verify your identity by sending a confirmation to your registered mobile number or email before processing the request. Once verified, we will process deletion of your account and associated data within 7 days. Some information may be retained where required for legal, regulatory, security, fraud-prevention or other legitimate compliance purposes, as described in Section 18.

Deleting your MBOX account does not cancel any loan or other product already sanctioned or issued by a Partner Institution. Information held by a Partner Institution is governed by that institution's own privacy policy.

22. Electronic Records and E-Sign

Your acceptance through OTP verification, click-wrap, digital acknowledgement, electronic signature, e-sign or other electronic methods is a valid and enforceable consent. System-generated records such as OTP logs, timestamps, IP logs, device identifiers, audit trails, application logs and communication logs may be used as evidence of your consent, acceptance and transaction activity, to the extent permitted by law.

23. Accuracy of Information

You are responsible for ensuring that the information and documents you provide are true, complete, accurate, current and genuine. False declarations, forged documents, impersonation or misrepresentation may lead to rejection of your application, reporting to relevant authorities and legal proceedings, as set out in the Master Consent. You can update your information at any time (see Section 19).

24. Age Restriction

The Services are intended only for individuals who are 18 years of age or older and legally competent to enter into a contract. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly.

25. Cookies

Our Website and Web App use essential cookies needed for login, security and session management, and may use analytics cookies to understand how the site is used. You can control cookies through your browser settings. Disabling essential cookies may stop parts of the Web App from working.

26. Third-Party Websites

The Services may contain links to websites of Partner Institutions or other third parties. Their handling of your information is governed by their own privacy policies, and we encourage you to read them.

27. Changes to This Privacy Policy

We may update this Privacy Policy and the Master Consent from time to time. Updated versions will be published on the Website, in the App and through other lawful channels, with a revised "Last Updated" date. For material changes, we will notify you in the App or by email and, where required by law, ask for your consent again. We maintain version-controlled records of this Privacy Policy and the Master Consent.

28. Legal and Regulatory Framework

This Privacy Policy is published in accordance with, and is interpreted under, applicable laws and regulatory directions as amended from time to time, including:

• The Digital Personal Data Protection Act, 2023 and the rules framed under it;
• The Information Technology Act, 2000 and the rules framed under it;
• The Credit Information Companies (Regulation) Act, 2005;
• The RBI Master Direction – Know Your Customer (KYC);
• RBI directions and guidelines on Digital Lending;
• The Prevention of Money Laundering Act, 2002 and the rules framed under it;
• The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and related regulations, where applicable;
• The TRAI Telecom Commercial Communications Customer Preference Regulations, as applicable to commercial communications;
• The Reserve Bank – Integrated Ombudsman Scheme, 2021;
• Consumer protection laws; and
• Applicable information-security and cyber-security requirements.

29. Governing Law and Disputes

This Privacy Policy is governed by the laws of India. Disputes are resolved as set out in the Master Consent, which provides for arbitration under the Arbitration and Conciliation Act, 1996, with the seat and venue in Bengaluru, Karnataka, subject to applicable law.

30. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: