Privacy Policy

1. Use of Our Platform or Services

This Privacy Policy is incorporated into and at all times is subject to and is to be read in conjunction with the Terms.

You hereby expressly consent to provide below mentioned information to Us for the purpose of providing the Services to You. If You disagree with any of the terms mentioned herein, please do not proceed with the usage of the Services.

For the Users consenting to continue accessing the Platform and availing the Services, this Privacy Policy explains our policies and practices regarding the collection, usage, and disclosure of Your information.

2. Collection of Information

3. Storage of Information

We store Your information in the servers located within India.

We ensure that no biometric data belonging to You shall be collected by our DLA or stored by our LSP through DLAs. In case, if any of our representatives ask for the same from You, We request You to kindly refrain from doing the same and address this concern to our Grievance Officer (the details of the same have been provided below in Clause 12).

We further ensure that our LSP complies with all mandatory technology standards, requirements on cybersecurity guidelines stipulated by RBI and other regulators /agencies, or as may be specified from time to time, for undertaking digital lending Services.

We retain any data or information provided by You for the period mandated under applicable law. Our data retention policy is restricted to our provision of Services. You can request deletion of Your information from us at any stage. Our data retention and deletion policies are in consonance with applicable laws including relevant guidelines of the RBI.

In the event of a data breach, We act swiftly to contain and investigate the incident. We report incidents to CERT-IN within 6 (six) hours of discovery and notify regulatory bodies, impacted customers, and other relevant parties as required. Corrective actions are taken to strengthen security, and We provide support to affected customers as necessary.

4. Data Retention Guidelines

Personal data shall not be retained beyond the applicable retention period, except where:

• a) retention is required for the resolution of an ongoing dispute or legal proceeding;
• b) a competent regulatory authority has directed retention of the data; or
• c) the Customer has not yet repaid the loan in full, in which case such data as is necessary for the administration of the outstanding facility shall be retained until repayment is completed.

Anonymized Data: Personal data that has been irreversibly anonymized, such that it can no longer be used to identify any individual, ceases to constitute personal data for regulatory purposes. We may retain anonymised or aggregated datasets for internal analytics and statistical purposes following the expiry of the applicable retention period.

5. Data Deletion and Destruction Protocol

Upon expiry of the applicable retention period for each category of personal data, We follow the structured destruction process set out below:

• a) Digital data: Digital data stored on Our servers shall be permanently and irreversibly deleted using industry-standard secure deletion processes.
• b) Physical documents: Where physical documents containing personal data have been generated, such documents shall be destroyed by certified shredding through an authorised disposal vendor.
• c) Third-party and LSP notification: Third-party service providers and the LSP/Affiliate/DLA/DSA holding personal data on Our behalf shall be formally notified and instructed to destroy all such data within 30 days of the expiry of the applicable retention period.
• d) Backup copies: Backup copies of personal data shall be purged within the scheduled backup rotation cycle following the expiry of the retention period.
• e) Destruction log: A destruction log shall be maintained as a permanent compliance record and shall not itself be subject to destruction. At minimum, the log shall record: the category of data destroyed, the volume or identifiers of records destroyed, the method of destruction employed, the date of destruction, and the name and designation of the authorised personnel who certified the destruction.
• f) Suspension of destruction: In the event of any litigation, regulatory investigation, dispute or other proceeding that is ongoing or reasonably foreseeable (each, a "Suspension Event"), destruction of all records that are or may be relevant to such Suspension Event shall be immediately suspended. Scheduled purges shall not proceed in respect of such records until the Suspension Event has been fully resolved and Our legal function has confirmed in writing that destruction may resume.

Right to request deletion: You may request the deletion of Your personal data by writing to us at tech@btfinance.in. We will process such request subject to the following conditions:

• i. any loan facility availed by You must be fully repaid before deletion of loan account data can be processed;
• ii. We shall retain such data as is required under applicable laws, including the Prevention of Money Laundering Act, 2002 and RBI guidelines, for the statutory minimum period, regardless of a deletion request; and
• iii. We shall communicate to You the categories of data that cannot be deleted and the reason therefor within 30 days of receipt of such request.

6. Use of Information Collected by BT Finance

The information collected from You will be used by BT FINANCE for the following purposes:

• i. To provide Services You have requested;
• ii. To establish identity, conduct KYC and verify the same in compliance with the applicable laws;
• iii. To resolve disputes and help investigate violations of our Terms or to defend against legal claims;
• iv. To disclose the information under special circumstances such as compliance with the applicable local law, court summons, court orders, requests/order from legal authorities or law enforcement agencies requiring such disclosure;
• v. To assess Your creditworthiness for providing the Services;
• vi. To get in touch with You (either directly or through our partners, agents, or LSPs) when necessary and contact You by email, SMS, letter, WhatsApp, telephone or in any other way about our products and Services, including for any transaction, promotion activity, marketing and/or commercial communications in relation thereto;
• vii. To identify, prevent, detect or tackle fraud, money laundering, terrorism and other crimes;
• viii. To identify, develop or improve products, that may be of interest to You;
• ix. To perform other administrative and operational purposes including the testing of systems;
• x. To recover any payments You owe to us or to our partners;
• xi. To undertake filing of records with the relevant government / Statutory authorities in compliance with the applicable laws;
• xii. Comply with our regulatory and legal obligations;
• xiii. To maintain records under applicable law or a may apply to pursuant to agreements executed by BT FINANCE;
• xiv. To carry out, monitor and analyse our business, carry out audits, market research, business, and statistical analysis and also direct our efforts for product improvement; and
• xv. To design and offer customized products and services. We collect all data and other necessary information under this Privacy Policy or otherwise on a need basis required for the above intended purposes in compliance with applicable laws.

7. Disclosure of Information

We will share Your information that We collect (except for any device information) only in such manner as described below and limited to the extent required for providing the Services (including through partners of BT FINANCE):

• i. We disclose and share Your information with our LSPs, partner banks, data processors, financial institutions, credit bureaus and other third-party partners (such as Direct Sales Agents ('DSA') and Debt Recovery Agents ('DRAs')) for facilitation and recovery pertaining to loan or facility or line of credit or purchase of a product.
• ii. To enable our third-party partners to contact You or to respond to Your queries / comments, for promotional offers or to resolve service issues to serve You better.
• iii. We will disclose the data or information provided with other technology partners to track how You interact with the Platform on our behalf.
• iv. We and our affiliates may share Your information with other business entity should We (or our assets) merge with, or be acquired by that business entity, or re-organization, amalgamation, restricting of business for continuity of business. Should such transaction occur than any business entity receiving any such information from us shall be bound by this Privacy Policy with respect to Your information.
• v. We may share Your personal information upon receipt of notice/communication/ order, as a part of our legal obligations and as per applicable laws with the government /quasi government authorities, judicial / quasi-judicial authorities.
• vi. By using our Services, You hereby provide Your consent to disclose Your personal information for the above-mentioned purposes. Any disclosure to third parties is subject to the following:
  • a) If We are under a duty to disclose or share Your personal data in order to comply with any legal or regulatory obligation or request, We shall not seek Your explicit consent however We shall reasonably endeavor to notify the same to You accordingly as the case may be;
  • b) We shall take Your express consent in the event We share Your personal data with third parties;
  • c) We shall share Your information with third-party only on a need basis and only for the purpose stated hereunder, as per the applicable laws.
  • d) We shall additionally seek express consent through a specific consent for at appropriate stages of data collection, if required under applicable laws.
  • e) Usage of Your information by such third parties is subject to their privacy policies. We share information to the extent required. We also suggest You go through the privacy policies of such third parties. The list of our lending service providers and digital lending applications of our lending service providers (as amended from time to time) are accessible on our Website at btfinance.in

8. Information Security

BT FINANCE intends to protect Your information and to maintain its accuracy as confirmed by You. We implement reasonable physical, administrative and technical safeguards to help us protect Your information from unauthorized access, use and disclosure. For example, We encrypt all information when We transmit the data in digital form. We also require that our registered third-party service providers protect such information from unauthorized access, use and disclosure.

BT FINANCE has adequate security measures in place to protect the loss, misuse and alteration of information under control. We endeavor to safeguard and ensure the security of the information provided by You. We use Secure Sockets Layers (SSL) based encryption, for the transmission of the information, which is currently the required level of encryption in India as per applicable laws.

We blend security at multiple steps within our products with state of the art technology to ensure our systems maintain strong security measures and the overall data and privacy security design allow us to defend our systems ranging from low hanging issue up to sophisticated attacks.

We aim to protect from unauthorized access, alteration, disclosure or destruction of information We hold, including:

• i. Encryption of data to keep Your data private while in transit;
• ii. Security feature like an OTP verification to help You protect Your account;
• iii. Review our process of collection, storage, and processing practices, including physical security measures, to prevent unauthorized access to our systems;
• iv. Restricted access to personal information to our staff, representatives, contractors, and agents who need that information in order to process it. Anyone with this access is subject to strict contractual confidentiality obligations and suitable disciplinary action taken, in case if they fail to meet these obligations;
• v. Compliance & cooperation with regulations and applicable laws;
• vi. Periodic review of this Privacy Policy and make sure that We process Your information in ways that comply with it.
• vii. Non-disclosure of Aadhaar number in any manner. We comply with legal frameworks relating to the transfer of data as mentioned and required under the Information Technology Act, 2000, rules and the amendments made thereunder.
• viii. On receipt of formal/ written complaints, We respond by contacting the person who made the complaint. We work with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of Your data that We cannot resolve with You directly.

9. Changes in Privacy Policy

Our Privacy Policy might change from time to time, and BT FINANCE will provide notice of it on Your email address linked to Your Platform account or can be seen by You in our Platform. We encourage You to periodically review the Platform for the latest information on our privacy practices. Users are bound by any changes to the Privacy Policy hosted / made available on the Platform.

10. Cookies

The Platform uses temporary cookies to store certain data that is used by us for maintenance of the Platform and its features as well as for research and development. We do not store personal/identity information in the cookies.

The cookies shall not provide access to data in Your device such as email addresses or any other data that can be traced to You personally. The data collected by way of cookies will allow the Platform to provide more enhanced and personal features, enabling delivery of more User-friendly services.

Most devices allow You to configure settings to notify You when a cookie is received or to block cookies altogether. However, disabling cookies may restrict the functionality and features available on the Platform or limit access to certain Services. Additionally, some pages on the Platform may include cookies or similar technologies implemented by third parties. Please note that We do not control the use of cookies by these third parties.

11. Third Party SDKs and Other Sites

The Platform has a link to registered third party software development kits ("SDKs"), Application Programming Interface ("API") integrations, redirections which collects data on our behalf and data is stored to a secured server. We ensure that our third-party service providers take extensive security measures in order to protect Your personal information against loss, misuse or alteration of the data as required under the applicable laws.

However, We are not responsible for the privacy practices or the content of those linked websites. With this Privacy Policy, We are only addressing the disclosure and use of data collected by Us. Their data collection practices, and their policies might be different from this Privacy Policy and We do not have control over any of their policies neither do We have any liability in this regard.

Our third-party service providers employ separation of environment and segregation of duties and have strict role-based access control on a documented, authorized, need-to-use / know basis. The stored data is protected and stored by application-level encryption. They enforce key management services to limit access to data.

Furthermore, our registered third-party service providers provide hosting security – they use industry leading anti-virus, anti-malware, intrusion prevention and detection systems, file integrity monitoring, and application control solutions.

We don't allow unauthorized access to Your non-public personal contacts or financial transaction SMS data by any third party in relation to Services other than our authorized partners for the Services.

12. Your Rights

Modifying or rectifying Your information: You are responsible for providing us with accurate and complete personal data. In the event of any personal information provided by You is inaccurate, incomplete or outdated then You shall have the right to provide Us with the accurate, complete and up to date data and have us rectify such data at our end immediately.

We urge You to ensure that You always provide us with accurate and correct information/data to ensure Your use of our Services is uninterrupted. In case of modification of personal information, You will be required to furnish supporting documents relating to change in personal information for the purpose of verification by BT FINANCE.

Your Privacy Controls: You have certain choices regarding the information We collect and how it is used:

• i. Your device may have controls that determine what information We collect. For example, You can modify permissions on Your android/iOS device or browser to remove any permissions that may have been given. However, BT FINANCE does not provide a guarantee of Services if any such controls are exercised / access is denied.
• ii. You can also request to remove content from our servers in accordance with sub-clause (iii) below.
• iii. Withdrawal/Denial of consent: You acknowledge that We have duly collected the information with Your consent and You have the option to not to provide such information, or deny consent for use of specific information, restrict disclosure by us to any third parties, deny retention by us of any of Your information, or revoke the consent already given for any of the above, and if required, make the /our DLAs delete/forget any such information. However, any withdrawal of such personal information will not be permitted in case any Service availed by You is active and such information is necessary to be retained by us or DLA/LSP/third party partners until the continuation of Services, or until such duration as stipulated under any applicable laws, whichever is later. Where consent has been withdrawn by you, We do not guarantee and cannot be liable for providing such Service. For exercising your right to withdraw/deny consent as per this clause, please contact us at tech@btfinance.in

You shall have the following rights pertaining to Your information collected by us:

• i. Deny Consent: You shall have the right to deny consent for use of specific data, restrict disclosure of your data to third parties, revoke consent already granted to collect personal data, opt for preferences as to data retention, and if required, make the Platform delete/ forget the data. However, any such denial will not prejudice our right to retain any data in relation to the loans or credit facilities availed by You. Further, in case of a denial of consent, the Platform does not provide a guarantee or will not be liable towards the continued facilitation of the Services if any such controls are exercised.
• ii. Withdraw Consent: You may withdraw Your consent to contact You, for the continued collection, use or disclosure of Your information, at any time, or request for deletion of Your login account to the Platform by raising a request on the Platform or by mailing us at tech@btfinance.in. However, We do not provide guarantee of continued provision of Services if any such controls are exercised / access is denied. Further, in the event the request for withdrawal is made while any credit facility or loan taken by you is outstanding, We shall have the right to continue processing Your information till such credit facility has been repaid in full, along with any interest and dues payable and/or for such period as may be allowed under applicable law. However, We shall not retain Your data and information if it is no longer required by us and there is no legal requirement to retain the same, and such data will be destroyed/purged in line with our internal policies. Do note that multiple legal bases may exist in parallel, and We may still have to retain certain data and information at any time to comply with applicable laws. Also, the information may still be used for execution of any outstanding or termination activity of any Services.
• iii. Report an issue: You have the right to report any security breach / incident to the Grievance Redressal Officer (GRO) of BT FINANCE (details mentioned hereinbelow). You are entitled / shall be entitled to prevent unauthorised usage of Your information by our personnel/staff / representative / agents by informing us immediately / within 10 days of being informed of the proposed use, that You do not wish to disclose such information. You can also exercise the right at any time by contacting us at priya.agrawal@btfinance.in
• iv. Information/data deletion may not be implemented for ongoing Services including loan, insurance policy (if any).
• v. Marketing and Communication: The consent for this information can be withdrawn by sending an email to tech@btfinance.in

13. Prohibited Actions

While visiting or using the Platform, You agree not to, by any means (including hacking, cracking or defacing any portion of the Platform) indulge in illegal or unauthorized activities including the following:

• i. Restrict or inhibit any authorized user from using the Platform.
• ii. Use the Platform for unlawful purposes.
• iii. Harvest or collect information about Platform's users without their express consent.
• iv. "Frame" or "mirror" any part of the Platform without our prior authorization.
• v. Engage in spamming or flooding.
• vi. Transmit any software or other materials that contain any virus, time bomb, or other harmful or disruptive component.
• vii. Remove any copyright, trademark or other proprietary rights notices contained in the digital platform.
• viii. Use any device, application or process to retrieve, index, "data mine" or in any way reproduce or circumvent the navigational structure or presentation of the digital platform.
• ix. Permit or help anyone without access to the digital platform to use the digital platform through Your username and password or otherwise.

14. Grievance Redressal and Further Information

For any information regarding the Privacy Policy, please contact tech@btfinance.in.

In case You have grievance or relating to collecting receiving, possessing, storing, dealing or handling of Your personal information provided, You may contact our Grievance Officer on the following address or write an email: