1. Introduction

---

The document outlines the protection principles and procedures for security and management of personal data. The document is part of the overall Information Security policies of the organization. UGRO Capital Ltd (Ugro) may collect and store information about users or applicants interested to avail Ugro services when you visit our website, use our services, or other online promotions / advertisements.

The policy is prepared in line with the RBI Digital Lending Framework dated August 10, 2022 ; considers UIDAI guidelines and regulations ; aligned with Personal Data Protection bill 2021 (draft). The policy may be updated from time to time in line with the company’s requirements. Ugro reserves the right to change or update this policy at any time on our site. Such changes shall be effective immediately upon posting to this site.

1.1. Applicability

This policy is applicable to all the personal data collected and managed by various business functions not limited to Customers, Loan products, services, business development partner or agents, Employees, vendors and any other individuals.

2. Personal Data and Privacy

---

2.1. Personal information “Definition”

Personal Data – personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number such as Aadhaar card, PAN, Driving license no., Electoral card number etc, location data, or other online identifiers, cell#, Company name, location or other KYC information.

2.2. Cookies

Cookies are required to be Accepted and enabled in browsers to allow smooth experience (If cookies are not selected may affect certain or all web site functions. Cookies and other commonly are used for data collection technologies on our websites and in our newsletters and emails to collect information on both an aggregate and individual basis.

Ugro may collect some information automatically, which include:

• IP address
• Information about your web browser software and version;
• General geographic location indicated by your IP address;
• Website that referred you to us, and similar information.
• Frequency of visits to our web site;
• Average length of visits;
• Pages viewed during a visit.

We may combine your information, automatically gathered information and the information we collect through cookies/web beacons / web bugs, including information that we have collected about you, or information that we have obtained from other sources. We may aggregate required statistics or data that are collected, to improve customer service experience.

2.3. Collection and Use of Personal data

Ugro collects information that you supply to us when you choose to use “Contact us” form on our website or email us for more information or when you register or fill in your contact details for any services. This information typically includes your name, company name, email address and other contact data.

Ugro may use the personal information that is collected to provide requested products and services and for our internal business purposes, including, but not limited to:

• Responding to your requests for our unique products and services;
• To process your transactions and to provide you with transaction and post transaction-related services, providing, improving, and marketing our products and services, including site content and performance;
• Evaluating your use of the services;
• Providing New products and service offers that might interest you;
• Responding to your requests for information;
• Communicating with you by e mail, postal mail or courier, and/or telephone about products or services that may be of interest to you;
• Maintaining and managing your account with us;
• Keeping you updated on the issues that are relevant to your relationship with us;
• Monitoring your compliance with any terms and conditions associated with our products and services, including to confirm your identity;
• Performing other functions as described to you at the time of collection or pursuant to your consent.

2.4. Consent to “Personal Data” use

By filling up “Contact us” details or sending any email requesting Product or service Information, it implies that you are allowing Ugro Consent to use the supplied information for further process and offering our range of Products and services.

In case, as an Applicant or User seeking information, you fill up the Physical Form and submit at a Ugro Branch or through a Digital Lending Agents (DLA) or Loan Service providers (LSP), you agree to giving Consent to use the supplied information for further process and offering our range of Products and services.

Consent Revocation option is available, should you wish to withdraw the consent given. Basis your revocation request, Ugro shall have limitation to offer you General Information only.

Further processing or furnishing of detailed product or service information based on custom requirements based on your profile may not be feasible.

2.5. Sharing of Personal data

Personal data collected and / or stored with Ugro is shared in the manner described in this Privacy Policy may involve the transfer of your personal information to Ugro or to authorized third parties of Ugro such as Digital Lending Agents (DLA) or Loan Service providers (LSP) or business partners for the purpose of accepting applications, process and management of user experience or customer data to deliver requisite services.

We may share personal information with organizations or individuals that perform functions on our behalf. For example, service providers may process data for verification services or may store and process data on our behalf. With your consent, we may share your basic information, PAN, Name not restricted to only these details, eg when sharing for CIBIL score with credit information companies registered under the Credit Information Companies (Regulation) Act, 2005. The service providers are granted authorized need-based access or shared relevant Personal information for the purpose of performing their functions for Ugro.

Ugro may share personal information in connection with a substantial corporate transaction, such as mergers, acquisition, the sale of our business, a divestiture, consolidation, or asset sale, or in the unlikely event of bankruptcy.

2.6. Storing of Personal data

Ugro keeps your personal information for so long as is necessary in light of the purpose for which it was originally collected or lawfully further processed by third parties.

The criteria we use to determine the period of time for which your personal information may be kept include:

• The nature and type of personal information that you provide to us;
• The purpose for which you provide your personal information to us;
• The necessary business and operational requirements to continue to provide services or functionality you have requested
• The information may be retained for a longer time period if required to do so by law, Regulator and legal agencies.

2.7. Legal Matters

Ugro may share personal information in response to a court order, a request for cooperation from a law enforcement or other government agency, or as otherwise required by law; to persons acting as authorized representative capacity on your behalf; to defend against legal claims; to investigate, prevent, or take other action regarding illegal activity, suspected fraud, suspected violations of terms and conditions associated with any of our products or services, or other wrongdoing; or to protect and defend the rights, property or safety of our company, our users, our employees, or others.

2.8. Personal Data Protection

UGRO uses commercially reasonable security measures (including physical, electronic and procedural measures) and assure that Personal data shall be safeguarded against loss, misuse, damage or modification and unauthorized access or disclosure or breaches.

However, no system for transmitting or storing information electronically can be completely secure, therefore guarantee cannot be explicit that personal information or that other communication channels are secure.

All the information collected during course of services will be held, stored and purged in accordance with the standard protocols as defined by the Ugro Information Security policies or the governing bodies of the land.

We assure that Third parties (DLA or LSP) of Ugro shall follow and uphold the principles of Personal data protection as per Digital Lending framework of RBI and ensure that required data protection, security measures as required are being taken and complied to by respective partners.

2.9. Data Subject Rights - Individual Rights

As an individual whose Personal or Contact details are stored with us, certain INDIVIDUAL RIGHTS are allowed, these are

• Right to access of information
• Amend personal data
• Delete personal data
• Receive or Unsubscribe from promotional mailers

Important Note - Ugro may ONLY service any such requests, if coming from authorized persons or representatives of the individual and further actions are subject to terms and conditions of our Agreements, service contracts, appointment letters or any other. Amend or Deletion request shall be processed if, it does not violate Ugro needs for providing business services and to retain required personal data as defined by law and legal agencies. If you wish to exercise your rights or you have any questions related to Privacy, please email to us at privacy@ugrocapital.com.

3. Compliance

---

Any violation to this policy is subject to disciplinary action. The specific disciplinary action depends upon the nature of the violation, the impact of the violation on informational assets and related facilities, etc. Violations shall be handled as per the existing HR processes and could range from a verbal reprimand, to termination of employment/contract and/or legal action.

If a department or function is unable to comply with any requirements detailed within this policy, an exception shall be obtained. Such exceptions shall be documented, indicating the rationale for the exception and the related risks. Exceptions to this policy shall follow the exception process for prior authorization and approval.