DstackLoan Privacy Policy

1. General Provisions and Scope of Application

1.1 Purpose of the Policy

DSTACK SOLUTIONS GLOBAL PRIVATE LIMITED (hereinafter referred to as the "Company" or "we") respects and is committed to protecting your personal privacy. This Privacy Policy (hereinafter referred to as the "Policy") is intended to explain, in a clear, transparent, and complete manner, how we process your personal data through the DstackLoan application (hereinafter referred to as the "App"), including the scope of collection, processing purposes, sharing circumstances, storage and security measures, and the rights you enjoy under the law.

1.2 Legal Basis and Compliance Framework

This Policy is formulated in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and its implementing rules, and with reference to the relevant regulatory requirements of the Reserve Bank of India (RBI) for digital lending service providers. We are committed to processing your personal data on the principles of lawfulness, fairness, transparency, necessity, and data minimization.

1.3 Applicable Scenarios

This Policy applies to the following circumstances:

• You download, register for, and use the DstackLoan mobile application;
• You apply for a revolving credit line through the App, and conduct drawdown, repayment, credit line restoration, and other operations;
• You visit our official website and related digital channels;
• Online interactions and customer service communications between you and us.

1.4 Consent Mechanism

By using the App, you signify that you have read and understood all the contents of this Policy and voluntarily grant us your consent to process your personal data. In accordance with Article 6 of the DPDP Act, your consent must be freely given, specific, informed, and unambiguous, and made through a clear affirmative action. If you do not agree to any term of this Policy, please immediately cease using the App and related services.

1.5 Description of Service Nature

DstackLoan is a personal revolving credit line service platform that provides you with a revolving credit line service. After completing a one-time credit assessment and credit approval review, you will obtain an exclusive revolving credit line; during the validity period, you may draw down at any time and repay at any time, and the credit line will be automatically restored after repayment, enabling the revolving use of funds.

As the direct provider of this service, we are responsible for credit assessment, credit line granting, fund disbursement, and account management, ensuring that every fund flow is clearly traceable, compliant, and transparent.

1.6 Alignment with Google Play Policies

This App complies with Google Play's relevant policy requirements for personal loan applications in India. We disclose data collection, use, sharing, and security practices through the Google Play Data Safety form, and ensure that this Policy is consistent with the disclosures in the Data Safety form.

This App does not request sensitive permissions prohibited by Google Play, including Contacts, Precise Location, External Storage, Media Files, and Phone Numbers.

2. Data Controller Identity and Responsibility Definition

2.1 Data Controller

With respect to the personal data processing activities under this Policy, DSTACK SOLUTIONS GLOBAL PRIVATE LIMITED is the Data Fiduciary, responsible for determining the purposes and means of processing and bearing compliance responsibilities under the DPDP Act.

2.2 Data Processors

To provide services related to this App, we may engage third-party service providers as Data Processors to process necessary data. We will enter into binding contracts with Data Processors, specifying processing instructions, confidentiality obligations, security standards, and data deletion requirements.

2.3 Disclosure of Cooperating Institutions

If our business model involves cooperation with registered Non-Banking Financial Companies (NBFCs) or banks, we will prominently disclose the names and identities of the cooperating institutions in the App description and related documents, and will not conceal the actual lender or service provider.

3. Categories of Personal Data We Process

3.1 Information You Voluntarily Provide

To complete credit assessment, credit line granting, and revolving loan services, we may process the following categories of information:

(1) Identity Verification and KYC Information

• Legal full name, date of birth, and gender;
• PAN card number, Aadhaar number, or other government-issued valid identification document information;
• Facial images and liveness detection data used for identity verification.

(2) Contact Information

• Email address;
• Mobile phone number.

(3) Personal Background Information

• Educational background, marital status, and number of family members;
• Other basic information relevant to credit assessment.

(4) Financial and Employment Information

• Income details, occupation type, and employer name;
• Bank account information and employment details;
• Necessary information for assessing repayment capacity and credit status.

(5) Credit Line Usage Information

• The drawdown amount applied for and repayment term selections;
• Historical drawdown and repayment records;
• Credit line restoration records and other data directly related to the use of the revolving credit line.

3.2 Information Automatically Collected by the System

During your use of the services, the system may automatically record the following technical information:

• Basic device information, including device model, operating system version, and application version number;
• Log information, including access time, operation paths, and feature click sequences;
• Error reports and crash logs, used for problem diagnosis and system optimization;
• Preference settings and usage behavior data collected through Cookies or similar technologies.

3.3 Information Related to Third-Party SDKs

To ensure business security and risk control, we may use third-party SDKs for fraud risk identification. These SDKs may obtain device identifiers, network information, device type, and sensor data to construct device fingerprints and risk profiles. All third-party SDKs are used in accordance with the data minimization principle, collect information only to the extent necessary, and are truthfully disclosed in the Google Play Data Safety form.

4. Device Permissions and the Minimization Principle

4.1 Permission Authorization Principle

All device permissions are invoked only after obtaining your explicit, separate authorization. Permissions are granted on a per-use basis, and you may enable or disable them at any time through your mobile device's system settings. Disabling a permission may affect the use of the corresponding feature, but will not affect the normal use of other authorized features.

4.2 Camera Permission

• Purpose: Strictly used for identity verification (KYC) processes, including identification document photography, facial comparison, and liveness detection;
• Scope: Photographing images of documents such as PAN cards and Aadhaar cards, as well as capturing facial images during liveness detection;
• Restrictions: Used only in identity verification and risk control processes; does not involve continuous background operation; not used for advertising or marketing purposes.

4.3 Approximate Location Permission

• Purpose: Used to determine service availability and assist in risk assessment and fraud detection;
• Scope: Approximate geographic location inferred from network, Wi-Fi, cell tower, or IP address;
• Restrictions: Used only to the extent necessary for providing relevant services; no continuous background tracking; not used for advertising.

4.4 SMS Permission

• Purpose: Used for automatic recognition and filling of OTP verification codes during account registration, login, and identity verification processes;
• Scope: Limited to SMS content directly related to verification codes and related service verification;
• Restrictions: Used only to the extent necessary for identity verification and related services; does not read other SMS content; not used for advertising or marketing.

4.5 Commitment Regarding Prohibited Permissions

In accordance with Google Play's specific requirements for personal loan applications in India, this App does not request the following prohibited sensitive permissions:

• Contacts (READ_CONTACTS);
• Precise Location (ACCESS_FINE_LOCATION);
• External Storage (READ_EXTERNAL_STORAGE);
• Media Files (READ_MEDIA_IMAGES);
• Phone Numbers (READ_PHONE_NUMBERS).

5. Processing Purposes and Legal Bases

5.1 Core Service Purposes

We process your information solely for lawful, clear, and necessary business purposes:

(1) Identity Verification and KYC

• Completing the "Know Your Customer" (KYC) process to verify identity authenticity;
• Using technical means such as document comparison, facial recognition, and liveness detection to prevent identity impersonation risks.

(2) Credit Assessment and Credit Line Granting

• Conducting comprehensive credit assessment based on identity information, financial status, and credit history;
• Determining the exclusive revolving credit line and corresponding interest rate pricing through an automated risk control system.

(3) Credit Line Usage and Fund Management

• Verifying credit line availability and completing approval when you initiate a drawdown application;
• Arranging fund arrival and restoring available credit in real time after repayment.

(4) Risk Assessment and Anti-Fraud

• Building device fingerprints, behavioral models, and multi-dimensional correlation analysis;
• Identifying abnormal drawdown behavior, multiple account registrations, and potential fraud risks.

(5) Account Management and Customer Service

• Maintaining the status of the revolving credit line account;
• Responding to and handling inquiries and requests.

5.2 Compliance and Legal Obligations

We may process your information based on the following legal or regulatory requirements:

• Compliance with the DPDP Act and its implementing rules;
• Fulfilling the RBI's relevant regulatory requirements for credit service providers;
• Responding to lawful information disclosure requests from government agencies or judicial authorities;
• Complying with anti-money laundering laws and regulations;
• Providing credit-related information to Credit Information Companies in accordance with the law.

5.3 Service Optimization and Product Improvement

Without identifying individuals, we may conduct the following analyses on aggregated or anonymized data:

• Optimizing app feature interactions and operational workflows;
• Enhancing system stability, accelerating loading speed, and fixing known errors;
• Optimizing product display and recommendation strategies based on user behavioral characteristics.

5.4 Notifications and Communications

We will send service-related information to you via SMS, in-app notifications, email, and other means, including:

• Credit assessment and credit line approval result notifications;
• Drawdown application status updates;
• Repayment reminders, overdue notices, and repayment confirmations;
• Credit line restoration notifications;
• One-Time Password (OTP) verification messages;
• Account security notifications;
• Platform announcements, including system maintenance, feature updates, and policy changes.

5.5 Marketing and Promotions

Based solely on your separate consent, we may push information about new product launches, limited-time promotional offers, and personalized product recommendations based on usage preferences.

You have the right to withdraw your marketing consent at any time through means including disabling it through in-app settings, contacting customer service, or clicking the unsubscribe link in SMS messages. Withdrawal of marketing consent does not affect your use of core credit line services. In accordance with the DPDP Act, withdrawal of consent must be as easy as giving consent, and we commit to processing your withdrawal request within a reasonable timeframe.

6. Sharing, Entrusted Processing, and Disclosure

6.1 Sharing with Service Providers

We may engage third-party service providers to assist in operating the Platform, with sharing limited to the minimum data necessary for providing services. Categories of service providers include:

• Cloud infrastructure and data storage service providers;
• Data analysis and statistics service providers;
• Customer service systems and ticket management service providers;
• Security monitoring and risk control technical support service providers.

The above service providers are all contractually bound to confidentiality obligations and may not use data for any purposes beyond those agreed upon.

6.2 Circumstances of Lawful Disclosure

We may lawfully disclose your information in the following circumstances:

• Providing credit-related information to Credit Information Companies in accordance with the law to fulfill RBI guideline requirements;
• When required by laws, regulations, judicial authorities, government agencies, or regulatory bodies with lawful directives;
• When necessary to protect the personal or public safety of users or the general public;
• In the event of major transactions such as mergers, acquisitions, or asset transfers, lawful transfer of data, and we will provide advance notice;
• Other circumstances with your explicit authorization.

6.3 Commitment Not to Sell Data

We solemnly commit:

• Not to sell or rent your personal data to any third party;
• Not to use your information for unauthorized marketing or promotional activities;
• Not to push advertisements to third parties without your separate authorization;
• Not to access or misuse your personal data without authorization.

7. Data Storage, Security, and Retention

7.1 Data Storage Location

Your personal information is primarily stored on secure servers within India and is subject to Indian law. In accordance with the requirements of the RBI Digital Lending Guidelines and DPDP rules, we ensure localized data storage and do not transfer personal data to overseas servers without legal permission.

7.2 Security Protection Measures

We employ a multi-layered security protection system covering technology, management, and personnel to fulfill the obligation of "reasonable security safeguards" under Article 8(5) of the DPDP Act:

• Transmission Encryption: Using TLS/SSL protocols to encrypt all network-transmitted data, ensuring information is not intercepted or tampered with during transmission;
• Storage Encryption: Encrypting sensitive fields such as identification document numbers and bank account information at the database level;
• Access Control: Establishing strict access control mechanisms, granting only authorized personnel in necessary positions access to user data on a minimum-necessary basis;
• Log Retention: Retaining logs of access, modification, and deletion for at least one year in accordance with DPDP rules;
• Regular Audits: Conducting periodic reviews of system security, data access logs, and operational activities;
• Personnel Management: All employees sign strict confidentiality agreements and receive regular data protection and privacy security training.

7.3 Data Retention Period

We retain your data only for as long as necessary to provide services and as required by law:

• During the existence of the account and the validity period of the credit line, retaining necessary information to maintain normal service operation;
• After account closure or settlement of all debts, data will be deleted upon completion of the purpose, unless legal requirements mandate extended retention;
• After the retention period expires, data will be securely deleted or anonymized;
• Statutory records such as KYC records, credit approval documents, and transaction histories are retained in accordance with the DPDP Act and RBI requirements, solely for compliance purposes, and are not used for new marketing or profiling activities.

7.4 Data Breach Emergency Response

In the event of a personal data breach, we will immediately activate emergency response procedures:

• Report to the Data Protection Board within 72 hours of becoming aware of the breach;
• Notify affected users without undue delay, explaining the nature of the breach, potential impact, and response measures taken;
• Cooperate with the Data Protection Board's investigation and rectification requirements in accordance with the law.

8. Your Data Subject Rights and How to Exercise Them

8.1 Statutory Rights

Under the DPDP Act, you have the following statutory rights over your personal data:

• Right to Information and Access: To know whether we hold your personal data and to access its contents, including information on data recipients, processing purposes, and methods;
• Right to Consent and Withdrawal: To grant or refuse consent for data processing, and to withdraw consent previously granted at any time; withdrawal must be as easy as giving consent;
• Right to Correction and Update: To request correction or updating when personal data is inaccurate or outdated;
• Right to Erasure: Under certain circumstances, such as when data is no longer necessary, consent has been withdrawn, and no other legal basis exists, to request deletion of personal data;
• Right to Complain: To lodge a complaint with the Data Protection Board if you believe your personal data has been misused or your privacy rights have been violated;
• Right to Nomination: To designate another person to exercise your data rights on your behalf.

8.2 How to Exercise Rights

To exercise any of the above rights, please contact us through the contact information in Chapter 11 of this Policy. We will respond to your request within 90 days as stipulated by DPDP rules. To verify your identity, we may require you to provide necessary identity verification information.

8.3 Account Deletion

You may submit an account deletion request through the in-app account management function or by contacting customer service. We will process your request in accordance with the law, but statutory retention obligations may limit the scope of exercising the right to erasure. Account deletion does not affect your repayment obligation for unsettled debts.

8.4 Consequences of Withdrawing Consent

You have the right to withdraw specific data processing authorizations previously granted to us at any time. Withdrawal does not affect the lawfulness of processing based on your consent before the withdrawal.

Please note: if you object to the processing of certain personal data, it may affect your credit assessment and credit line granting, thereby affecting your ability to use this service. While you still have unsettled credit line usage obligations with us, withdrawal of consent does not relieve us of our rights and obligations to continue processing your personal data lawfully. Upon withdrawal of consent, we will clearly inform you of the relevant consequences.

9. Automated Decision-Making and Human Review

9.1 Explanation of Automated Decision-Making

We may use automated systems to assess your creditworthiness, including credit scoring, behavioral analysis, and fraud risk identification. Automated decisions will affect your credit line granting, interest rate pricing, and drawdown approval results. Such automated decisions are designed to improve approval efficiency and risk assessment accuracy.

9.2 Your Related Rights

Under the DPDP Act, you have the following rights:

• To understand the factors considered in automated decision-making;
• To object to decisions based solely on automated processing;
• To request human review of decisions when your application is rejected.

If you choose to opt out of automated assessment, it may affect our ability to provide you with credit line services, as this is a core component of credit assessment and credit line granting.

10. Protection of Minors, Cross-Border Transfer, and Cookies

10.1 Protection of Minors

This service is not intended for minors under 18 years of age. In accordance with the DPDP Act and rules, we do not provide services to children, nor do we engage in behavioral monitoring, profiling, or targeted advertising of children. If we discover that we have inadvertently collected personal information from a child, we will promptly take deletion measures.

10.2 Cross-Border Data Transfer

Your personal data is stored by default within India. In accordance with the DPDP Act, should cross-border data transfer be necessary, we will ensure that:

• Applicable legal requirements are complied with;
• Adequate data protection measures are implemented;
• Such transfer is conducted only when necessary and with a lawful basis.

10.3 Cookies and Tracking Technologies

We use Cookies to enhance user experience, conduct risk analysis, and analyze usage behavior. You may disable Cookies through your device system settings, though this may affect the user experience of certain features.

11. Policy Updates, Complaint Channels, and Contact Information

11.1 Policy Updates

We reserve the right to revise this Privacy Policy from time to time.

• Update Notifications: In the event of material changes involving changes in data processing purposes, scope of permissions, reduction of user rights, or other significant modifications, we will notify you prominently through in-app pop-ups, website announcements, or email notifications;
• Effectiveness and Acceptance: Revised policies will be marked with a new effective date. Your continued use of the services constitutes your acceptance of the revised policy terms. If you do not agree to the updated terms, you may stop using the App and contact our Data Protection Officer.

11.2 Contact Information

If you have any questions, complaints, or requests to exercise your rights regarding this Privacy Policy or data processing, please contact us through the following means:

• Company Name: DSTACK SOLUTIONS GLOBAL PRIVATE LIMITED
• Application Name: DstackLoan
• Customer Support Email: [email protected]
• Official Website: https://www.dstacksolutionsglobal.com

Response Time: We commit to responding within a reasonable timeframe after receiving your request, typically confirming receipt within 15 working days, and completing the processing within 90 days in accordance with DPDP rules.

11.3 Complaint Channels

You have the right to file a complaint directly with the Data Protection Board of India to seek remedies. The Data Protection Board is an independent body established under the DPDP Act, responsible for monitoring compliance, investigating violations, and taking corrective measures. In accordance with DPDP rules, before lodging a complaint with the Data Protection Board, you should first seek resolution through our internal grievance channels described above.

12. Consent Confirmation and Third-Party Data Statement

12.1 Your Confirmation

By using the DstackLoan services and providing us with your personal data, you hereby confirm that you have read, understood, and agree to our use, processing, and disclosure of your personal data in accordance with this Privacy Policy.

12.2 Statement Regarding Third-Party Data Providers

If you, as a representative or agent of the Company, provide personal data of third parties (including but not limited to your emergency contacts, family members, etc.), you hereby represent and warrant that:

• You have obtained lawful and valid consent from such third parties;
• You have the authority to provide us with their personal data;
• Such personal data may be used, processed, and disclosed in accordance with this Privacy Policy.

12.3 Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of India. Any dispute arising out of or in connection with this Policy shall be submitted to the exclusive jurisdiction of the courts in Delhi, India.