Regulatory Disclosures

2.1 Loan Application & Processing

• All loan application forms shall include necessary information which affects the interests of the borrower, so that a meaningful comparison with the terms and conditions offered by other NBFCs can be made.
• The Company shall provide acknowledgement for receipt of all loan applications.
• The Company shall convey to the borrower, in writing, the reasons for rejection of the loan application, within a reasonable timeframe.
• All communications to the borrower shall be in the vernacular language or a language as understood by the borrower.

2.2 Loan Appraisal & Terms

• The Company shall convey to the borrower the amount of loan sanctioned along with the terms and conditions including annualized rate of interest and method of application thereof.
• The loan agreement shall contain all clauses relating to rate of interest, fees, charges, penal interest, pre-payment options, and all other material terms and conditions.
• A copy of the loan agreement along with a copy of all enclosures quoted in the loan agreement shall be furnished to all borrowers at the time of disbursement of loans.

2.3 Disbursement & Repayment

• The Company shall give notice to the borrower of any change in the terms and conditions including rate of interest and charges.
• The Company shall release all securities on repayment of all dues or on realisation of the outstanding amount of loan subject to any legitimate right of lien for any other claim.
• In the matter of recovery of loans, the Company shall not resort to undue harassment.
• The Company shall ensure that the staff are adequately trained to deal with the customers in an appropriate manner.

2.4 General Principles

• The Company shall refrain from interference in the affairs of the borrower except for the purposes provided in the terms and conditions of the loan agreement.
• In case of receipt of request from the borrower for transfer of borrowal account, the consent or otherwise i.e. objection of the Company, if any, shall be conveyed within 21 days from the date of receipt of request.
• The Company shall not charge foreclosure charges/pre-payment penalties on floating rate term loans sanctioned to individual borrowers.

4.1 KYC Requirements

The Company carries out Customer Due Diligence (CDD) for all customers before establishing a business relationship. The following documents are required:

Identity Proof (any one):

• Aadhaar Card
• PAN Card (mandatory for loans above ₹50,000)
• Passport
• Voter ID Card
• Driving License

Address Proof (any one):

• Aadhaar Card
• Passport
• Utility Bills (not older than 3 months)
• Bank Account Statement (not older than 3 months)
• Registered Rent Agreement

4.2 Customer Acceptance Policy

• No account shall be opened in anonymous or fictitious/benami name.
• The Company shall not discriminate against customers on the basis of their race, religion, caste, sex, or geography.
• Risk categorization of customers shall be done at the time of opening the account and shall be reviewed periodically.
• Enhanced Due Diligence (EDD) shall be conducted for Politically Exposed Persons (PEPs) and high-risk customers.

4.3 Customer Information Confidentiality

The Company shall maintain confidentiality of all customer information and transactions. Customer information shall not be shared with any third party except under the following circumstances:

• When required by law or ordered by a court of competent jurisdiction
• When required by regulatory authorities (RBI, SEBI, etc.)
• When expressly authorized by the customer
• When required for credit information purposes to Credit Information Companies (CICs)

6.1 Information Collection

We collect the following categories of personal data:

• Identity data: Name, PAN, Aadhaar (with consent), date of birth, photographs
• Contact data: Address, email, mobile number
• Financial data: Bank statements, income proof, ITR, credit bureau reports
• Property data: Property documents (for secured loans)
• Employment data: Employer details, salary slips, business proof

6.2 Purpose of Data Collection

• Loan processing and credit assessment
• KYC compliance and identity verification
• Regulatory reporting to RBI, CERSAI, CICs
• Account servicing and communication
• Recovery and collection activities
• Fraud prevention and risk management

6.3 Data Sharing

Personal data may be shared with:

• Credit Information Companies (CIBIL, Equifax, Experian, CRIF High Mark)
• Central Registry of Securitisation Asset Reconstruction and Security Interest (CERSAI)
• Regulatory authorities as mandated by law
• Service providers under strict confidentiality agreements
• Legal proceedings or law enforcement agencies when required by law

6.4 Data Subject Rights

Customers have the right to:

• Access their personal data held by the Company
• Request correction of inaccurate data
• Withdraw consent (where processing is based on consent)
• Request erasure of data (subject to legal retention requirements)
• Lodge a complaint with the Data Protection Board of India

6.5 Data Retention

Personal data shall be retained for the duration of the business relationship and for a minimum of 5 years after closure/settlement of all accounts, as required under PMLA guidelines and other regulatory requirements.

8.1 App Information

8.2 Representative Example (APR Illustration)

* This is a representative example only. Actual rates, fees, and EMI will vary based on borrower's credit profile, loan amount, and tenure. A Key Fact Statement (KFS) with exact APR will be provided before loan agreement execution.

8.3 Data Practices & Permissions

In compliance with RBI Digital Lending Guidelines:

• Data collected: Name, phone number, email, PAN, Aadhaar (with consent), bank account details, employment/income information, device metadata (for fraud prevention only).
• Data NOT collected: Contact list, SMS, call logs, photos, media files, or social media data. The app does NOT access your phone's contact book, gallery, or messages.
• Data storage: All data stored on secure servers within India as per data localization norms.
• Data retention: Personal data retained for the loan tenure + 5 years post-closure (as per PMLA requirements).
• Data sharing: Credit bureau reporting (CIBIL, Equifax, Experian, CRIF), regulatory authorities, and CERSAI only.
• Consent: Explicit, auditable consent obtained before accessing any personal data. Borrowers can withdraw consent (subject to contractual and regulatory obligations).

8.4 Cooling-Off Period

As per RBI guidelines, borrowers have a look-up period (cooling-off period) during which they can exit the loan without penalty:

• Cooling-off period: 3 days from the date of disbursement
• During this period, the borrower may return the principal amount and proportionate interest/fees without any prepayment penalty
• No additional charges shall be levied for exercising this option

8.5 Grievance Mechanism for SahayFin

• In-app support: Help & Support section within the SahayFin app
• Email: support@sahay.fin (or complaints@aceprofinance.in)
• Phone: +91 22 0000 0000 (Mon-Sat, 10 AM - 6 PM IST)
• Escalation: Nodal Officer at grievance@aceprofinance.in
• RBI Ombudsman: https://cms.rbi.org.in (if unresolved within 30 days)

8.1 RBI Sachet Portal

In case of any concern regarding unauthorized collection of deposits, customers can lodge a complaint on the RBI's Sachet Portal:

8.2 Credit Information Reporting

The Company reports loan and credit data to the following Credit Information Companies (CICs) licensed by RBI:

• TransUnion CIBIL Limited
• Equifax Credit Information Services Pvt. Ltd.
• Experian Credit Information Company of India Pvt. Ltd.
• CRIF High Mark Credit Information Services Pvt. Ltd.

Default/overdue information shall be reported to CICs after providing due notice to the borrower.

8.3 Resolution Framework for COVID-19 Related Stress

As per RBI circular dated May 5, 2021 (Resolution Framework 2.0), eligible borrowers who were classified as Standard as on March 31, 2021 may be considered for restructuring of their loans as per applicable guidelines.

8.4 Outsourcing Policy

The Company outsources certain operational activities to third-party service providers while maintaining responsibility for the outsourced activities. The Company ensures that:

• Outsourced service providers maintain adequate data security and confidentiality
• Customer complaints related to outsourced services are handled by the Company
• Regulatory compliance is not compromised through outsourcing

8.5 IT Governance & Cyber Security

In compliance with RBI Master Direction on Information Technology Framework for NBFCs, the Company maintains:

• Board-approved IT policy and information security policy
• Regular vulnerability assessments and penetration testing
• Incident response mechanisms for cyber security threats
• Data backup and disaster recovery procedures

8.6 Regulatory References