Privacy Policy

NEENV FINANCIAL TECHNOLOGIES PRIVATE LIMITED ("Neenv", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our supply chain financing platform.

In the language of the Digital Personal Data Protection Act, 2023, Neenv is a Data Fiduciary — the entity that determines the purpose and means of processing your personal data — and you are a Data Principal. Where we engage others to process data on our instructions, they act as Data Processors and remain bound by our instructions and by contract.

By accessing or using our services, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access our platform. Where the law requires your consent for a particular purpose, we ask for it separately and specifically; agreeing to this policy is not by itself treated as that consent.

A plain-language summary of what we collect and why, our cookie policy, and our statutory disclosures are set out on our Legal & Privacy page.

This Privacy Policy is issued under and is to be read in accordance with:

• the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, including the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), as brought into force and as amended from time to time;
• the Information Technology Act, 2000 and the rules made under it, to the extent they continue to apply;
• the directions, guidelines, and master directions issued by the Reserve Bank of India that apply to our lending partners and to us in our role as a Lending Service Provider, including the RBI Digital Lending Guidelines and the RBI Master Direction on Know Your Customer;
• the Prevention of Money-Laundering Act, 2002 and the rules made under it;
• the Credit Information Companies (Regulation) Act, 2005, in relation to credit information; and
• the Companies Act, 2013 and the Income-tax Act, 1961, in relation to books of account and tax records.

This policy is governed by the laws of India. The courts at Mumbai, Maharashtra shall have jurisdiction over any dispute arising from it, without prejudice to your right to approach the Data Protection Board of India under the DPDP Act or the Reserve Bank of India under the Reserve Bank – Integrated Ombudsman Scheme, 2021.

Where any provision of this policy is inconsistent with the DPDP Act or the DPDP Rules, the statute prevails and this policy will be read accordingly.

We may collect the following types of information:

Personal Information:

• Name, email address, phone number, and business address
• Business registration details (GST number, PAN, CIN)
• Bank account and financial information
• KYC documents and identity verification information
• Transaction history and credit information

Technical Information:

• IP address, browser type, and device information
• Usage data and analytics
• Cookies and similar tracking technologies

We collect only the personal data necessary for the purposes described in Section 4. Where you provide us with personal data about another individual — for example a colleague, director, or authorised signatory of your business — you confirm that you are entitled to share it with us and that they have been informed of this policy.

We use the information we collect to:

• Process and manage your financing applications
• Verify your identity and conduct credit assessments
• Provide, operate, and maintain our platform
• Communicate with you about your account and transactions
• Send promotional communications (with your consent)
• Comply with legal and regulatory requirements
• Prevent fraud and enhance security
• Improve our services and user experience

Under the DPDP Act, we process personal data either on the basis of your consent or for a legitimate use permitted by the Act. Consent is our basis for marketing communications and for optional website analytics. Processing necessary to perform a service you have requested, and processing we must carry out to meet a legal or regulatory obligation — KYC, anti-money-laundering, credit reporting, tax and statutory record-keeping — does not rest on consent and continues even if consent for other purposes is withdrawn.

We do not use your personal data for automated decision-making that produces a legal effect on you without human involvement. Credit decisions are made by our lending partner, not by Neenv.

Where we rely on your consent, we ask for it before processing, through a clear affirmative action, in plain language, and separately for each purpose. Our notice tells you what data is being collected, the purpose, how to withdraw consent, how to raise a grievance, and how to complain to the Data Protection Board of India.

5.1 Your right to withdraw

You may withdraw your consent at any time, in full or for any individual purpose. This is not limited to marketing. Withdrawing consent must be, and is, as easy as giving it — we do not require you to give a reason, complete a form we have not offered you, or speak to anyone before we act.

• All processing based on consent: email the Grievance Officer named in Section 14 stating what you wish to withdraw. You may withdraw everything, or name specific purposes.
• Marketing communications: use the unsubscribe link in any message, or email us.
• Website analytics cookies: use the "Manage cookie preferences" control in our Cookie Policy.

5.2 What happens when you withdraw

We act on a withdrawal request within 3 working days of receiving it. We stop the affected processing, and we instruct our Data Processors to do the same. Personal data no longer needed for any other purpose is erased in line with Section 10, unless we are required by law to retain it.

Withdrawal operates from the date it takes effect. It does not make earlier processing unlawful, and it does not affect:

• data we are required to retain under the laws listed in Section 2;
• data held by a lending partner in connection with a live credit facility, which is governed by that lender's own privacy policy and its obligations to the RBI; or
• credit information already furnished to a credit information company, which is governed by the Credit Information Companies (Regulation) Act, 2005.

Where withdrawing consent means we can no longer provide part of a service, we will tell you the consequence before acting on your request, so you can decide.

We may share your information with:

• Financial Institution Partners: Banks and NBFCs that provide financing through our platform
• Brand/Corporate Partners: Businesses in your supply chain as required for transaction processing
• Service Providers: Third-party vendors who assist in operating our platform
• Credit Bureaus: For credit assessment and reporting purposes
• Regulatory Authorities: As required by applicable laws and regulations

We do not sell your personal information to third parties for marketing purposes.

6.1 Who these parties are

The recipients we currently work with are set out below. We update this list when it changes.

Every Data Processor we engage is bound by a written contract that limits them to our documented instructions, requires security measures at least equal to our own, requires them to report a breach to us without delay, and requires deletion or return of the data when the engagement ends.

Your personal data is stored and processed primarily within India. Our platform data, application records, and KYC records are held on infrastructure located in India, and our lending partner holds the data relating to a credit facility on its own systems in India in accordance with the RBI's data storage requirements.

A limited category of data may be processed outside India by technology processors:

Section 16 of the DPDP Act permits transfer of personal data outside India except to a country or territory that the Central Government restricts by notification. We do not transfer personal data to any restricted country. Where we transfer data outside India, we do so under a written contract that binds the recipient to confidentiality, purpose limitation, and security standards at least equal to those in this policy, and we remain accountable to you for that data.

We do not transfer KYC documents, bank account details, credit information, or transaction records outside India.

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure access controls and authentication
• Regular security assessments and audits
• Employee training on data protection

In addition, and in line with the reasonable security safeguards required by Section 8(5) of the DPDP Act and the DPDP Rules, we maintain:

• Access control on a need-to-know basis — access to personal data is restricted to personnel whose role requires it, granted through role-based permissions, reviewed periodically, and revoked when a person changes role or leaves.
• Encryption — data in transit is protected with TLS; data at rest, including backups, is encrypted.
• Logging and monitoring — we maintain logs of access to and activity on systems holding personal data, to detect unauthorised access and to support investigation of any incident. Logs are retained for at least one year.
• Backups and continuity — personal data is backed up regularly, backups are encrypted and held in India, and restoration is tested so that data can be recovered after an incident.
• Contractual safeguards — every processor is contractually required to maintain equivalent safeguards.
• Deletion on expiry — personal data is deleted, and the deletion propagated to backups on their normal cycle, once the retention period in Section 10 ends.

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

A personal data breach means any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises its confidentiality, integrity, or availability.

If a breach affecting your personal data occurs, we commit to the following:

• Notice to you, without delay. We will inform every affected Data Principal directly, in plain language, describing the nature and extent of the breach, when it occurred, the likely consequences for you, the measures we have taken to mitigate risk, what you can do to protect yourself, and how to contact us for more information.
• Initial notice to the Data Protection Board of India, without delay, on becoming aware of the breach, describing its nature, extent, timing, and likely impact.
• Detailed report to the Board within 72 hours of becoming aware of the breach — or within any longer period the Board allows on request — covering the events and circumstances leading to the breach, the measures taken to mitigate risk, the findings on who caused it, the remedial measures taken to prevent recurrence, and a copy of the intimations given to affected Data Principals.
• Records. We maintain a record of every breach, the response taken, and the remedial measures implemented.

Where a breach originates with a Data Processor, our contracts require them to notify us without delay so that these timelines can be met. Where a breach relates to data held by a lending partner on its own systems, that lender carries the notification obligation and we will support and coordinate with it.

Breaches involving payment systems or regulated lending activity are additionally reported to the Reserve Bank of India, and cyber security incidents to CERT-In, within the timelines those authorities prescribe.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Financial records are retained as per applicable regulatory requirements.

In practical terms, the periods we apply are:

At the end of the applicable period, personal data is erased, and the erasure is propagated to backups on their normal rotation cycle. Where a record must be kept for a statutory period but is no longer needed operationally, we restrict access to it for the remainder of that period rather than keeping it in active use.

If a longer period is directed by a court, a regulator, or is necessary for a live legal proceeding, we retain the data for that period and no longer.

Our platform and services are intended for businesses and for individuals aged 18 years and over. We do not knowingly collect personal data from anyone under the age of 18.

Our services are business-to-business financing products. They are not directed at children, are not marketed to children, and cannot be applied for by a child. Consistent with Section 9 of the DPDP Act:

• we do not undertake tracking or behavioural monitoring of children;
• we do not direct advertising at children; and
• we do not process children's personal data in any way likely to cause a detrimental effect on the well-being of a child.

The same approach applies to a person with a disability who has a lawfully appointed guardian.

If we become aware that we have inadvertently collected personal data from a person under 18 without verifiable consent from a parent or lawful guardian, we will erase it promptly. If you believe a child has provided us with personal data, please contact the Grievance Officer named in Section 14 and we will act on it without delay.

Subject to applicable laws, you have the right to:

• Access and receive a copy of your personal information
• Correct inaccurate or incomplete information
• Request deletion of your information (subject to legal requirements)
• Withdraw consent for marketing communications
• Lodge a complaint with relevant data protection authorities

Under the DPDP Act, these rights are as follows:

• Right to access information (Section 11): a summary of the personal data we hold about you and how it is being processed, together with the identities of every other Data Fiduciary and Data Processor with whom it has been shared and a description of what was shared.
• Right to correction, completion, updating and erasure (Section 12): correction of inaccurate or misleading data, completion of incomplete data, updating of out-of-date data, and erasure of data that is no longer needed for the purpose it was collected for, unless retention is required by law.
• Right to withdraw consent (Section 6(4)): in full or for a specific purpose, at any time, as easily as consent was given. This extends to all consent-based processing, not only marketing — see Section 5 above.
• Right of grievance redressal (Section 13): a readily available means of raising a grievance with us about our handling of your data or your rights, which we must respond to within the period prescribed by the DPDP Rules.
• Right to nominate (Section 14): nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Right to complain to the Data Protection Board of India: if you are not satisfied with our response, or we do not respond within the prescribed period — see Section 14 below.

12.1 How to exercise them

Email the Grievance Officer named in Section 14, marking your message "Data Rights Request". Full guidance on what to include is set out in the Data Rights section of our Legal & Privacy page. We may ask for information reasonably necessary to verify your identity before acting on a request, and we do not charge a fee.

We acknowledge requests within 3 working days and respond substantively within 30 calendar days. Grievances are resolved as early as possible and in any event no later than 90 days from registration. If we decline a request in whole or in part, we will tell you why and what you can do next.

Your duties as a Data Principal: the DPDP Act asks that you provide authentic information when exercising the right to correction, that you do not impersonate another person or suppress material information where the law requires disclosure, and that you do not raise a false or frivolous grievance.

We use cookies and similar tracking technologies to enhance your experience on our platform. These help us understand how you use our services and enable certain features. You can control cookie preferences through your browser settings.

Only strictly necessary cookies operate by default. Analytics cookies, including Google Analytics, are not loaded at all until you actively accept them through our cookie consent banner, and you may withdraw that consent at any time.

The full list of what we store, its purpose and duration, and the control to change or withdraw your choice are set out in our Cookie Policy.

In accordance with Section 13 of the DPDP Act, we have appointed a Grievance Officer to answer questions about this policy and to address any grievance regarding our processing of your personal data or the exercise of your rights.

We acknowledge every grievance within 3 working days and resolve it as early as possible, and in any event no later than 90 days from the date it is registered. The complete escalation path is set out in our Grievance Redressal Policy.

14.1 Escalation to the Data Protection Board of India

If you are not satisfied with our response, or we have not responded within the period stated above, you may make a complaint to the Data Protection Board of India, the adjudicating authority established under Chapter V of the DPDP Act. Complaints to the Board are made in the manner and form prescribed by the DPDP Rules, and the Board publishes its procedure and contact details on its official website.

Exhausting the grievance process with us first is a precondition to approaching the Board under the DPDP Act. Nothing in this policy limits your right to any other remedy available to you in law, including escalation to the Reserve Bank of India under the Reserve Bank – Integrated Ombudsman Scheme, 2021 where your complaint concerns a regulated entity.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

Where a change materially affects how we process personal data that we hold on the basis of your consent, we will inform you directly and, where the law requires it, obtain fresh consent before the change takes effect.

If you have any questions about this Privacy Policy or our data practices, please contact us:

For data privacy requests and grievances specifically, please write to the Grievance Officer named in Section 14 rather than to the general enquiry address.