PRIVACY POLICY

At Northern Arc, ("we", "our", or "us") are committed to protect your personal data and respect your privacy. Please read the following terms of the Policy carefully to understand our practices regarding your personal data and how we will treat it. This Policy sets out the basis on which any personal data we collect from you, we collect about you, or that you provide to us, will be processed by us.

Collection of Customer Data

By providing us with the consent to process your personal data, you acknowledge that we will collect, store, use, and disclose your personal data in accordance with this Policy. This includes:
- Identity and profile-related data: First and last names, parents' names, dates of birth, gender, photographs, educational qualifications, purpose of loans, house ownership, employment status, company names, contact information, and marital status.
- KYC data: Identification documents issued by government authorities, such as Aadhaar, PAN card, and voter ID.
- Transaction data: Details of transactions that occur through the products and services or in connection with the services, including sought or availed services.
- Data from SMS: SMS data from individuals' phones is collected to verify and analyse financial positions, cash flow, credits, income, and spending patterns, with individuals' permission.
- Financial data: Past credit history, income details, details of loans, payments, bank account information, and bank account statements.
- Device data: IP addresses, browser types, time zone settings, operating systems, and device information.
Data is not collected from individuals' mobile phone resources, such as contact lists, call logs, telephony functions, and files and media.
- We do not collect your biometric data. However, we may take one-time access of your camera, microphone, location (fine and coarse GPS data), or any other facility solely for the purpose of onboarding or KYC checks, after obtaining your explicit consent.
On the mobile application, the 'safety & security' section in app details shall display the data being collected and for what purpose such as-
- App permissions like-
  - SMS: SMSs are read to ascertain the credit worthiness and offer amount.
  - Location: To check the serviceability of a loan application and to expedite the KYC process.
  - Camera & Media Access: It helps you upload your pictured as part of the application and KYC process
  - Read Device Information: It helps to securely link the loan application to the user's phone.
- Data collected for the purposes-
  - Approximate and precise location
  - Personal info (name, email address, address, phone number, and other info)
  - Financial info (user payment info, purchase history, and other financial info)
  - SMSs
  - Photos & videos (photos, gallery, media)
  - Files and docs
  - App activity
  - App info and performances (crash logs, diagnostics, and other data to improve app Aerformance)
  - Device or other IDs
- Data that may be shared with other companies as per the requirements-
  - Personal info (name, email address, address, phone number, and other info)
  - Financial info (user payment info, purchase history, and other financial info)
  - Photos & videos (photos, gallery, media)
  - Files and docs
  - App activity & interactions
  - App info and performance (crash logs, diagnostics, and other data to improve app performance)
  - Device or other IDs etc.
Northern Arc is required to collect your personal data to provide you with access to the Products and Services. In certain cases, we are required to collect personal data as required by law, or under the Terms. If you fail to provide us that data as and when requested by us, we will not be able to perform our obligations under the arrangement we have with you or are trying to enter into with you (for example, to provide you with features of the Services). In this case, we may have to cancel or limit your access to the Services (or part thereof).
Collection Of Financial SMS Information
We don't collect, read or store your personal SMS from your inbox. We collect and monitor only financial SMS sent by 6-digit alphanumeric senders from your inbox which helps us in identifying the cash flow patterns, description and amount of the transactions undertaken by you as a user to help us perform a credit risk assessment which enables us to determine your risk profile and to provide you with the appropriate credit analysis. This process will enable you to take financial facilities from the regulated financial entities available on the platform. This Financial decision will be based on historical transaction data too.
Collection Of Device Location and Device Information
We collect and monitor the information about the location of your device to provide serviceability of your loan application, to reduce risk associated with your loan application and to provide pre-approved customized loan offers. This also helps us to verify the address, make a better credit risk decision and expedite know your customer (KYC) process. Information the App collects, and its usage, depends on how you manage your privacy controls on your device. When you install the App, we store the information we collect with unique identifiers tied to the device you are using. We collect information from the device when you download and install the App and explicitly seek permissions from You to get the required information from the device. The information we collect from your device includes the hardware model, build model, RAM, storage; unique device identifiers like IMEI, serial number, SSAID; SIM information that includes network operator, roaming state, MNC and MCC codes, WIFI information that includes MAC address and mobile network information to uniquely identify the devices and ensure that no unauthorized device acts on your behalf to prevent frauds.

Credit and investment products and services

We will collect your personal information, such as proof of identity, address, contact details, bank account details, demat account details, credit information, and risk profiles, from applicants, customers, and users of its website and mobile applications. This information will be used for evaluating credit applications, credit risk assessments, investment applications, providing products and services, complying with customer identification requirements under the law, and maintaining and reporting customer account information as required by applicable laws.

Social Media

Information made publicly available on social media and third-party sources may be collected by us. You can control your browser privacy settings for information shared on social media through your system cookies and settings. Additionally, we may receive information from credit bureaus, registries, account aggregators, and other regulated entities.

Related Persons

Information about related persons, co-applicants, guarantors, nominees, ultimate beneficial owners, and others may be collected to comply with applicable laws or to evaluate credit and risk profiles, provided the necessary consents and permissions are obtained.

Payments processing

Payment-related information, such as credit card, debit card, and bank account details, may be collected when making payments on Northern Arc's website or mobile applications. It is saved to facilitate payment processing through third-party payment gateways, subject to theirs terms, conditions, and privacy policies.

Log File Information

Log file information is automatically reported when accessing the program and may also be collected from emails sent to users. This data helps track email interactions, application usage, and provides insights for reporting and optimization.

Device Identifiers

When a user sets up their mobile application or accesses it from a new device, we may capture specific device information, including the device's unique identifiers (e.g., IMEI, serial number for mobile phones) and device characteristics. This information is used to identify and verify the device. This information helps to implement device binding which involves linking a specific mobile device to a mobile application. The primary goal is to ensure that your account can only be accessed from a trusted and authenticated device.

Device binding adds an extra layer of security. It helps prevent unauthorized access, reduces the risk of fraud, and protects your data.

Method of Collecting Information

We will use following methods to collect and process your personal data, including:

Information Provided by You

Information voluntarily provided by users when using the Services or corresponding with us, such as during registration, feature use, data sharing, or issue reporting. Records of these interactions are maintained.
Information Collected from Your Devices

Information is automatically collected when users visit the use the Products or Services through tools like cookies and mobile application.
Information Received from Third Parties

Personal data is obtained from third parties, public sources, and data analytics tools. This data contributes to reporting, marketing, and improving user experience.

In case the information provided by the user or customer is invalid or not accessible, e.g., a change in contact details, Northern Arc may reach out to an appropriate and authorized bureau and agency to obtain the updated information.
Publicly Available Information

We will not have control over personal data made publicly available, such as reviews or comments in public sections of the platform or application stores. Provider of the information or users share such data at their own risk, and we will not be responsible for third-party misuse of this information.
Information Received from Specialized Service Providers

We also obtain your information from third party entities that your business maintains accounts with, such as financial institutions, service providers referral partners, identity verification services, card networks, vendors, mailing list providers, consumer reporting agencies, commercial credit bureaus and associations, fraud prevention agencies. We may combine this information with the information that has already been collected from you or about you.

For example, we may obtain transactional information about your businesses from financial institutions, information about your business' engagement with customers from social networking services, and information about your business' sales volume from service providers.
Purpose for which Information is Collected (How we use your data)
- We use personal data in accordance with applicable laws, primarily to provide services and comply with legal obligations.
- By using our services, you authorize us to contact us via email, phone, or other means to ensure awareness of service features.
- We use your personal data for the following purposes and activities undertaken without direct human supervision or control:
  - To register you as a user of the mobile application;
  - To provide you with the Services;
  - To facilitate your application to avail loan and otherwise in connection with your obtaining of credit facilities from regulated entities including our lending partners
  - To manage our relationship with you, including notifying you of changes to any Services;
  - To administer and protect our business and the products or services, including troubleshooting, data analysis, system testing, and performing internal operations;
  - To deliver content to you;
  - To send you communication, including through WhatsApp business messages, in relation to your use of the Products or Services;
  - To monitor trends so we can improve the Products and Services;
  - To improve our business and delivery models;
  - To perform our obligations that arise out of the arrangement we are about to enter or have entered with you;
  - To enforce our Terms;
  - To undertake marketing services, including sending you promotional messages;
  - To make offers of relevant products and promotions time to time
  - To obtain services related feedback;
  - To perform data analysis pertaining to our business, while using anonymized or masked data;
  - To respond to court orders, establish or exercise our legal rights, or defend ourselves against legal claims;
  - In compliance with the Reserve Bank of India's norms, to contact you or locate you in case of any default; and
  - To ensure compliance with applicable laws

Storage, sharing & disclosure of collected information

Storage & sharing of Information
- Your Consent: You allow us to collect, compile, and share their information with third parties, including Lenders and service providers, solely for rendering Services. Failure to provide consent may hinder our ability to meet its obligations.
- Communication Authorization: You authorize us, our partners, and affiliates to contact them via email or phone to ensure you are aware of Service features
- Legal Compliance: We will share data when required by law, courts, government agencies, or authorities.
- Your data, including financial data, will be stored on systems located in India.
Disclosure of Personal Information

We do not disclose personal information to third parties without your consent, except when necessary for normal financial business operations or legally permitted.

Northern Arc may engage third party service providers to perform functions and provide services to us, such as hosting and maintaining our servers, websites and mobile applications management, conducting surveys or contests, third-party solutions for marketing and analytics, application developers, database storage and management, data hosting, e-mail management, payments processing, some aspects of our technical and customer support, collections and recovery. In order to enable these third parties to perform these services for us and for you we may share your personal information, and possibly some non-personal information, with them after imposing confidentiality obligations on them.

Links to Other Websites

Our website and mobile applications may contain links to other websites and mobile applications that are not operated by us. If you click on a third-party link, you will be directed to that third party's site or mobile application. We advise you to review the privacy policy and terms of use of every site you visit and every mobile application that you use. Third parties are under no obligation to comply with this Privacy Statement with respect to personal data that you provide directly to those third parties or that those third parties collect for themselves. We do not control the third-party websites or mobile applications that may be accessible through our websites or mobile applications. Thus, this Privacy Policy does not apply to information you provide to third-party websites or mobile applications or gathered by the third parties that operate them. Please be aware that we have no control over the content and policies of those websites or mobile applications and we cannot accept responsibility or liability for their respective privacy practices.

Northern Arc encourage you to review the privacy policies and terms of other websites, services and mobile applications accessed through our platform.

Protection of Personal Information

Northern Arc take precautions to protect the security of your personal information. Such security practices and procedures as stipulated under applicable law will be applied on the personal information, we collect from you. To protect privacy of your personal information, we implement Page 6 of 8 a variety of security measures to maintain the safety of your personal information. Please be aware that we cannot rule out breach of privacy of your personal information on account of breach of any of our physical, technical, or managerial safeguards.

Where we receive your personal information through the digital lending applications of our loan service providers, we require them to have privacy policies to govern the personal information they collect from you. Collection of your personal information through our digital lending applications will be need-based and with your prior and explicit consent and the purpose of obtaining consent will be disclosed at each stage of interface. Your explicit consent will be taken before sharing your personal information with any third party, except for cases where such sharing is required as per applicable law.

Third parties that are service providers to the Company with whom personal information will be shared by the Company will be required to provide access to such personal information to its personnel only on a need-to-know basis.
Restricted Access

Access for our personnel to personal information will only be on a need-to-know basis that is relevant for their respective function. Where it will suffice, access will be provided to depersonalized/anonymized/pseudonymized information as appropriate.
Data Protection or Grievance Redressal

You can contact the Data Protection Officer or Grievance Redressal Officer in case of any privacy concern, complaint, or any question regarding this Privacy Policy

Title: Chief Information Security Officer

Address: IndiQube Golf View Homes,

6th Floor, Tower B, 3rd Cross Road,

S R Layout, Murgesh Pallya, Bengaluru-560017

Email ID: dpo@northernarc.com
- We facilitate your request to exercise these rights, following regulations governing data processing and storage. To initiate this process, they should send an email to the Data Protection Officer or Grievance Officer, as detailed in Section 10.4.6 of this Policy, providing a comprehensive outline of the right(s) they intend to exercise. Additionally, you describe the personal data they believe we hold. In case further information is necessary, the Grievance Officer will get in touch with them
- Our privacy team will aim to respond to these requests within 30 days. If, for any reason, they cannot meet this timeline, you will be duly informed.
Support

Users of our services, website or mobile application will send an email to customersupport@northernarc.com in case of any questions or to require any support regarding this Privacy Policy.
Data Retention and Destruction Protocols
- Any deletion or destruction of any personal data governed by this Privacy Policy in terms thereof shall be, to the extent technically possible and in accordance with the relevant industry standards. Alternatively, we may render the personal data into anonymized data, so that it no longer constitutes personal data.
- We ensure that users acknowledge personal data, and it may continue to be stored as required or permitted by laws, regulations, or for legal defense.
- We ensure that KYC, device location, and SMS data shall be deleted or anonymized as per applicable legal or regulatory requirements pertaining to data retention from the application date. Other data will be deleted or anonymized upon your request, provided there are no active loans or services. However, legal obligations or applicable laws may prevent data deletion in some cases.
Rectification and Erasure of Personal Information
- If you believe that any information, we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, please write to customersupport@northernarc.com with the subject line "Rectification Request". We will take reasonable steps to correct any personal information found to be inaccurate, incomplete, misleading, or out of date. Such updates, corrections, changes and deletions will have no effect on other information that we maintain, or information that we have provided to third parties in accordance with this Privacy Policy prior to such update, correction, change or deletion
- If you require any personal information of yours in our possession to be deleted wholly or partially, you may write to customersupport@northernarc.com with the subject line "Erasure Request". We will consider deleting such personal information subject to our obligations under applicable laws, our rights and obligations under contracts, and our legitimate interests including for the establishment, exercise or defense of legal claims if such personal information is no longer necessary for the purpose for which it was originally collected or processed for.
- You should be aware that it is not technologically possible to remove each and every record of the information you have provided to us from our system. The need to back up our systems to protect information from inadvertent loss means that a copy of your information may exist in a non-erasable form that will be difficult or impossible for us to locate. Personal information that has been deleted pursuant to any request for deletion will not be retrieved for use thereafter.
- Northern Arc shall verify the accuracy of any newly provided personal. When using Northern Arc's services, website, or mobile application; individuals will be provided with the means to review and correct inaccurate or incomplete information, as permitted by legal requirements.
Non-Binding

Please note that this privacy policy does not create any contractual or other legal rights in or on behalf of any party, nor is it intended to do so.
Notification of data breaches

Norther Arc comply with applicable laws applicable to the organization in respect of any data breach.
Legal Rights

Under certain circumstances, you have the right to:
- Request the erasure of your personal data: This enables you to ask us to delete or remove personal data. We shall comply with any request, subject to applicable laws and the terms of the loans that are sanctioned through the mobile application.
- Right to Deny Consent: You can opt not to grant consent for the processing of your personal data. However, this choice may affect our ability to provide services
- Right to Revoke Consent: You can withdraw consent at any time. We comply with any such request, subject to applicable laws and the terms governing Products or Services.

Children's Privacy

Norther Arc service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian Page 8 of 8 and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from anyone under the age of 18 without verification of parental consent, we take steps to remove that information from our servers.

Cookies, small data files stored on the device, help us distinguish you from other users and to remember your preferences. This enhances the experience and allows us to improve services.

Cookies identify you without accessing personal data like email addresses. Data collected via cookies helps us manage and personalize services, granting access to certain features
Third parties may place cookies on specific pages; we don't control their cookie usage.
We use cookies to enhance your experience. You can configure the browser to refuse or alert about cookies, but this may affect website functionality.

Website Disclaimer

We use cookies to give you the best possible experience with northernarc.com. Some are essential for this site to function; others help us understand how you use the site, so we can improve it. We may also use cookies for targeting purposes. Click "Accept all cookies" to proceed as specified or click "Manage my preferences" to choose the types of cookies you will accept.

Changes to this policy

We may, at our discretion, make changes to this Privacy Policy to reflect updates in our business processes, upgrades in privacy standards and procedures, or legislative or regulatory changes. You acknowledge that any such policy changes will be effective from the date of posting on our website, and notification of these changes will be published on the website.
We keep our Policy under regular review and may amend it from time to time, at our sole discretion.
The terms of this Policy may change and if it does, these changes will be posted on this page and, where appropriate, notified to you by email or phone number through SMS.

By providing Northern Arc with personal information, a provider of the information acknowledges that Northern Arc will collect, store, use, process, disclose and share providers personal information in accordance with the applicable laws and this Privacy Policy.