Privacy Policy

Document Details Version 3.0 FINAL, dated 19 October 2026. Replaces the Privacy Policy in Terms and Privacy Policy V2.0 (last revised 27 April 2021). Effective date 20th October, 2026 Entity Finnovus Technologies Private Limited (CIN U72900MH2020PTC340845) Registered office 5th Floor 11-B/503 Baronet CHS, Lokhandwala Township, Akurli Road, Kandivali East, Mumbai, Maharashtra-400101 Grievance Officer Sujit Desai, customer.services@creditsiddhi.com (see section 14)

1. About this policy

Finnovus Technologies Private Limited ("Finnovus", "CreditSiddhi", "we", "us" or "our") builds NEO, a platform that helps MSMEs show who they are as businesses. NEO brings together the documents and information a business chooses to share and presents them as a NEO Economic Identity Report and, for eligible businesses, NEO MSME Certification. We respect your privacy and your choices. This policy explains how we collect, use, share and protect personal information about you when you visit our websites (creditsiddhi.com and creditsiddhi.in) (the "Site"), use NEO by CreditSiddhi (the "Platform"), request a meeting, or take part in our events and campaigns. It applies to the people who deal with us: MSME owners, proprietors, directors and promoters who share business documents; representatives of institutions, buyers and other organisations that use NEO; and visitors to our websites. It also binds our employees, agents and partners, who must follow it whenever they handle personal information on our behalf. Please read it with our Terms and Conditions, Cookies Policy and Digital Lending Disclosure. Using the Platform does not mean you have agreed to everything described here. Where the law requires your consent, for example to process the documents you upload or to share your report with another organisation after a match, we ask for it separately, at that point, and you can say no.

2. What we do, and what we do not

• NEO helps an MSME show who it is as a business. It builds an Economic Identity from the documents and information the MSME submits, and from other sources it authorises, and presents it as the NEO Economic Identity Report and, for eligible businesses, NEO MSME Certification.
• You decide who sees your report. Until you give a separate consent, no institution, buyer or partner sees your documents or your report.
• If you later ask us to connect you with a lending institution, we act as a lending service provider and handle your information in line with the RBI digital lending directions that apply to us. We are not a bank, a lender or a credit bureau, and we do not approve or disburse loans. The institution, and not Finnovus, decides whether to lend and on what terms. Having a report does not guarantee any outcome.
• We collect information about your business from you, from the documents you share and from public sources, and we decide why and how it is used. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the data fiduciary. We prepare your report from this information and share it with institutions only as set out in sections 5 and 6.

3. Information we collect

Category Examples Where it comes from Contact details Name, email address, organisation, role, and the message you send when you request a meeting or contact us. You Account details Name, email, mobile number, designation, and sign-in credentials (passwords are stored in hashed form, never in plain text). You Business documents and data GST registrations and returns, bank statements, tax statements, financial statements, Udyam registration, PAN and compliance documents. You, by upload or by a source you authorise Identity and address proofs Proofs for the business and for its proprietors, directors or promoters, such as Aadhaar and PAN. We use identity documents only to confirm who you are, and for no other purpose. You Information we derive Patterns in your cash flow, customers, suppliers and payments, and the NEO Score and report built from them. Generated by NEO from the data above Public information Official and public records about a business, such as company registry filings, regulatory and statutory records and other public registers. We add sources from time to time, and list the current sources on our website. Public sources Technical data IP address, device and browser type, pages visited and time stamps, used for security and to run the site. Collected automatically Our correspondence Emails, call notes and meeting records with you. You and us Sensitive information. Bank account details and statements are "sensitive personal data or information" under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). We collect them only with your consent, which you may give in writing or by electronic confirmation, and only for the purposes in section 4. What you can leave out. You can browse most of the website without telling us who you are. If you do not give us information that a service needs, we may not be able to provide that service, but we will tell you which information is needed and why.

4. How we use information

Purpose Information used Basis Reply to your enquiry and arrange a meeting Contact details, correspondence Your request Send you updates and promotional messages about NEO Contact details Your consent. You can opt out at any time Create and manage your account and check who you are Account details, identity proofs Your consent Prepare your NEO Economic Identity Report, NEO Score and certification, and match your profile with suitable institutions Business documents, derived data, public information Your consent (stage 1) Refresh your report every quarter, or when you ask us to Business documents, derived data Your consent (stage 1) Share your report or documents with an institution after a match Report, selected documents Your separate consent for that institution Keep the Platform secure, prevent fraud, fix faults and keep audit records Technical data, account details Legal obligation and legitimate use Understand how the website is used, using de-identified or aggregated data Technical data Your consent Improve NEO's methods and models, using de-identified or aggregated data only Derived data with details that identify you or your business removed Your consent (stage 1), which you can decline Make anonymised, aggregated data available to approved external researchers, to support research on MSMEs and on policy for the sector Derived data that has been anonymised and aggregated Your consent (stage 1), which you can decline Meet legal duties and respond to lawful requests from authorities Any of the above Legal obligation Research. We may make anonymised, aggregated data available to external research scholars, so that it can inform research on India's MSME sector and the policies that support it. Anonymised means it can no longer identify you or your business, and aggregated means it is combined with data from many businesses. Data is released only when each group contains at least 100 businesses. We approve only researchers who work or study at an institution recognised by the University Grants Commission (UGC), and each approval is for a defined period only. Researchers receive the data under written terms that bar them from trying to identify anyone and from passing it on. We never give researchers your documents, your report or your NEO Score. Improving NEO means learning from patterns across many businesses. We remove details that identify you or your business before we do this, and no other customer sees your documents or your report. We use your information only for the purposes above. We do not sell personal information, and we do not use it to show you third-party advertising.

5. Consent in two stages, and how to withdraw it

We ask for your consent in two separate stages, so that agreeing to the first never means agreeing to the second.

• Stage 1: being assessed by NEO. You consent to us processing the documents and information you provide to prepare your report, NEO Score and certification, to refresh them every quarter or when you ask, and, if you agree, to improve NEO and to support external research using de-identified or anonymised data. At this stage no institution sees your documents or your report. We may use your report internally to match your profile with suitable institutions.
• Stage 2: after a match. Before we share anything with a lending institution, we show you the institution by name, exactly what we would share, why, and for how long, and we ask for your consent for that institution. You can agree for one institution and decline another, and you can say no without losing your report. When we ask for consent we will tell you what information we want, why, who will see it and how to withdraw. You can withdraw consent at any time by writing to us at customer.services@creditsiddhi.com. We will act on a withdrawal within 15 working days. You can opt out of updates and promotional messages at any time, using the unsubscribe link in the message or by writing to us. Withdrawing consent does not affect what we did lawfully before you withdrew. It may mean we can no longer prepare or refresh your report, or keep it available to institutions.

6. Who we share information with

We share information only in these cases.

• Institutions you choose. After a match, and only once you have given the stage 2 consent for that institution, we share the report and documents shown to you in that consent. Once shared, that institution's own privacy policy and retention rules apply to its copy.
• Buyers and other organisations evaluating you. If a buyer or another organisation asks NEO to evaluate you as a supplier or partner, we share information with it only if you agree.
• Service providers. Companies that help us run the Platform, such as cloud hosting (Google Cloud Platform, India), secure communications and, if you accept analytics cookies, analytics tools such as Google Analytics. They may use the information only to provide their service to us and must protect it.
• Authorities. Government bodies, regulators and courts, where the law requires or a lawful order is served.
• A change in our business. If Finnovus merges with or is acquired by another company, your information may transfer to it. The new owner must honour this policy, and we will tell you first. We never sell information that identifies you or your business.

7. How the NEO Score and report are produced

NEO produces your report and NEO Score by analysing your documents and data with automated methods. The report is information for you and for the organisations you choose to share it with. It does not decide anything about you: a person at the receiving organisation makes any decision. If you think something in your report is wrong, write to us at customer.services@creditsiddhi.com and we will review it within 15 working days and correct it where we find an error.

8. Where we keep information, and how we protect it

We store the information you give the Platform on Google Cloud Platform infrastructure in India. Website analytics data, which we collect only if you accept analytics cookies, is processed by our analytics providers and may be processed outside India. We do not run analytics on the pages where you upload documents or view your report. We protect information with measures that include encryption in transit and at rest, access limited to staff who need it, hashed passwords, network and activity monitoring, regular security testing and a documented incident response process. No system is completely secure, so we cannot promise absolute security. You help by keeping your sign-in details private. If a personal data breach affects you, we will tell you and the authorities in the way and time the law requires.

9. How long we keep information

Information How long Enquiries and meeting requests 12 months after our last contact with you Account, report and derived data While your account is active, and then for no more than 30 days after you close it, except records we must keep by law Uploaded business documents Until you delete them or close your account, and then for no more than 30 days, except records we must keep by law. No law sets a fixed period for this, so we set the shortest period we need. Consent and withdrawal records For as long as we rely on your consent, and 3 years after, so we can show what you agreed to Security and access logs As long as the law requires, and not less than 180 days, stored in India (CERT-In directions) We may keep information for longer where a law, a regulator or a legal claim requires it. When the period ends we delete or anonymise it.

10. Your rights

You can ask us to:

• give you a summary of the personal information we hold about you and how it is used, and who we have shared it with;
• correct, complete or update information that is wrong or out of date;
• ask us to erase information we no longer need to keep;
• withdraw a consent you have given;
• look into a complaint about how we handle your information; and
• act through a person you nominate if you die or cannot act for yourself. To use any of these rights, write to customer.services@creditsiddhi.com or to the Grievance Officer in section 14. We will confirm who you are and answer within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India once its complaint process is in force, or to any other authority the law provides.

11. Children

The Platform is for businesses and the adults who run them. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, tell us and we will delete it.

12. Cookies and similar technologies

We use cookies that are strictly necessary to run the Platform, such as keeping you signed in and keeping your session secure, and we set them without asking. We use analytics cookies from Google and other providers only if you accept them, and only on the public pages of the Site, not on the pages where you upload documents or view your report. We do not use advertising cookies, and our fonts are stored on our own servers. Our Cookies Policy explains what we use, why and how to control it.

13. Links to other sites, and changes to this policy

Our website may link to other sites. We do not control them and are not responsible for their content or privacy practices. We may update this policy, for example when the law or the Platform changes. We will post the new version here with its date. If a change affects how we use information you have already given us, we will tell you directly and, where the law requires, ask for your consent again. Continuing to browse the site after a change means you accept the updated policy for visitor data, but it never replaces consent that the law requires.

14. Contact us and the Grievance Officer

For questions about this policy, to use your rights, or to make a complaint, write to our Grievance Officer. We acknowledge complaints within 3 working days and resolve them within 30 days. Detail Contact Name Sujit Desai, Grievance Officer Email customer.services@creditsiddhi.com Postal address Finnovus Technologies Private Limited, 5th Floor 11-B/503 Baronet CHS, Lokhandwala Township, Akurli Road, Kandivali East, Mumbai, Maharashtra-400101 General enquiries customer.services@creditsiddhi.com