Privacy Policy

1. About This Policy

Mega Corporation Limited, together with its group entities (as the context requires, “MCL”, “we”, “us” or “our”), values the trust our customers place in us when they share their personal information. This Privacy Policy has been approved by our Board of Directors and explains, in plain terms, what personal data we collect about you, why we collect it, how we use and share it, and the choices and rights available to you.

This Policy applies to every individual who accesses or uses our website, mobile applications, branch offices, kiosks, customer service touchpoints, and any other channel through which we offer our products and services (together, the “Platform”). It covers personal data collected directly from you, generated through your use of the Platform, or received from our lending partners, business partners and other third parties described below.

We collect and process personal data only where you have consented, or where such collection is otherwise permitted under applicable law, and only to the extent reasonably necessary to deliver our services to you. If you choose not to provide certain information, or later withdraw a consent you previously gave, we may not be able to offer you the affected service.

Please read this Policy carefully before sharing any information with us or before using the Platform. We are responsible for the privacy and security practices of our own Platform; we are not responsible for the practices of any third-party website, application or service that may be linked from our Platform, and we encourage you to review the privacy notices of any such third party before interacting with it.

Capitalised terms used but not defined in this Policy have the meaning given to them in our Terms and Conditions / Terms of Use.

2. Scope and Relationship with Other Terms

This Policy forms part of, and is incorporated by reference into, the Terms and Conditions governing use of the Platform. Where any Lending Partner or Partner (each as defined below) provides you with a product or service through the Platform, that Lending Partner’s or Partner’s own privacy policy will separately govern its handling of your personal data, and we encourage you to review it.

By accessing or using the Platform, or by otherwise providing us with personal data, you confirm that you have read and understood this Policy.

3. Interpretation and Key Terms

Unless the context requires otherwise, the following terms carry the meanings set out below wherever they are used in this Policy:

Affiliate

any person that, directly or indirectly, controls, is controlled by, or is under common control with MCL.

Applicable Law

all applicable statutes, rules, regulations, directions, circulars and orders of any competent governmental or regulatory authority, including, to the extent applicable to MCL: the Digital Personal Data Protection Act, 2023 read with the Digital Personal Data Protection Rules, 2025; the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (to the extent still in force); the Reserve Bank of India’s Guidelines on Digital Lending, 2022; the Reserve Bank of India (Outsourcing of Information Technology Services) Directions, 2023; the Reserve Bank of India (Managing Risks and Code of Conduct in Outsourcing of Financial Services) Directions, 2017; the Master Direction — Know Your Customer (KYC) Direction, 2016; and the Credit Information Companies (Regulation) Act, 2005 read with the Credit Information Companies Rules, 2006 and the Credit Information Companies Regulations, 2006 — in each case as amended, re-enacted or replaced from time to time.

Body Corporate

a company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activity.

Cookies

small data files placed on your device by our website or mobile application to recognise your device and remember your actions or preferences over time.

Data

any representation of information, facts, concepts or instructions that is capable of being processed by a computer system, in any form, and, where relevant to credit institutions or credit information companies, has the meaning given to it under the Credit Information Companies (Regulation) Act, 2005.

Digital Lending App / DLA

a mobile or web-based application, whether operated by a Regulated Entity or by a Lending Service Provider engaged by a Regulated Entity, through which digital lending services are offered, consistent with the outsourcing framework prescribed by the Reserve Bank of India.

Group

Mega Corporation Limited together with the other entities forming part of its corporate group.

KYC

Know Your Customer.

Lending Partner

a Regulated Entity that offers its products or services (including loans) through the Platform pursuant to a contractual arrangement with MCL.

Lending Service Provider / LSP

an agent engaged by a Regulated Entity to perform, on the Regulated Entity’s behalf, one or more lending-related functions such as customer sourcing, underwriting support, pricing support, servicing, monitoring or recovery, in line with the outsourcing framework prescribed by the Reserve Bank of India.

Partner

a select third party with whom we have a contractual relationship for the provision of, or in connection with, the Services.

Person

any natural person, company, partnership, trust, association, government or agency thereof, or any other entity recognised as a person under Applicable Law.

Personal Data

has the meaning given to it under Applicable Law and, in general terms, means any data about an individual who is identifiable by or in relation to such data, as further described in Section 4 of this Policy.

Platform

the website, mobile application, branches, kiosks, customer touchpoints and any other channel owned or operated by MCL.

Regulated Entity / RE

commercial banks, urban and state co-operative banks, district central co-operative banks, and non-banking financial companies (including housing finance companies).

Representative

an employee or other personnel engaged by MCL or the Group for the purposes of its business.

Services

the services described in the Terms and Conditions of the Platform, including lending and personal-finance-management services such as analysis of bank transactions, investments, deposits and similar instruments to provide you with analytical insights.

User / you

any natural or legal person who accesses or uses the Platform; where a natural person acts on behalf of a business entity, references to “you” extend to that entity and its authorised representatives.

4. Personal Data We Collect

We collect, use and store the categories of personal data described below, always on a need-basis and only after obtaining your consent where such consent is required.

We may also supplement the data you provide with information we receive from our own dealings with you, or from Lending Partners, Partners and other Group entities. Please keep your personal data accurate and up to date, and notify us promptly of any change.

5. Basis and Manner of Consent

• MCL collects personal data only pursuant to explicit consent, after informing you of the consequences of declining to provide, or of withdrawing, that consent.
• We maintain an auditable record of every consent granted, modified or withdrawn.
• Providing personal data to us is entirely voluntary. However, some data is essential for regulatory or contractual reasons; if you do not wish to provide it, you may not be able to use the affected feature or Service.
• You may withdraw or modify your consent at any time by writing to us at the email address in Section 20. Withdrawal may mean that you can no longer access certain features or Services, and any Services already availed may be modified, restricted or discontinued in line with their applicable terms.
• Where we obtain personal data from publicly available sources, or in connection with a competition or survey, we do so in accordance with Applicable Law.
• We store all personal data in secure databases, protected by access controls, and treat it as confidential. You are responsible for keeping your login credentials confidential and must not knowingly permit unauthorised use of your account.
• We may also obtain your data from independent third parties — including Lending Partners, Partners, payment aggregators, payment service providers, technology providers, e-commerce platforms, fraud-prevention agencies and other Group entities — each governed by its own privacy policy.
• With your consent, we may process your information as a “financial information user”, including data received through a licensed account aggregator or consent manager, in accordance with Applicable Law, to provide our Services (including personal-finance-management and lending features).
• MCL may appoint an Affiliate or other Group entity as an outsourced service provider — for example, to support loan-account monitoring, receivables collection, data analytics or IT services — and such entity may act as a central repository of your data so that we can offer you a unified view of your products across the Group and related services offered by that entity.
• Separately, and in addition to the consents above, you consent to MCL and its present and future Group companies, professional advisers, service providers, successors, assigns, trustees, rating agencies, lenders and investors (each, a “Finance Party”) collecting, storing, analysing, transferring (within or outside India, subject to Applicable Law) and otherwise processing (i) personal data you provide to MCL, (ii) data generated from your relationship with MCL, and (iii) any analytics or scores derived from either — for purposes including underwriting, servicing and monitoring credit facilities; creating or perfecting security over amounts owed to MCL; enabling any sale, assignment, securitisation or similar capital-raising transaction (including due-diligence access); and debt monitoring, collection and enforcement. This consent supplements, and does not limit, the other consents described in this Policy.

6. How We Collect Your Information

• Directly from you — when you download our app, register an account, sign up for communications, complete a form, or otherwise provide us with personal data, whether online or offline.
• Through your interactions with us — including recorded telephone calls or other communications with our Representatives or customer-service team, subject to Applicable Law and our internal policies.
• Through Cookies and similar technologies — see Section 7 below.
• From third-party websites or apps with which we have a contractual relationship — where the third party’s own privacy policy will govern, and where we may receive data that helps us identify your account on that third-party platform.
• From credit information companies, acting as your authorised representative where required, subject to any necessary authorisation from you.
• From third parties supporting document verification and repayment tracking, including the National Securities Depository Limited (“NSDL”) and payment-gateway providers.
• From government or regulatory sources, such as GST records.

All personal data we collect is stored on our backend and cloud servers located in India, and is collected strictly on a need basis to deliver the Services.

7. Cookies and Similar Technologies

We use Cookies, cache and pixel tags to recognise your device, improve navigation and understand how visitors use the Platform. Our servers and analytics partners may collect IP addresses, operating-system and browser details, and language settings through these technologies, primarily to estimate visitor numbers, session duration and page popularity. Most browsers let you manage or disable Cookies through their settings; doing so may, however, limit some features of the Platform.

8. How We Use Your Personal Data

We use your personal data for the following purposes, among others:

• Creating and administering your account and onboarding you as a user.
• Verifying your identity for KYC and underwriting purposes, including on behalf of our Lending Partners and other Group entities.
• Delivering the Services you have requested, and communicating with you if a requested Service becomes unavailable.
• Carrying out internal risk assessment, creditworthiness evaluation, fraud, anti-money-laundering and name-screening checks, consistent with our Board-approved Fraud Risk Management and KYC/AML/CFT Policy.
• Meeting record-keeping, regulatory and law-enforcement obligations.
• Contacting the third-party references you voluntarily provide at the time of a loan application, where we are unable to reach you (including for instalment collection).
• Conducting market research, tracking engagement and building a profile to understand your preferences and personalise your experience, including features made available through device access you have granted.
• Personalising communications, offers and marketing (where you have consented), and informing you of changes to our terms and policies.
• Responding to your requests, feedback and queries.
• Assessing your eligibility for Services in which you have shown interest.
• Data analytics, audits and usage-trend analysis to evaluate and improve our Services and campaigns.
• Security, business continuity and risk management, and system or product planning and development.
• Performing our contractual obligations to you.
• Offering loyalty programmes and other benefits, and maintaining our relationship with customers, Lending Partners and Partners.
• Meeting our obligations as a Lending Service Provider or Digital Lending App operator.
• Recovering amounts owed to MCL, a Lending Partner or a Partner.
• Investigating breaches of our terms of use or defending legal claims, and disclosing information where required by law, court order or a competent authority.
• Pursuing MCL’s legitimate interests, or those of a third party, including generating aggregated or de-identified insights (directly or through Partners and Group entities) to understand broader usage trends.
• Enabling Group entities and Partners to offer, and communicate with you about, their own products and services.

9. Disclosure and Sharing of Your Personal Data

• We may share your personal data with Lending Partners, other Group entities and Affiliates, vendors, service providers, data processors, banks and financial institutions, credit bureaus, the Central KYC Registry, law-enforcement and investigating authorities, telecom operators and statutory bodies — for purposes such as customer verification, service personalisation, credit rating, and marketing of MCL’s or its Lending Partners’ Services.
• With your consent, we may share your data as a financial information provider through a licensed account aggregator or consent manager, in accordance with Applicable Law.
• We may share data you submit, data arising from your relationship with us, and any derived insights, with duly appointed Partners, service providers and Group entities in the ordinary course of business, including for fee collection, enrolment in additional services, and credit analysis.
• Any third party that receives your personal data from us is contractually required to use it strictly for the purpose for which it was shared, and to apply appropriate technical, organisational and confidentiality safeguards.
• We may disclose your personal data to statutory or regulatory authorities where required by Applicable Law or legal process, or for risk-mitigation purposes — but never sell your personal data or disclose it for unrelated commercial purposes.
• Other Group entities, Lending Partners and Partners may follow privacy practices that differ from ours; where you interact with their platforms directly, their own privacy notices will apply.
• Your KYC data may be disclosed to regulators as part of our statutory audit process. Where your Aadhaar number has been collected as described in Section 4.4, it will be disclosed only as permitted under Applicable Law.
• If MCL is involved in a merger, acquisition, restructuring or sale of business (in whole or in part), your personal data may be transferred to the relevant third party or statutory authority as part of that transaction.
• Where we run co-branded campaigns or promotions with third parties, your data may also be collected and used by those third parties; we recommend reviewing their privacy policies.
• If you choose to use a Service offered by a Lending Partner or Partner, we will share your personal data with them, and they are required to protect it in line with this Policy and Applicable Law.
• By accepting this Policy, you consent to the sharing of your personal data as described in this Section. You may decline to provide certain data, or withdraw consent, but such withdrawal will not apply to an active Service already availed, and MCL cannot guarantee continued provision of that Service once consent is withdrawn.

10. How Long We Retain Your Personal Data

• We do not retain personal data for longer than is permitted under Applicable Law.
• We may retain data for a longer period where necessary for legal, regulatory, accounting or dispute-resolution purposes, including responding to regulator, customer or governmental queries and defending legal claims.
• Retention periods vary depending on the type of data, its sensitivity, the purpose of processing, and applicable legal requirements — different categories of data may therefore be retained for different lengths of time.
• In some cases, we may anonymise your personal data so that it can no longer be linked to you, and continue to use it in that anonymised form.
• On receiving a written deletion request at the email address in Section 20, we will take all steps legally required of us to delete your personal data. Please note that where you have previously consented to sharing your data with third parties, we cannot guarantee or enforce deletion by those third parties, and are not responsible for their retention practices.

11. How We Safeguard Your Personal Data

• Third parties we engage are contractually required to process your personal data only on our instructions and as necessary to perform their services, in compliance with Applicable Law.
• We require such third parties to implement appropriate technical, organisational and confidentiality safeguards. While we cannot personally verify every third party’s compliance, we take reasonable steps within the limits of Applicable Law to hold them accountable.
• We apply procedural and technical safeguards designed to protect your personal data from unauthorised access, use, alteration or destruction.
• Access to your personal data is restricted to Representatives, agents, contractors and other third parties on a need-to-know basis, and they act under our instructions and a duty of confidentiality.
• We protect your personal data with the same standard of care we apply to our own confidential information, and in line with Applicable Law.
• We maintain technical, organisational and industry-appropriate measures, including data-breach response measures. If you suspect misuse, loss or unauthorised access to your personal data, please contact us immediately using the details in Section 20.

12. Your Rights and How to Exercise Them

• You may request reasonable access to, and review of, your personal data, and request correction or deletion where appropriate. We will take reasonable steps to verify your identity before granting access.
• You may unsubscribe from marketing emails at any time using the unsubscribe link included in each email.
• You may request access to, correction of, completion of or erasure of your personal data through the Platform, and you may seek: (i) a summary of the personal data we process about you and the related processing activities; (ii) the identities of entities with whom we have shared it, along with a description of the data shared; and (iii) any other information prescribed under Applicable Law.
• You may decline to provide personal data, or withdraw a previously given consent, at any time, though this may affect the Services available to you. Withdrawal of consent relating to data shared with a Partner or Lending Partner will additionally be governed by that entity’s own privacy policy.
• You may opt out of the collection or use of your personal data — including through Cookies and similar technologies — for marketing or other purposes.
• You may request that your personal data be corrected, restricted, ported, or deleted or anonymised, or object to its processing. Where we are unable to action such a request (for regulatory or other reasons), we will provide you with a reasoned response.
• You may nominate another individual to exercise your rights under Applicable Law in the event of your death or incapacity, by contacting us using the details in Section 20.
• If you have a concern or grievance, you may contact our Grievance Redressal Officer, whose details appear in Section 20.
• You also have the right to approach the relevant regulatory authority in connection with the protection of your personal data; details will be published once notified by the Government.

13. Marketing Communications and Offers

We may let you know about new Services and occasional offers from our Partners, but only with your prior consent. You can opt out at any time by emailing us at the address in Section 20 — though doing so means we will not be able to keep you informed of new products, events or offers that might otherwise interest you.

14. Availing Lending Partner and Partner Services on Our Platform

• The Platform offers eligible Users payment options in the form of loans, provided by MCL directly or by a Lending Partner, in accordance with Applicable Law. Where you choose such an option, you transact with us or the relevant Lending Partner, with MCL acting as a Regulated Entity, Digital Lending App or Lending Service Provider, as applicable.
• Before extending a loan, we or our Lending Partner may run a credit-approval check and build your economic profile, and reserve the right to decline the facility at our sole discretion, with or without stating a reason.
• Where a loan is availed from a Lending Partner, MCL’s role is limited to that of a Digital Lending App or Lending Service Provider; MCL has no further role in that lending relationship.
• Availing a loan through MCL requires you to follow MCL’s (or the relevant Lending Partner’s) instructions, including maintaining a valid PAN and bank account.
• Using our Services requires you to accept the applicable terms and conditions.
• The commercial terms of any credit facility (tenure, interest, repayment schedule, etc.) will be communicated to you separately at the time you avail that facility.
• MCL and its Affiliates are not liable for losses arising from credit facilities extended by Lending Partners, including losses arising from fraud committed by a Lending Partner.

15. Your Representations to Us

By using the Platform, you confirm that you are at least 18 years of age and have the legal capacity to enter into a contract and share your personal data with us.

16. Changes to This Policy

• We may update this Policy from time to time and will publish the current version on the Platform. We may also send periodic reminders by email unless you have asked us not to.
• An updated Policy takes effect as soon as it is published, and continued use of the Platform after that date constitutes acceptance of the update.
• We encourage you to review this Policy periodically to stay informed about how we handle your personal data.

17. Prohibited Uses of the Platform

While using the Platform, you agree that you will not:

• Restrict or interfere with any other authorised user’s access to the Platform.
• Use the Platform for an unlawful purpose.
• Harvest or collect information about other users without their consent.
• Frame or mirror any part of the Platform without our prior written authorisation.
• Engage in spamming or flooding of the Platform.
• Transmit viruses, malware or other harmful code.
• Remove any copyright, trademark or other proprietary notice from the Platform.
• Use any automated tool to scrape, data-mine or circumvent the Platform’s structure or presentation.
• Allow anyone else to access the Platform using your credentials.
• Infringe or misappropriate any intellectual-property or other proprietary right.

18. Governing Law and Jurisdiction

This Policy is governed by the laws of India. The courts at Delhi shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

19. Severability

If any provision of this Policy is found by a court or competent authority to be invalid, illegal or unenforceable, that provision will be treated as deleted to the minimum extent necessary, and the remaining provisions will continue in full force and effect.

20. Grievance Redressal and Contact Information

If you have any questions about this Policy, or believe your personal data has not been handled in accordance with Applicable Law or this Policy, please contact us: