SeclineLoan Privacy Policy

1. Who We Are and Why This Policy Matters

SeclineLoan ("the Platform," "we," "us") is a revolving credit service platform operated by Secline Cyber Solutions Private Limited. This Policy explains how we collect, use, store, share, and protect your personal data in the course of your application for, receipt of, and use of the SeclineLoan revolving credit line.

The revolving credit model of SeclineLoan means that, within the approved limit, you may draw and repay funds on a revolving basis. This model has a continuous data-use characteristic—credit limit assessment, re-verification at each drawdown, and limit monitoring during the life of the account all require your information to be processed under logic different from that of a single loan. This Policy provides specific explanations on this point.

This Policy is prepared in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and its 2025 implementing rules (DPDP Rules), as well as the Reserve Bank of India's Digital Lending Directions, 2025 (RBI Digital Lending Directions, 2025). The DPDP framework is centered on the core principles of consent and transparency, purpose limitation, data minimization, storage limitation, and security safeguards. The RBI Directions require that data collection in digital lending be "need-based, subject to prior explicit consent, and auditable." SeclineLoan uses the above standards as its design and operational baseline.

2. What Data We Collect and Why We Collect It

We collect only the data necessary to provide revolving credit services. The following explains this by data type and revolving credit scenario.

2.1 Identity and Eligibility Data

This includes name, date of birth, gender, marital status, number of dependents, residential address, government-issued identity identifiers (such as PAN and authorized verification information under Aadhaar), and any other information required to complete KYC.

In revolving credit, identity verification is not a one-time event. When you first activate the limit, at each subsequent drawdown, and upon limit renewal or adjustment, we may need to reconfirm the validity and consistency of your identity. This is both a requirement of prudent credit management and consistent with anti-fraud and account security needs.

2.2 Income, Employment, and Repayment Capacity Data

This includes employment status, occupation category, employer information, length of employment, monthly income, daily expenses, existing debt obligations, and other financial information you voluntarily provide.

Credit limit assessment for revolving credit differs from that for a single loan: it depends not only on your current solvency but also on whether, during the revolving use of the limit, your financial status continues to support the dynamic balance between the used limit and the available limit. Therefore, we may update and confirm the above information at reasonable intervals during the life of the limit, but we will not continuously scrape it without limitation.

2.3 Transaction and Behavioral Data Directly Related to the Revolving Credit Account

This is the core part that distinguishes a revolving credit privacy policy from an ordinary loan policy. We process the following data directly related to your SeclineLoan account:

• Limit usage: used limit, available limit, drawdown frequency, amount and term of each drawdown;
• Repayment behavior: repayment time, repayment amount, whether repayment is on time, and records of partial or full repayment;
• Limit revolving pattern: the usage trajectory formed by repeated drawdowns and repayments within the approved credit limit;
• Delinquency status (if any): days past due, overdue amount, and subsequent handling status.

The above data is used to: dynamically assess whether your credit condition matches the current limit, determine whether the limit needs to be adjusted (increased, decreased, or suspended), identify abnormal usage patterns, and fulfill credit reporting obligations.

2.4 Device Permission Data—Strictly Limited to the Scope Permitted by the RBI

Under the RBI Digital Lending Directions, 2025, digital lending applications must not access contacts, call logs, or files and media on the device. One-time, limited camera, approximate location, or SMS access is permitted only in specific scenarios such as KYC, onboarding, and transaction verification, and only after your explicit, separate consent. SeclineLoan strictly complies with this boundary:

• Camera: Used only in the KYC process to capture identity documents and facial images for identity verification and anti-impersonation purposes. It is not invoked in the background and is not used for other purposes.
• Approximate location: Used to confirm whether your area falls within SeclineLoan's service scope. SeclineLoan does not continuously track location, does not use location for credit decisions themselves, and does not conduct behavioral profiling based on location.
• SMS: Only when you actively initiate KYC, card binding, repayment, or other steps requiring OTP verification, and after your separate, explicit authorization, it is used to automatically read and fill in the verification code for that transaction. SeclineLoan does not read, upload, or store SMS content unrelated to the current verification, does not access SMS history, and does not use SMS for marketing, collection, credit decisions, or behavioral profiling. SeclineLoan prioritizes system-provided OTP auto-read mechanisms (such as SMS Retriever) to avoid requesting general SMS read permissions.
• Device identifiers and basic technical information: Limited technical identifiers used for account security, prevention of multi-account abuse, and fraud detection, and not involving communication content or communication relationships.

We do not collect: contacts, call logs, SMS content or SMS history unrelated to the current OTP verification, photos/media files, lists of other applications installed, or any data category explicitly prohibited by the RBI.

3. Data Processing Logic in the Revolving Credit Scenario

3.1 Credit Limit Grant: Comprehensive Judgment Based on Multi-Source Information, Not a Single Data Source

Whether to grant a limit and how much to grant is the result of a comprehensive assessment based on your identity information, financial information, account behavior, and (within the scope permitted by law and authorization) credit information. The RBI Directions require lenders to assess age, occupation, and income before approval. SeclineLoan will not make a credit decision based on any single data source alone.

3.2 Monitoring and Adjustment During the Life of the Limit

The characteristics of revolving credit determine that a limit is not fixed once granted. During the life of your limit, we may review or adjust the limit based on the following triggers:

• Significant changes in your repayment behavior;
• Major changes in your financial information that you proactively inform us of or that may be learned with authorization;
• Information requiring attention arising from regulatory requirements or credit reports;
• Necessary to prevent fraud or account abuse.

Any limit adjustment shall follow the procedures set out in the Platform's Terms of Service and be subject to relevant consumer protection norms.

3.3 Necessary Verification at Each Drawdown

When making a drawdown within the revolving limit, we may conduct limited identity consistency confirmation, available limit checks, and risk screening. The purpose of these verifications is to strike a balance between convenience and security: the convenience of revolving credit should not come at the expense of account security.

3.4 Purpose Limitation

All the above data processing is limited to the following purposes: credit assessment and limit management; account security and fraud prevention; service delivery and customer support; and compliance with Indian legal and regulatory obligations. We will not use your data for advertising or marketing purposes unrelated to the revolving credit service unless you separately provide independent, separable consent.

4. Data Sharing: Controlled and Transparent

SeclineLoan does not sell, rent, or trade your personal data.

4.1 With Lending Partners/Regulated Entities

Where applicable, your information may be shared with RBI-regulated banks for limit approval, disbursement, account management, and regulatory compliance. Such sharing is limited to the necessary scope, and recipients must assume data protection obligations no lower than the standards in this Policy.

4.2 With Service Providers

We may engage service providers for identity verification, cloud infrastructure, fraud detection, and customer support. They may process data only to the extent necessary to provide services to us and must not use it for their own purposes. The RBI Directions require lenders to be responsible for their service providers' data processing, and SeclineLoan accordingly imposes contractual constraints and conducts ongoing supervision.

4.3 Regulatory and Legal Disclosure

We may disclose information where required by applicable law, regulatory requirements, judicial proceedings, or lawful requests from government authorities. Before disclosure, we will, to the extent permitted by law, assess the legality and scope of the request and minimize the disclosed content as much as possible.

5. Data Localization and Cross-Border Transfer

The RBI Directions require that borrowers' personal data, transaction records, and credit assessment files be stored on servers located in India. SeclineLoan's primary data processing and storage facilities are located in India. If any cross-border processing occurs (for example, using cloud services located outside India for backup or technical support), we will ensure that such processing meets the applicable conditions under the DPDP framework and that relevant data is promptly deleted or repatriated in accordance with RBI requirements after overseas processing is completed. If SeclineLoan is designated as a "Significant Data Fiduciary," we will comply with any additional localization restrictions that may be specified by the government.

6. Data Retention and Deletion

We retain your personal data only for the period necessary to achieve the purposes of collection and in compliance with applicable legal requirements for retention of credit records.

Specifically:

• Data related to the active period of the revolving credit account is retained during the life of the account and after account closure for the period necessary to fulfill legal, regulatory, and dispute resolution obligations;
• As required by the DPDP Rules, logs and related records are retained for at least one year after the relevant purpose is completed, for traceability and security auditing;
• Data beyond the necessary retention period will be securely deleted or irreversibly anonymized.

When you exercise your right to deletion, we will execute it within the scope permitted by law, except for data that must be retained to comply with RBI or other statutory retention obligations. We will explain any such exceptions to you in our response.

7. Your Rights and Choices

Under the DPDP Act and DPDP Rules, you have the following rights:

• Right of access: to know what personal data we hold about you and how it is processed;
• Right to correction: to request updating of inaccurate or incomplete personal data;
• Right to deletion: to request deletion of your personal data to the extent that statutory retention obligations do not constitute an obstacle;
• Right to withdraw consent: for processing based on consent, you may withdraw consent at any time, and withdrawal shall be no less convenient than giving consent;
• Right to nominate: to designate another person to exercise the above rights on your behalf.

We will respond within 90 days after receiving your request.

You can manage SeclineLoan's camera and location permissions through your device settings. Please note that withdrawing or restricting certain permissions may affect the availability of the revolving credit service or the convenience of drawdown functions.

To exercise the above rights, please contact us through the contact details provided in Section 10.

8. Data Security

SeclineLoan adopts technical and organizational measures proportionate to the nature and risk of the data processed, including encryption, access controls, identity authentication mechanisms, and internal data protection procedures.

In the event of a personal data breach, we will, in accordance with the requirements of the DPDP Rules, promptly notify affected individuals in clear and easy-to-understand language, explaining the nature of the breach, possible consequences, measures taken, and contact details for obtaining assistance.

9. Minors

SeclineLoan's revolving credit services are intended only for adults with full civil capacity as prescribed by Indian law. We do not intentionally collect or process personal data of minors. If we discover that such data has been collected, we will take reasonable measures to delete it.

10. Updates to This Policy and Contact Us

We may update this Policy due to service changes, regulatory developments, or improvements in privacy practices. The updated version will be published in the SeclineLoan app or on the official website. Material changes will be highlighted prominently.

If you have any questions, requests, or complaints regarding this Policy, please contact:

Secline Cyber Solutions Private Limited
Privacy and Grievance Officer: [email protected]