We, at Quick Money, understand privacy and its value. “Quick Money” is the brand owned and operated by Qicky Globaltech Private Limited (the “Company”, “we”, “us” or “our”), a company incorporated under the Companies Act, 2013, having CIN U66190MH2025PTC464463 and registered office at A/702, Akshita Avenue, Holy Cross Road, Borivali West, IC Colony, Mumbai City, Mumbai, Maharashtra, India – 400103. This Privacy Policy explains why we collect information from you (“You”, “Customer” or “User”), the user of the website https://www.quick.money (the “Website”) and the associated mobile application “Quick Money” (the “Application” or “App”) (collectively, the “Platform”), how we collect, use, store, share, retain and delete information about you, and the rights available to you (“Privacy Policy”).

The Company acts as a Loan Service Provider (“LSP”) for its RBI-regulated NBFC Lending Partner, Ruloans Financial Private Limited (CIN U65999MH2018PTC309853, RBI CoR No. N-13.02385) (the “Lending Partner”), and also offers certain non-lending/value-added services. In respect of personal data collected, used or shared for the purpose of facilitating a loan — including for KYC, credit assessment, underwriting, disbursal, servicing, collection and recovery — the Company acts solely as a Data Processor, processing such data on the documented instructions of the Lending Partner, who is the Data Fiduciary for that data under the Digital Personal Data Protection Act, 2023. In respect of personal data collected or used for the Company’s own non-lending/value-added services, Platform administration, security and marketing communications, the Company acts as the Data Fiduciary.

This Privacy Policy has been prepared in compliance with:

• the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made thereunder, as and when brought into force;
• the Information Technology Act, 2000 (“IT Act”) and the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), to the extent applicable;
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• the Reserve Bank of India (“RBI”) Guidelines on Digital Lending dated 2 September 2022, as amended, and the RBI Master Directions applicable to digital lending (“RBI Digital Lending Guidelines”);
• the RBI Master Direction — Know Your Customer (KYC) Direction, 2016, as amended (“RBI KYC Directions”), the Prevention of Money Laundering Act, 2002 (“PMLA”) and rules thereunder, the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and UIDAI regulations (where applicable), the Central KYC Registry (“CKYC”) regulations, the Credit Information Companies (Regulation) Act, 2005, and the RBI’s Account Aggregator framework (Master Direction — NBFC-Account Aggregator, 2016); and
• other applicable Indian laws, regulations and guidelines that require the publication of a privacy policy for handling personal information, including sensitive personal data or information.

3.1 Nature of your consent. Your consent under this Privacy Policy is free, informed, specific, unconditional and unambiguous, given by a clear affirmative action, and signifies agreement to the processing of your personal data only for the specified purposes notified to you. Consent is collected in a granular manner — separately for each distinct purpose and data category — and is revocable at any time (see Clause 12).

3.2 By clicking “I Agree” (or a similar affirmative action) on the Platform, you consent to the collection, use, storage, processing and disclosure of your information as described in this Privacy Policy, to facilitate lending services through our Lending Partners and non-lending/value-added services (“Services”).

3.3 Purpose limitation and data minimisation. We collect only such data as is necessary for the stated purpose (need-based collection), process it lawfully and fairly, and do not use it for any purpose incompatible with the purposes notified to you. In line with the RBI Digital Lending Guidelines, data collection by the Platform is need-based, with your explicit prior consent, and has an auditable trail.

3.4 Notice. At or before the time of seeking consent, you will be provided a notice describing the personal data proposed to be collected, the purpose of processing, the manner in which you may exercise your rights (including withdrawal of consent and grievance redressal), and the manner of making a complaint to the Data Protection Board of India.

3.5 Granular, separate consents. Without limiting the above, the Platform obtains separate, specific and independently revocable consents for each of the following, none of which is a precondition for any purpose other than the one to which it relates:

• accessing your credit information from Credit Information Companies (“CICs”/credit bureaus);
• bank statement analysis for income and repayment-capacity assessment;
• fetching your financial information through the RBI Account Aggregator framework;
• reading financial transactional SMS (as described in Clause 5.3);
• KYC verification, including Aadhaar-based e-KYC/offline verification, Video-KYC and CKYC Registry search/upload;
• access to device information (Clause 5.4);
• one-time access to location (for KYC/onboarding and fraud prevention);
• one-time access to camera (for KYC, selfie/photograph and document capture);
• one-time access to microphone (only where Video-KYC or support calls require it);
• marketing and promotional communications, separately for each channel — WhatsApp, e-mail, SMS and push notifications; and
• any other purpose that is not necessary for the Service you have requested.

3.6 No forced bundling. We do not make the provision of a Service conditional on consent to processing that is not necessary for that Service. Declining an optional consent (for example, marketing) will not affect your access to the lending Services.

3.7 Contacts, call logs and media are not accessed. In compliance with the RBI Digital Lending Guidelines, the Quick Money App does not access your mobile phone contact list, call logs, telephony functions, or file and media storage. Any request for such access purportedly on behalf of Quick Money should be reported to our Grievance Officer.

3.8 IF YOU DO NOT AGREE TO THIS PRIVACY POLICY OR ANY PART OF IT, PLEASE DO NOT USE, ACCESS, DOWNLOAD OR INSTALL THE PLATFORM OR ANY PART THEREOF.

Part A — Digital Lending Services: information collected by the Platform for facilitation of loans disbursed by our RBI-registered NBFC Lending Partner, Ruloans Financial Private Limited, whose details are available on the Website, the App and in the Terms and Conditions.

Part B — Non-Lending Services: information collected by the Platform while registering a User or while providing value-added services (i.e., services other than facilitation of loans).

5.1 Information you give us

• Data provided by filling in forms on the App or the Website, or by corresponding with us (for example, by e-mail or chat);
• Registration data: your full name, address, gender, date of birth, e-mail address, phone number, username, password and other registration information;
• Identity and financial data: PAN, Aadhaar (where voluntarily provided in accordance with law), officially valid documents, employer name, monthly income/salary, bank account number, bank statements, credit information, GST information (including GSTN user id fetched through the official GSTIN API stack with your consent — we do not store GSTN passwords), and copies of identification documents, which are forwarded to our Lending Partners for onboarding and processing of your application;
• Data generated by your usage of the Platform, including loan application and transaction history; and
• Records of customer support interactions, including e-mails, chats and call recordings (support and Video-KYC calls may be recorded for quality, training, dispute-resolution and regulatory purposes, and you will be informed at the start of a recorded call).

Wherever possible, we indicate mandatory and optional fields. You always have the option not to provide information by choosing not to use a particular Service or feature.

Biometric data: we do not collect any biometric data from you for any of our services or operations. If any person claiming to represent Quick Money asks for such data, please refrain from providing it and report the matter to our Grievance Officer.

5.2 Social account information

The Platform may allow registration through social accounts (e.g., Google). We collect only the registered e-mail id and public profile information (such as name and e-mail) to verify you and pre-populate relevant fields. We do not collect or store your social account passwords.

5.3 SMS information (with separate consent)

We do not collect, read or store personal SMS from your inbox. With your separate, explicit consent, we collect and monitor only financial transactional SMS sent by 6-digit alphanumeric senders (such as bank transaction alerts — the transacting parties, a description and the amount) for the purpose of credit-risk assessment, facilitating the lending Services as required by the Lending Partners, and providing you updates or confirmations of actions on the Platform. You may revoke this permission at any time in your device settings.

5.4 Device information (with separate consent)

When you install the App, we collect device information tied to unique identifiers, including device model, operating system and version, unique device identifiers, advertising identifiers (e.g., Google Advertising ID), IP address, log information (search queries, crash logs, dates and diagnostic data), and Platform performance data. We use this information to: provide automatic updates; provide additional security so that your account is not used on other people’s devices; detect and prevent fraud; identify and resolve technical issues; and improve the functionality of the App. Advertising identifiers are not used for behavioural advertising without your separate consent, and you may reset or disable them in your device settings.

5.5 Location, camera and microphone (one-time, purpose-limited access)

In accordance with the RBI Digital Lending Guidelines, the App requests only one-time access to your camera, microphone and location, and only where necessary for onboarding/KYC:

• Location — to verify your address and serviceability, for KYC/onboarding and fraud prevention;
• Camera — to capture your photograph/selfie and documents for identity verification required for loan processing, as instructed by our Lending Partners; and
• Microphone — to enable two-way communication with authorised agents for completing Video-KYC; the audio/video is recorded for regulatory purposes.

Such KYC information is transferred securely to the concerned Lending Partner and is not retained by us beyond what applicable law and our contracts require. You may deny or revoke these permissions in your device settings at any time; however, mandatory KYC steps may then not be completed.

5.6 Information we collect from third parties

• Credit information from CICs (credit bureaus) or credit-rating agencies, with your specific authorisation, acting as your authorised representative and/or on behalf of our Lending Partners, in accordance with the Credit Information Companies (Regulation) Act, 2005;
• Verification data from entities such as NSDL/Protean, UIDAI (where applicable), the CKYC Registry, and payment gateway providers, for document and identity verification;
• GST details from the official GSTIN API stack or other relevant government sources, using credentials or OTP provided by you; and
• Financial information through Account Aggregators licensed by RBI, strictly with your explicit consent recorded through the Account Aggregator’s consent artefact, which you may revoke through the Account Aggregator.

We collect such third-party information on a need basis, strictly for providing the Services; where collected as part of our outsourced obligations to Lending Partners, it is transferred directly to the Lending Partner and not retained by us.

5.7 Non-personal information, cookies and analytics

We automatically track certain non-personal information about your use of the Platform (browser type, pages visited, aggregate usage) for internal research into user demographics, interests and behaviour, compiled and analysed on an aggregated basis, to improve our Services.

Cookies: Cookies are small data files stored on your device. We use cookies (and similar technologies) to identify you, keep you signed in, remember preferences, measure and improve the Website, and for security and fraud prevention. Most browsers permit you to decline or delete cookies; if you do so, some parts of the Platform may not function fully. Non-essential cookies (including analytics and advertising cookies) are used only with your consent, which you may withdraw at any time.

Analytics and SDKs: The App integrates registered third-party SDKs and API integrations (for example, analytics, crash-reporting, payment and KYC SDKs) that collect data on our behalf. Each SDK’s access is limited to the permissions and purposes disclosed in this Privacy Policy. We contractually require SDK providers to implement security measures required under applicable law and not to use your data for their own purposes.

We use the information collected from you only for the following purposes:

• establishing and verifying your identity;
• facilitating your KYC as per the RBI KYC Directions and instructions of our Lending Partners;
• processing your loan application, assessing creditworthiness and repayment capacity, and facilitating sanction, disbursal, servicing, collection and recovery of loans by Lending Partners;
• providing non-lending/value-added services requested by you;
• troubleshooting problems and monitoring, improving and administering the Platform;
• designing and offering customised products and services (with your consent where required);
• analysing Platform usage, diagnosing service or technical problems and maintaining security;
• sending Service communications — notifications, information regarding products or services requested by you, and processing your queries and applications;
• fraud monitoring and prevention — detecting, investigating and protecting the Company, its Lending Partners and users against suspicious or illegal activity, fraud, money laundering and other criminal activity, and complying with the PMLA;
• marketing and promotional communications (SMS, e-mail, WhatsApp, push notifications) — only with your separate, explicit consent, which you may withdraw at any time;
• conducting data analysis to improve the Services;
• complying with applicable laws, regulations, and lawful requests of governmental, regulatory, judicial and quasi-judicial authorities;
• resolving disputes and enforcing our agreements; and
• customising your experience and enforcing our Terms and Conditions.

Automated decision-making and profiling: credit assessment may involve algorithmic/AI-based scoring models and automated profiling operated by us or our Lending Partners (for example, analysing bureau data, bank statements and transactional SMS to estimate repayment capacity). Final credit decisions rest with the concerned Lending Partner. You may contact our Grievance Officer to seek information about such processing, request human review of a decision that significantly affects you, or raise a grievance.

7.1 All personal data collected in connection with the lending Services is stored on servers located in India, in compliance with the RBI Digital Lending Guidelines and other statutory and regulatory obligations.

7.2 For lending Services, we store only such basic personal information (such as name, address, contact information) as is required for our role as LSP and for our non-lending services; other personal information collected as part of outsourced services for our Lending Partners is collected on their instructions and transferred to them upon completion of preliminary onboarding.

7.3 Cross-border transfers. We do not transfer personal data collected for lending Services outside India. If any personal data relating to non-lending Services is transferred outside India in future, such transfer will be made only as permitted under the DPDP Act and applicable RBI directions, and subject to contractual safeguards ensuring a standard of protection comparable to this Privacy Policy.

8.1 We share your information only as described below and on a need-to-know basis:

• with our Lending Partner, Ruloans Financial Private Limited (an RBI-registered NBFC), for facilitation of a loan, facility or line of credit, and with financial service providers for the purchase of a product requested by you;
• with CICs/credit bureaus, for making credit information reports and reporting loan performance, as required under the Credit Information Companies (Regulation) Act, 2005;
• with Account Aggregators, the CKYC Registry, UIDAI (where applicable) and other KYC infrastructure entities, in accordance with applicable law and with your consent where required;
• with service providers and data processors — including payment gateways, KYC/verification agencies, cloud hosting, analytics, communication and collection service providers — engaged under written contracts that bind them to confidentiality, purpose limitation, security safeguards and data-protection obligations consistent with this Privacy Policy and applicable law;
• with our technology partners to track, on our behalf, how users interact with the Platform, strictly for Platform improvement;
• with governmental, quasi-governmental, judicial, quasi-judicial and regulatory authorities (including RBI), where we are under a duty, request or order to disclose, or where disclosure is otherwise required or permitted by law — including disclosure of your KYC journey as part of statutory or regulatory audit. Your Aadhaar number shall never be disclosed except as mandated by law;
• in connection with a merger, acquisition, re-organisation, amalgamation or restructuring of our business — any receiving entity shall remain bound by this Privacy Policy in respect of your information; and
• to enforce our terms of use, or to protect the rights, property or safety of the Company, our users or others, including exchanging information with other companies and organisations for fraud protection and credit-risk reduction.

8.2 Every disclosure to third parties is subject to the following safeguards:

• where we are under a legal or regulatory duty to disclose, we shall not seek your consent but shall, where lawful, endeavour to notify you;
• in all other cases, we share your personal data with third parties only with your consent, only on a need basis, and only for the purposes stated in this Privacy Policy;
• third parties are bound by confidentiality agreements and are restricted from using your information for any other purpose; we do not permit unauthorised disclosure of your information; and
• usage of your information by third parties whose services you separately avail is governed by their own privacy policies, which we recommend you review.

8.3 No sale of data. We do not sell your personal data. We do not share your personal data with any third party for its own marketing purposes without your separate, explicit consent.

9.1 Retention by the Company. As LSP and Data Processor for loan-related data, the Company retains such data only for as long as necessary to complete the specific onboarding, KYC and loan-facilitation step for which it was collected, and transfers it to the Lending Partner in the course of that process. After the relevant step is complete, the Company retains only basic contact information (such as your name, phone number, e-mail address and address) and a record of your activity on the Platform, for the earlier of (a) 6 (six) months after you cease to be an active user of the Platform (for example, after your loan is fully repaid and your account is closed, or your application does not result in a loan), or (b) such longer period as the Company is independently required to retain under applicable law (including the IT Act and tax laws), after which such data is deleted or anonymised.

9.2 Retention by the Lending Partner. As the Data Fiduciary for loan-related data, the Lending Partner independently retains your KYC records, loan documents, transaction history and related financial data for a minimum of 5 (five) years after the relevant transaction is completed (or such longer period as required under the PMLA, the RBI KYC Directions, or other applicable law), in accordance with its own privacy policy and record-retention obligations. The Company does not control, and is not responsible for, the Lending Partner’s independent retention of such data.

9.3 Retention for non-lending Services. For non-lending/value-added services for which the Company is the Data Fiduciary, we retain your personal data only for as long as necessary to provide that service, and thereafter only as required to comply with our legal and regulatory obligations, resolve disputes and enforce our agreements.

9.4 On withdrawal of consent, or when the specified purpose is no longer being served, we will erase your personal data (and cause our processors to erase it), unless retention is required by law.

9.5 You may request deletion of your data and your login account at any time in the manner set out in Clause 12. After deletion, you may not be able to use the Services. Deletion may not be implemented for data relating to ongoing Services — including an active loan, insurance policy or similar product — until the Service is closed and applicable retention periods expire. The Lending Partner retains the independent right to keep records of loans availed by you as required by law.

10.1 We implement reasonable security practices and procedures and appropriate technical and organisational measures, commensurate with the nature of the data and our processing, to protect your information against unauthorised access, use, alteration, disclosure or destruction, including:

• Encryption in transit and at rest — transmission of information over the internet is encrypted (TLS/SSL), and stored personal data is protected using application-level and storage-level encryption with managed key-access controls;
• Access controls — access to personal information is restricted, on a documented, role-based, need-to-use basis, to employees, contractors and agents who need it to process it, all of whom are bound by strict contractual confidentiality obligations and are subject to discipline or termination for breach;
• Audit logging — access to and processing of personal data on our systems is logged and auditable, and consent records are maintained with an auditable trail;
• Vulnerability management — periodic reviews of our information collection, storage and processing practices (including physical security), vulnerability assessments and remediation, and industry-standard anti-virus, anti-malware, intrusion prevention/detection, file-integrity monitoring and application-control measures at our hosting environments;
• Fraud monitoring — transaction and account monitoring designed to detect and prevent fraudulent, unauthorised or illegal activity;
• account-level protections such as OTP verification; and
• environment separation and segregation of duties at our third-party service providers, which are contractually required to protect your information to the same standard.

10.2 Certifications. As of the date of this Privacy Policy, the Company does not hold any third-party information security certification (such as ISO/IEC 27001). This Privacy Policy will be updated to identify any such certification if and when it is obtained and verified.

10.3 Incident response and breach notification. We maintain an incident-response procedure for identifying, containing, assessing and remediating security incidents. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the form and manner prescribed under the DPDP Act and rules, and, where applicable, CERT-In and RBI, within the prescribed timelines. You may report suspected security incidents to our Grievance Officer.

10.4 While we follow the standards described above, no transmission over the internet can be guaranteed to be perfectly secure; we encourage you to protect your credentials and devices and to notify us immediately of any suspected compromise.

The Platform and the Services are intended only for persons who are 18 (eighteen) years of age or older and competent to contract. We do not knowingly collect or process the personal data of children (persons under 18 years of age). We do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If we become aware that personal data of a child has been collected without valid consent of a parent or lawful guardian as required under the DPDP Act, we will delete such data. If you believe a child has provided personal data to us, please contact the Grievance Officer.

Subject to applicable law (including the DPDP Act), you have the following rights in respect of your personal data:

• Right to access information — to obtain a summary of the personal data being processed, the processing activities, and the identities of Data Fiduciaries and Data Processors with whom it has been shared;
• Right to correction and updating — if any personal data provided by you is inaccurate, incomplete or outdated, you may have it corrected, completed or updated. We urge you to always provide accurate and current information; supporting documents may be required for verification;
• Right to erasure — to request deletion of personal data that is no longer necessary for the purpose for which it was processed, unless retention is required by law;
• Right to withdraw consent — you may withdraw any consent, in whole or for specific purposes or channels, at any time, with ease comparable to the manner in which it was given, by using the in-App consent controls, by adjusting your device permissions, or by writing to the Support E-mail Support@quick.money. Withdrawal is prospective and does not affect processing already carried out; the consequences of withdrawal (including possible inability to continue a Service) shall be borne by you. If you have availed a loan, the Lending Partner may continue processing your information until the credit facility is repaid in full and for such further period as permitted by law;
• Right of grievance redressal — to have your grievances redressed in the manner set out in Clause 14; and
• Right to nominate — to nominate, in the manner prescribed under the DPDP Act, another individual who may exercise your rights in the event of your death or incapacity.

Your privacy controls: you can modify or revoke device permissions (SMS, location, camera, microphone and others) in your Android/iOS settings; delete the App from your device; manage cookie preferences in your browser; opt out of marketing communications through your account preferences or by writing to the Support E-mail; and request removal of content from our servers. Exercising these controls may limit our ability to provide certain Services, and the Platform does not guarantee Services where controls necessary to a Service are revoked.

Duties of Data Principals: you shall not impersonate another person, suppress material information, or register a false or frivolous grievance or complaint, and shall furnish only such information as is verifiably authentic when exercising the right to correction or erasure.

We reserve the right to change, modify, add or remove portions of this Privacy Policy at any time. Changes will be posted on the Platform and, in the case of material changes, notified to you through the Platform or your registered contact details. Changes are effective when posted, unless stated otherwise. Where a change expands the purposes of processing of previously collected personal data, we will seek your fresh consent as required by law. Your continued access to or use of the Services after notice of changes constitutes your acceptance of the amended Privacy Policy.

14.1 If you have any grievance, question or concern regarding this Privacy Policy, the processing of your personal data, a request for access, correction, erasure or nomination, a consent withdrawal, or a suspected security incident, you may contact our Grievance Officer, designated in accordance with the IT Act and rules thereunder, the DPDP Act and the RBI Digital Lending Guidelines:

Grievance Officer / Data Protection Contact

Name: Durwang Sawant

Address: A/702, Akshita Avenue, Holy Cross Road, Borivali West, IC Colony, Mumbai City, Mumbai, Maharashtra, India – 400103

E-mail: durwang@quick.money

Contact: +91 9022491781

Hours: Monday – Saturday, 10:00 a.m. – 7:00 p.m.

14.2 We will acknowledge your grievance within 1 (one) working day and endeavour to resolve it within the timelines prescribed under applicable law (and in any event within 30 (thirty) days). When we receive formal written complaints, we respond by contacting the complainant, and we work with the appropriate regulatory authorities to resolve complaints that cannot be resolved directly.

14.3 If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India in the manner prescribed under the DPDP Act. For grievances relating to digital lending that remain unresolved for 30 (thirty) days, you may lodge a complaint under the Reserve Bank – Integrated Ombudsman Scheme, 2021 on the RBI Complaint Management System portal (https://cms.rbi.org.in).