Privacy Policy

Oxon Credit Private Limited (CIN U64990HR2026PTC146902), with its registered office at 10th Floor, 1037, Tower-B3, Spaze I Tech Park, Sohna Road, Sector 49, Gurugram, Haryana 122018, is the data fiduciary for the personal data collected on the Platform. Your information is collected and stored on servers located in India. Our lending partners (banks and NBFCs) are separately responsible for the data they receive from us to process your application, under their own privacy policies.

The information we learn from you helps us match you with suitable loan offers and improve the Platform. Depending on how you use it, we collect:

• Identity and contact details — name, mobile number (verified by OTP), email address, date of birth, gender, PAN, and your address or pincode.
• Business details — business or practice name, type and nature of business, company type, GST status and GSTIN, annual turnover or income, the date you started the business, and its premises and location.
• Financial information — bank statements and account data you choose to share through an Account Aggregator, and documents you upload (such as KYC or GST documents).
• Application and communication records — your application status, notes of calls and messages with our team, and any enquiry you send through our contact form (name, business name, mobile number, email, loan amount and message).
• Device and usage data — IP address, browser and device details and the pages you visit, used to keep the Platform secure and working (see “Log Files” below).

You can choose not to give us certain information, but then we may not be able to offer you some of our services. We do not collect your biometric information. The Platform does not access your camera, microphone, contacts or precise location; if a future step ever needs one of these, for example for a KYC check, we will ask for your explicit consent at that time.

Cookies and similar browser storage are small pieces of data stored on your device. We use only what the Platform needs: to keep you signed in after you verify your mobile number, and to remember simple choices. Our forms may also use a bot-protection service, which can set its own cookies or read browser signals to tell people from automated programs.

We use Google Analytics to count visits and see which pages are used and where visitors come from, so that we can improve the Platform. It sets its own cookies (named "_ga") and records information such as the pages viewed, the device and browser type and the approximate location from your connection. It does not receive what you type into our forms, and we have turned off its advertising features, so this information is not used for advertising. You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout.

We do not use advertising cookies, and we do not sell your personal data. You can block or clear cookies in your browser settings, but parts of the Platform, such as signing in, may then stop working.

• To verify your mobile number, and to create and secure your account.
• To assess your profile and match you with suitable loan offers from our lending partners.
• To share your application with the lending partner(s) you choose to proceed with.
• To contact you by call, SMS, WhatsApp or email about your application or enquiry, with your consent.
• To answer your questions, provide support and handle complaints.
• To detect and prevent fraud, abuse and security incidents.
• To meet legal, regulatory and audit requirements.
• To understand how the Platform is used, using aggregated data, so that we can improve it.

We share your personal information only as needed, and we do not sell it. We may share it with:

• Lending partners — the banks and NBFCs you choose to apply to, for evaluating and processing your application. They may obtain your credit information from credit information companies under their own consent process.
• Account Aggregator ecosystem — the Account Aggregator and the institutions holding your accounts, only to the extent of the consent you give on the Account Aggregator's own page.
• Service providers — companies that help us run the Platform, such as cloud hosting, maps (Google Maps on our contact details), SMS and email delivery and bot protection, under contracts that limit their use of your data.
• AI language service — when our chat assistant cannot understand an answer to a simple question (such as your business type or income), that answer may be sent to OpenAI, a service provider in the United States, only to read it. Email addresses, PAN, GST numbers and long numbers are removed first, and your name, mobile number, date of birth and PAN answers are never sent.
• Advisers and auditors who are bound by confidentiality.
• Government or regulatory authorities where required by law or to protect our legal rights.

If our business is ever merged with or transferred to another company, your information may move with it, and the new owner must continue to protect it as described here.

Your data is stored on secure cloud servers located in India. Databases and uploaded documents are kept in private, encrypted storage that is not open to the public. We keep your data for as long as your account or application is active and as needed for the purposes above, and afterwards only for the period the law requires us to keep records (for example KYC and financial record-keeping rules). After that it is deleted or anonymised.

You are in control of your information. Under the Digital Personal Data Protection Act, 2023 you may:

• ask what personal data we hold about you and how it is used;
• ask us to correct, complete or update it (you can also update many details from your account);
• ask us to erase data we no longer need;
• nominate another person to exercise these rights if you die or become unable to;
• raise a grievance with us about how your data is handled (see sections 13 and 14).

You can stop marketing messages at any time by replying to the message or writing to wecare@oxonfintech.com. Service messages about an application you have made may still be sent. To exercise any of these rights, write to wecare@oxonfintech.com.

You may withdraw a consent you have given, or ask us to delete your data, at any time by writing to wecare@oxonfintech.com from the email address or mobile number registered with us. We will acknowledge your request within 2 working days and complete it within 30 days.

• Withdrawing consent does not affect processing that happened before you withdrew it, and it may mean we can no longer continue with your application.
• We will delete or anonymise your data unless the law requires us to keep it, for example KYC and financial records for the prescribed period.
• Data already shared with a lending partner is held by that lender under its own policy; please contact the lender about it.
• An Account Aggregator consent can be revoked at any time through the Account Aggregator itself.

Like most websites, our servers automatically record technical information when you use the Platform, such as your IP address, browser type and version, device type, the pages you request, date and time, and any error that occurs. We use it to keep the Platform secure, find and fix problems and detect abuse. We do not use it to identify you personally, except where needed for security or by law.

We take reasonable steps to protect your information, including:

• encrypted (HTTPS) connections between your device and the Platform;
• OTP-based sign-in to your mobile number, with limits on repeated attempts;
• access limited to staff who need it for their work, with records of who accessed what;
• private, encrypted storage for databases and uploaded documents;
• monitoring of the Platform for unusual activity.

No system is completely secure, so please keep your OTP private and never share it with anyone. If you suspect misuse of your account, tell us straight away. If a personal data breach affects you, we will inform you and the authorities as the law requires.

We do not show third-party advertisements on the Platform. The Platform may link to other websites, such as a lending partner's page, an Account Aggregator or a regulator's site. Those sites have their own privacy policies, and we are not responsible for how they handle your information, so please read their policies before sharing anything with them.

We may update this policy from time to time, for example when our services or the law change. The date at the top shows the latest version, and we will give notice on the Platform or by email if a change is significant. Your continued use of the Platform after a change means you accept the updated policy.

For a complaint about our services or your application, write to our Nodal Grievance Officer. We acknowledge complaints within 2 working days and aim to resolve them within 15 working days, and in any case within 30 days. The full process is in our Grievance Redressal Mechanism.

• Designation: Nodal Grievance Officer
• Email: wecare@oxonfintech.com
• Address: Oxon Credit Private Limited, 10th Floor, 1037, Tower-B3, Spaze I Tech Park, Sohna Road, Sector 49, Gurugram, Haryana 122018
• Hours: Monday to Saturday, 10 am – 7 pm IST

For a concern about how we handle your personal data, or to exercise your rights under the Digital Personal Data Protection Act, 2023, write to our Data Grievance Officer. If you are not satisfied with our response, you may complain to the Data Protection Board of India as provided under that Act.

• Designation: Data Grievance Officer
• Email: wecare@oxonfintech.com
• Address: Oxon Credit Private Limited, 10th Floor, 1037, Tower-B3, Spaze I Tech Park, Sohna Road, Sector 49, Gurugram, Haryana 122018
• Hours: Monday to Saturday, 10 am – 7 pm IST