Introduction

This Privacy Policy describes how Zavo Nexus Private Limited ("Zavo", "Bridge", "we", "us", "our"), the operator of the Bridge platform (website and mobile application, together the "Platform"), collects, uses, discloses, and protects personal data of users ("you") who access the Platform to discover and apply for financial products from Regulated Entities.

This Policy applies to the Platform-level data we collect from you at registration and while you browse and compare offers. Once you begin a KYC/loan application with a specific Regulated Entity such as Padmalaya, that Regulated Entity's own Privacy Policy separately governs the personal data it collects and processes as lender, in addition to this Policy.

This Policy is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 ("DPDPA"), and the Reserve Bank of India (Digital Lending) Directions, 2025 ("DLD 2025").

1. Registration and Communication Consent

When you register on the Platform, we collect your name, email address, mobile number, city, and the product you are interested in.

By registering, you consent to receiving transactional and service-related communications (such as OTPs, application status, and alerts) via SMS, email, WhatsApp, RCS, and calls from us and from the Regulated Entity to which your application is directed.

Promotional or marketing communications including offers from Zavo or from associate partners will be sent only where you have given separate, specific, opt-in consent for such communications, and such consent may be withdrawn at any time without affecting transactional communications. We do not send promotional communications to numbers registered on the DND/NDNC registry unless you have separately and explicitly opted in to receive commercial communications from a specific sender in accordance with TRAI's Telecom Commercial Communications Customer Preference Regulations, 2018.

You may stop transactional or promotional communications at any time by writing to info@bridgecapital.in with your registered mobile number, or through the preference settings within the Platform.

2. Information Sharing and Disclosure

We do not share your personal data with third parties except as necessary to provide the services you have requested, or with your permission. We do not sell or rent your personally identifiable information to anyone other than as specifically set out in this Policy.

• Regulated Entities: We share your application data with the Regulated Entity(ies) to which you choose to apply, including Padmalaya, solely for evaluation and processing of your application.
• Declined-application referrals: Where a Regulated Entity declines your application, we may, only with your separate and optional consent, share your data with our other lending/platform arrangements to evaluate alternate offers.
• Recovery agents: Where a Regulated Entity authorises Zavo or a third party to act as a recovery agent in respect of a loan, your data may be shared for that purpose; you will be notified of the identity of such agent on the website of the Regulated Entity.
• Corporate transactions: We may transfer your personal data to an affiliate or successor entity in connection with a merger, reorganisation, or sale of business.
• Legal and regulatory authorities: We may disclose personal data to law enforcement or regulators where required by law, court order, or valid legal process, or where necessary to protect against fraud or harm to any person.

3. Lawful Basis and Your Rights

We process your personal data on the basis of your consent, for compliance with legal obligations, or for other legitimate and reasonable purposes connected with providing the Platform. Where processing is based on consent, you have the right to withdraw it at any time.

You have the right to:

• Give or withhold consent for use of specific categories of data;
• Restrict disclosure of your personal data to third parties beyond what is necessary to provide the Service;
• Withdraw any previously granted consent;
• Obtain a summary of the personal data we hold about you and how it is processed;
• Request correction of inaccurate personal data; and
• Request erasure of personal data that is no longer necessary for the purpose it was collected, subject to any legal retention obligation.

If withdrawing consent means we can no longer provide you the Service, we will inform you of the consequences before processing your withdrawal request. Requests may be sent to info@bridgecapital.in and will be acknowledged within 48 hours and resolved within 30 days.

4. Security of Personal Data

We take reasonable physical, technical, and managerial safeguards to protect your personal data from unauthorised access, alteration, disclosure, or destruction, and require third-party service providers to maintain equivalent security standards under contract.

The App requests only need-based device permissions. We do not access your contact list, call logs, non-transactional SMS inbox, or telephony functions. Camera and file/storage and other access is requested only on a one-time, purpose-limited basis for document capture during KYC, and only after your specific consent on the relevant screen.

We do not collect, process, or store biometric information (fingerprints, facial recognition data, voice patterns, or iris data) through the Platform, and no biometric authentication is used in onboarding or loan-processing journeys.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security, though we take commercially reasonable measures including encryption in transit, TLS-secured API transmission, and access controls restricting internal visibility of your data.

5. Data Retention

We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law. Indicatively: application and registration data not resulting in a disbursed loan is retained for 24 months from the date of last activity, unless needed longer for fraud investigation or legal proceedings; data relating to a disbursed loan is retained by the concerned Regulated Entity in line with its own retention schedule; and consent records are retained for the duration of the relationship plus five (5) years for audit purposes.

6. Cookies and Website Analytics

The Platform uses cookies to support technical administration, research and development, and personalisation of content. We may also collect browser type, operating system, IP address, referring URL, and pages visited for analytics purposes. We do not knowingly collect personal information from children.

We may use third-party advertising companies to serve ads based on your visits to this and other websites; such companies do not receive your name, email address, or phone number for this purpose.

7. Disclosure to Legal Authorities

We may disclose personal data to government agencies, regulators, courts, or law enforcement where required under applicable law or a valid legal process. All such requests are reviewed for legitimacy, limited to the minimum information necessary, and overseen by our compliance team.

8. Grievance Redressal and Data Protection Contact

For any privacy-related query, complaint, or request to exercise your rights under Section 3, you may contact our designated Grievance Redressal Officer:

We will acknowledge your grievance within 48 hours and endeavour to resolve it within 30 days. Further details of our grievance mechanism are available on our Grievance Redressal page. If you remain dissatisfied, you may escalate to the RBI Complaint Management System at cms.rbi.org.in, or the RBI Sachet Portal at sachet.rbi.org.in, for complaints relating to unregulated or unauthorised financial activity.