Privacy Policy

🏢 For Tenants/Admins (Business Subscribers)

👥 For B2B Partners & B2C Users

• Name, email, phone number
• Business information and registration details
• KYC documents (PAN, Aadhaar)
• Service requests and documents submitted
• Communication history
• Transaction and payment history

📋 Lead Data (Customer Information Submitted by Tenants)

• Full name and contact details of lead subjects
• Employment and income information
• Loan requirements and financial needs
• KYC documents (PAN, Aadhaar, address proof)
• Bank statements and financial documents
• Property documents (for secured loans)
• Business documents (for business loans)
• Any other information required for loan processing

🌐 Automatically Collected Information

• IP address and geolocation data
• Browser type, version, and settings
• Device type, operating system, and unique identifiers
• Pages visited, time spent, and navigation patterns
• Referral URLs and exit pages
• Cookies and similar tracking technologies

📤 What Happens to Lead Data

• Collection: Lead data is collected through our CRM platform
• Storage: Data is stored on our secure servers
• Processing: Data is processed to match with appropriate lenders/partners
• Sharing: Data is shared with one or more banks, NBFCs, or partners for service fulfillment
• Multiple Sharing: A single lead may be shared with multiple partners to maximize approval chances

✅ Your Consent Obligations (For Tenants/Admins)

If you submit leads on behalf of your customers, you REPRESENT AND WARRANT that:

• You have obtained explicit consent from each individual whose data you submit
• You have informed them that their data will be shared with banks/NBFCs/partners
• You have the legal authority to submit their data on their behalf
• All information submitted is accurate and authentic
• You will indemnify us against any claims arising from unauthorized data submission

🏦 Third-Party Data Handling

Once data is shared with banks, NBFCs, or other partners:

• That data becomes subject to their respective privacy policies
• We have no control over how they use, store, or process the data
• They may contact the lead subject directly
• They may share data with their own partners as per their policies
• We are not responsible for their data handling practices

📞 Our Right to Contact Lead Subjects Directly

Vistarkriya, its authorised personnel, sub-processors, and technology partners may contact any lead subject, borrower, applicant, or customer whose data is submitted through the Platform ("Lead Subject") directly — via voice call, IVR, WhatsApp, RCS, SMS, email, or in-app notification — for processing, verification, fulfilment, quality, fraud-prevention, support, recovery, and transactional purposes connected with the lead or service requested.

(a) Data Fiduciary — Platform Data

VistarKriya Marketings Private Limited is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 for personal data collected directly from Tenants during registration, KYC verification, and account management. This data is collected solely for the purposes of identity verification, age and eligibility confirmation, regulatory compliance (including under the Income Tax Act, 1961, the Goods and Services Tax Acts, the Companies Act, 2013, and the Information Technology Act, 2000), fraud prevention, contractual performance, and legal protection.

This data is retained for as long as required by applicable law. The Platform's obligation to comply with statutory retention requirements under tax, corporate, and information technology laws shall override any erasure request to the extent permitted by Section 17(2) of the Digital Personal Data Protection Act, 2023.

(b) Data Processor — Tenant Customer Data

For personal data of Tenants' customers, borrowers, lead subjects, and end users submitted by Tenants through the Platform, the Tenant is the Data Fiduciary. VistarKriya Marketings Private Limited acts solely as a Data Processor, processing such data on the Tenant's behalf and in accordance with these Terms. All obligations towards the data principal — including obtaining valid consent, responding to access and erasure requests, and handling grievances — rest exclusively with the Tenant as Data Fiduciary. The Tenant shall indemnify VistarKriya Marketings Private Limited against any claim, penalty, or loss arising from the Tenant's failure to discharge its Data Fiduciary obligations. Except that, with respect to de-identified, aggregated, and Derived Data that the Platform independently creates and owns under Terms of Service §16, the Platform acts as a Data Fiduciary in its own right.

(c) Breach Notification

In the event of a personal data breach:

• For data where Vistarkriya is the Data Fiduciary: Vistarkriya shall notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act, 2023 and rules made thereunder.
• For data where the Tenant is the Data Fiduciary: Vistarkriya shall notify the Tenant without undue delay upon becoming aware of the breach. The Tenant, as Data Fiduciary, is solely responsible for notifying the Data Protection Board and affected Data Principals. Vistarkriya shall provide reasonable cooperation to the Tenant in investigating and remediating the breach.

⚖️ Governing Law & Jurisdiction

This Privacy Policy and any disputes arising out of or in connection with it shall be governed by and construed in accordance with the laws of India. Subject to the arbitration clause below, the courts of Dehradun, Uttarakhand shall have exclusive jurisdiction over any legal proceedings arising from this Policy.

🤝 Dispute Resolution & Arbitration

(a) Good-Faith Negotiation: Any dispute shall first be attempted to be resolved through good-faith negotiation for a period of thirty (30) days from written notice of the dispute.

(b) If unresolved, the dispute shall be referred to binding arbitration under the Arbitration and Conciliation Act, 1996 (as amended).

• (c) Number of Arbitrators: One (1), mutually appointed by the parties. If the parties cannot agree within fifteen (15) days, the appointment shall be made in accordance with the Arbitration and Conciliation Act, 1996.
• (d) Seat and Venue: Dehradun, Uttarakhand, India.
• (e) Language: English or Hindi.
• (f) Arbitration Fees: To be borne by the losing party unless otherwise determined by the arbitrator.
• (g) The arbitrator's decision shall be final and binding.

🌪️ Force Majeure

Vistarkriya shall not be liable for any failure or delay in performing its obligations where such failure or delay results from circumstances beyond our reasonable control, including but not limited to:

• Acts of God, natural disasters, earthquakes, floods, fire
• War, terrorism, riots, civil unrest
• Government actions, new regulations, or restrictions
• Pandemic, epidemic, or public health emergencies
• Power outages, internet disruptions, server failures
• Third-party API failures, bank system outages
• Strikes, labor disputes
• Any other events beyond our reasonable control

✂️ Severability

If any provision of this Policy is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if modification is not possible, shall be severed from this Policy. The remaining provisions shall continue in full force and effect and shall not be affected or impaired in any way.

📄 Entire Agreement

This Privacy Policy, together with our Terms of Service and Refund Policy, constitutes the entire agreement between you and VistarKriya Marketings Private Limited regarding data privacy and supersedes all prior agreements, representations, and understandings.