Digital Lending Policy

Bhawana Capital Private Limited (“the Company”) is a non-deposit-taking Non-Banking Financial Company – Base Layer registered with the Reserve Bank of India (“RBI”), extending loans through a fully digital process. This Policy is adopted by the Board in conformity with Chapter III (Paragraphs 6–30) of the Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025, read with the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Directions, 2025 (Key Fact Statement and penal charges). It applies to all digital lending operations of the Company and to every Loan Service Provider (“LSP”) and Digital Lending App (“DLA”) engaged by it, and is not specific to any partner, product or LSP.

A Key Fact Statement in the prescribed standardised format, including the Annual Percentage Rate and all charges, is provided to every prospective borrower before execution of the loan contract, with the prescribed validity period. No charge not disclosed in the KFS is charged at any stage without the borrower’s explicit consent.

Digitally executed documents — the KFS, the loan agreement with enclosures, and sanction communications — flow automatically to the borrower on their verified email / SMS upon execution.

The borrower has an explicit option to exit the loan during the cooling-off period disclosed in the KFS (not less than the prescribed minimum) by paying the principal and proportionate APR, without penalty; a disclosed one-time processing fee may be retained.

Creditworthiness is assessed on the basis of the borrower’s economic profile, captured and recorded in an auditable way, before any credit limit is sanctioned. There is no automatic increase in credit limit without the borrower’s explicit request and consent on record.

Collection of borrower data is need-based and with the borrower’s prior explicit consent, with an auditable trail. The DLA does not access mobile phone resources except one-time access where necessary, with consent.

The borrower is provided options to deny or revoke consent for use of specific data, restrict disclosure to third parties, and require deletion of data.

Borrower data is stored on servers located in India. Where any processing occurs outside India, the data is deleted from offshore servers within the prescribed time and brought back to India.

A comprehensive privacy policy, including details of third parties permitted to collect personal information through the DLA, is published on the Company’s website and on each DLA.

The Company and each LSP with a borrower interface designate nodal Grievance Redressal Officers to deal with complaints relating to digital lending, including complaints against the DLA. Their contact details are displayed on the Company’s website, on the DLA and in the KFS. Responsibility for resolution remains with the Company; complaints unresolved within 30 days may be escalated to the RBI in the manner set out in the Grievance Redressal Mechanism.

Any default loss guarantee arrangement is entered into only in accordance with Paragraphs 19–29 of Chapter III of the Credit Facilities Directions: with eligible providers, under a Board-approved framework and prior due diligence; in the permitted forms (cash deposit, lien-marked fixed deposit or bank guarantee); with the total DLG cover on any outstanding portfolio not exceeding five per cent of the amount disbursed out of that portfolio at any time; with recognition of individual loan assets as NPA and consequent provisioning remaining the Company’s responsibility; and with the prescribed invocation timelines, tenor and disclosure requirements.