INTRODUCTION TO PRIVACY POLICY

This policy applies to Penpay Technologies Private Limited, a company incorporated under theCompanies Act, 2013 and having its registered office at House No. 147, KH.No. 241/2, 3rd Floor,New Mangla Puri, Gadaipur, South West Delhi, New Delhi, Delhi, India, 110030. This privacypolicy (the "PRIVACY POLICY") applies to your use of the website of Penpay hostedat penpay.com, the Services (as defined under the Penpay “Terms of Use”).

The terms “WE”, “OUR” and “US” refer to Penpay and the terms “YOU”, “YOUR” and“USER” refer to you, as a user of Penpay. The term “PERSONAL INFORMATION” meansinformation that you provide to us which personally identifies you to be contacted or identified,such as your name, phone number, email address, and any other data that is tied to suchinformation. Our practices and procedures in relation to the collection and use of PersonalInformation have been set-out below in order to ensure safe usage of the Website for you

We have implemented reasonable security practices and procedures that are commensurate withthe information assets being protected and with the nature of our business. While we try our bestto provide security that is better than the industry standards, because of the inherent vulnerabilitiesof the internet, we cannot ensure or warrant complete security of all information that is beingtransmitted to us by you. By visiting this Website, you agree and acknowledge to be bound by thisPrivacy Policy and you hereby consent that we will collect, use, process and share your PersonalInformation in the manner set out herein below. If you do not agree with these terms, do not usethe Website.

This Privacy Policy is published and shall be construed in accordance with the provisions of Indianlaws and regulations including the Information Technology (Reasonable Security Practices andProcedures and Sensitive Personal Data or Information) Rules, 2011 under the InformationTechnology Act, 2000, the Aadhaar Act, 2016 and its Amendments, including the AadhaarRegulations; that require publishing of the privacy policy for collection, use, storage, transfer,Page | 2disclosure of Personal Information. Personal Information means and includes all information thatcan be linked to a specific individual and also includes Sensitive Personal Information (all PersonalInformation which requires heightened data protection measures due to its sensitive and personalnature), both, hereinafter referred to as “Personal Information”, excluding any information that isfreely available or accessible in public domain. Please note, our products/services are offered inIndia for Indian customers, and your Personal Information processing will be subject to Indianlaws. If you do not agree with this Privacy Policy, please do not use or access our Platform.

INFORMATION COLLECTION

If you create an account to take advantage of the full range of services offered on Penpay, we askfor and record Personal Information such as your name, email address and mobile number. Wemay collect and store your Sensitive Personal Data or Information (such as any financialinformation including inter alia credit card, debit card details, bank account and know yourcustomer ("KYC") documents as per RBI regulations and any other information as may beapplicable) that the User may opt to save in the User account created with Penpay. We use youremail address to send you updates, news, and newsletters and contact you on behalf of other Users(such other Users who send you friend requests, personal messages, or other social collaborationbased events). We use your mobile numbers to send you transaction alerts and SMS alerts basedon your preferences. If you do not wish to receive such SMSs from us, please notify usat penpay.com/support to stop receiving SMSs from us. Penpay assures that your PersonalInformation will not be made public or sold to any third party

Personal and Sensitive Personal Information collected, as applicable, includes, but are notlimited to:

• name, age, gender, photo, address, phone number, e-mail id, your contacts, nominee details
• KYC-related information such as PAN, income details, your business-related information,videos or other online/ offline verification documents as mandated by relevant regulatoryauthorities.
• Aadhaar information including Aadhaar number or Virtual ID for the purposes of e-KYCauthentication with the Unique Identification Authority of India (UIDAI). Note thatPage | 3submission of Aadhaar information is not mandatory and there are alternatives tosubmission of identity information (e.g., Voter ID, DL)
• OTP sent to you by your bank, NSDL or Penpay
• balance including broker ledger balance or margins, transaction history and value, bankaccount details, wallet balance, investment details and transactions, income range, expenserange, investment goals, service or transaction related communication, order details,service fulfilment details, part of your card details for smooth transaction using Penpay orany of the services
• your device details such as device identifier, internet bandwidth, mobile device model,browser plug-ins, and cookies or similar technologies that may identify your browser andplug-ins, and time spent, IP address and location
• your health and lifestyle-related information, including your physical activity, when you opt for health-tracking services

Information may be collected at various stages of your usage of the Penpay Platform such as:

• visiting Penpay Platform
• registering on Penpay Platform as an “user” or “merchant” or any other relationship that may be governed by terms and conditions listed on Penpay Platform
• transacting or attempting to transact on Penpay Platform
• accessing links, e-mails, chat conversations, feedbacks, notifications sent or owned by Penpay Platform and if you opt to participate in our occasional surveys
• otherwise dealing with any of the Penpay Entities/Subsidiaries
• while applying for career opportunities with PenPay.

PURPOSE AND USE OF INFORMATION

Penpay may process your Personal Information for the following purposes:

• creation of your account and verification of your identity and access privileges
• provide you access to the products and services being offered by us, merchants, registered investment advisors, research analysts, entities, subsidiaries, sellers, logistic partners, or business partners
• fulfill your service request
• to conduct the KYC compliance process as a mandatory prerequisite as per the requirements of various regulatory bodies, including UIDAI under the Aadhaar Act and its Regulations
• to validate, process and/or share your KYC information, nominee details with other intermediaries, Regulated Entities (REs) or AMCs or financial institutions or with any other service providers as may be required
• to process payments on your behalf and on your instructions; communicate with you for your queries, transactions, and/or any other regulatory requirement, etc.
• enhancing your user experience in various processes/submission of applications/availment of product/service offerings by analysing user behaviour on an aggregated basis
• to monitor and review products/services from time to time; customize the services to make your experience safer and easier, and conducting audits
• to allow third parties to contact you for products and services availed/requested by you on Penpay Platform or third-party links
• to carry out credit checks, screenings or due diligence checks as lawfully required by us and detect and protect us against error, fraud, money laundering and other criminal activity
• enforce our terms and conditions
• to inform you about online and offline offers, products, services, and updates; customizing and improving your experience by marketing, presenting advertising, and offering tailored products and offers
• to resolve disputes; troubleshoot problems; technical support and fixing bugs; help promote a safe service
• to identify security breaches and attacks; investigating, preventing, and taking action on illegal or suspected fraud or money laundering activities and conducting forensic audits as part of internal or external audit or investigation by Penpay or government agencies located within India or outside the Indian jurisdiction
• to meet legal obligations

While we may also process your Personal Information for other legitimate business cases, we ensure to take appropriate steps to minimize the processing to the extent possible, making it less intrusive to your privacy.

Please note that when providing you with account aggregator services, we do not store, use,process, or have access to any financial information that you choose to transmit under our services.

COOKIES OR SIMILAR TECHNOLOGIES

We use data collection devices such as “cookies” or similar technologies on certain pages of the Platform to help analyse our web page flow, measure promotional effectiveness, and promote trust and safety. “Cookies” are small files placed on your device hard-drive/storage that assist us in providing our services. Cookies do not contain any of your Personal Information. We offer certain features that are only available through the use of a “cookie” or similar technologies. We also use cookies to allow you to enter your password less frequently during a session. Cookies or similar technologies can also help us provide information that is targeted to your interests. Most cookies are “session cookies,” meaning that they are automatically deleted from your device harddrive/storage at the end of a session. You are always free to decline/delete our cookies or similar technologies if your browser/device permits, although in that case you may not be able to use certain features on the Platform and you may be required to re-enter your password more frequently during a session. Additionally, you may encounter “cookies” or other similar technologies on certain pages of the Platform that are placed by third parties. We do not control the use of cookies by third parties.

>

INFORMATION SHARING AND DISCLOSURES

Your Personal Information is shared as allowed under applicable laws, after following due diligence and in line with the purposes set out in this Policy.

We may share your Personal Information with different categories of recipients such as business partners, service providers, sellers, logistic partners, merchants, entities, subsidiaries, legally recognized authorities, regulatory bodies, governmental authorities, financial institutions, internal teams such as marketing, security, investigation team, etc.

Personal Information will be shared, as applicable, on need-to-know basis, for the following purposes, including but not limited to:

• for enabling the provision of the products/services availed by you and facilitating the services between you and the service provider, registered investment advisors, research analysts, sellers, logistic partners, as requested
• for the Aadhaar authentication process by submitting Aadhaar information to Central Identities Data Repository (CIDR) and National Securities Depository Limited (NSDL)
• for complying with applicable laws as well as meeting the Know Your Customer (KYC) requirements as mandated by various regulatory bodies, whose regulated service/product you opt through our services/Platforms
• for completing a payment transaction initiated by you on a merchant site, where based on your instructions, the merchant requests to fetch your Personal Information from us
• for the purpose of processing your financial product subscription requests placed with us and ensuring that these requests reach the relevant financial institution whose service/product you have opted for
• We may also share your information with third parties under contract who assist us with our business operations, including enabling your KYC process, eligibility checks, collection services, and storage of such information, as required by our lending partners
• if it is required by financial institutions to verify, mitigate, or prevent fraud or to manage risk or recover funds in accordance with applicable laws/regulations
• for services related to communication, marketing, data and information storage,transmission, security, analytics, fraud detection, risk assessment and research
• enforce our Terms or Privacy Policy;
• respond to claims that an advertisement, posting, or other content violates the rights of a third party; or protect the rights, property or personal safety of our users or the general public
• if required to do so by law or in good faith we believe that such disclosure is reasonably necessary to respond to subpoenas, court orders, or other legal process
• if requested by government authorities for government initiatives and benefits
• for grievance redressal and resolution of disputes
• should we (or our assets) plan to merge with, or be acquired by any business entity, or reorganization, amalgamation, restructuring of our business then with such other business entity.

While the information is shared with third parties as per purposes set out in this Policy, processing of your Personal Information is governed by their policies. Penpay ensures stricter or no less stringent privacy protection obligations are cast on these third-parties, wherever applicable and to the extent possible. However, Penpay may share Personal Information with third-parties such as legally recognized authorities, regulatory bodies, governmental authorities, and financial institutions as per purposes set out in this Policy or as per applicable laws. We do not accept any responsibility or liability for usage of your Personal Information by these third parties or their policies.

STROAGE AND RETENTION

To the extent applicable, we store Personal Information within India and retain it in accordance with applicable laws and for a period no longer than it is required for the purpose for which it was collected. However, we may retain Personal Information related to you if we believe it may be necessary to prevent fraud or future abuse or if required by law such as in the event of the pendency of any legal/regulatory proceeding or receipt of any legal and/or regulatory direction to that effect or for other legitimate purposes. Once the Personal Information has reached its retention period, it shall be deleted in compliance with applicable laws.

REASONABLE SECURITY PRACTICES

Penpay has deployed administrative, technical, and physical security measures to safeguard user’s Personal Information and Sensitive Personal Information. Specifically, in order to safeguard your Aadhaar information, we have implemented applicable security controls as given under and required by the Aadhaar Regulations. We understand that as effective as our security measures are, no security system is impenetrable. Hence, as part of our reasonable security practices, we undergo strict internal and external reviews to ensure appropriate information security encryption or controls are placed for both data in motion and data at rest within our network and servers respectively. The database is stored on servers secured behind a firewall; access to the servers is password-protected and is strictly limited.

Further, you are responsible for maintaining the confidentiality and security of your login id and password. Please do not share your Penpay login, password, and OTP details with anybody. It shall be your responsibility to intimate us in case of any actual or suspected compromise to your Personal Information.

THIRD-PARTY PRODUCTS, SERVICES, OR WEBSITES

When you are availing products and services of service providers on Penpay Platform, Personal Information may be collected by respective service providers and such Personal Information shall be governed by their privacy policy. You may refer to their privacy policy and terms of service to understand how your Personal Information will be handled by such service providers.

Our services may include links to other websites or applications when you visit our Platform. Such websites or applications are governed by their respective privacy policies, which are beyond our control. Once you leave our servers (you can tell where you are by checking the URL in the location bar on your browser or on the m-site you are redirected to), use of any Personal Information that you provide on these websites or applications is governed by the privacy policy of the operator of the application/website, you are visiting. That policy may differ from ours and you are requested to review those policies or seek access to the policies from the domain owner before proceeding to use those applications or websites. We do not accept any responsibility or liability for usage of your Personal Information by these third parties or their policies.

YOUR CONSENT

We process your Personal Information with consent. By using the Penpay Platform or services and/or by providing your Personal Information, you consent to the processing of your Personal Information by Penpay in accordance with this Privacy Policy. If you disclose to us any Personal Information relating to other people, you represent that you have the authority to do so and permit us to use the information in accordance with this Privacy Policy. Further, you agree and authorize Penpay to communicate with you via channels like Phone calls and E-mail for the purposes set out in this policy.

CHOICE/OPT-OUT

We provide all users with the opportunity to opt-out of receiving any of our services or nonessential (promotional, marketing-related) communications from us, after setting up an account. If you want to remove your contact information from all our lists and newsletters or discontinue any our services, please click on the unsubscribe button on the emailers.

PERSONAL INFORMATION ACCESS/ RECTIFICATION AND CONSENT

You can access and review your Personal Information shared by you by placing a request with us. In addition, you may at any time revoke consent given to us to store your e-KYC information, collected as part of the Aadhaar-based e-KYC process. Upon such revocation, you may lose access to services that were availed on the basis of the consent provided. In some cases, we may continue to retain your information as per the ‘Storage and Retention’ section of this Policy. To raise any of the above requests, you may write to us using the contact information provided under the ‘Contact Us’ section of this Policy.

In case you wish to delete your account or Personal Information, you may reach out to our grievance officer. However, retention of your Personal Information will be subject to applicable laws.

For the above requests, Penpay may need to request specific information from you to confirm your identity and ensure authentication. This is a security measure to ensure that Personal Information is not disclosed to any person who does not have a right to receive it or is not incorrectly modified or deleted.

In cases where you need any further information specific to the product/ services that you are availing, we request you to read through the Terms and Conditions specific to the product/service which is easily accessible through the Penpay Platform. For seeking any further information on the same, you can write to us at the details mentioned in the ‘Contact Us’ section of this Policy.

CHILDREN INFORMATION

We do not knowingly solicit or collect Personal Information from children under the age of 18 and use of our Platform. If you are under the age of 18 years then you must use the Platform or services under the supervision of your parent, legal guardian, or any responsible adult.

CHANGES TO POLICY

This policy is subject to the changes. We reserve the right, at our sole discretion, to change, modify, add, or remove portions of this Privacy Policy at any time without any prior written notice to you. We may, however, reasonably endeavor to notify you of the changes, it is your responsibility to review the Privacy Policy periodically for updates/changes. Your continued use of our services/Platform, following the posting of changes will mean that you accept and agree to the revisions. We will never make changes to policies in order to make it less protective of Personal Information already shared by you.

CONTACT US

In case you have any questions, concerns, or complaints regarding the processing of your PersonalInformation or this Privacy Policy you may write to Penpay Grievance Officer at legal.penpay@gmail.com.We are committed to answer your questions within the reasonable time limit. Any delay in theresolution time shall be proactively communicated to you