Privacy & Data Protection Policy

1. Introduction & Regulatory Framework

Stellarpath Horizons Private Limited ("Company", "We", "Us", or "Our") owns and operates the digital lending technology platform TheCredPe (thecredpe.com), having its registered office at Office No. 721-A, Jaina Tower-II, Distt Centre, Janak Puri, Janakpuri B-1, West Delhi, New Delhi, Delhi, India, 110058.

We are unconditionally dedicated to maintaining the confidentiality, integrity, and security of all personal, KYC, and financial data entrusted to us by borrowers, applicants, and website visitors. This Privacy Policy is constructed in strict adherence with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act).
• The Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• The Reserve Bank of India (RBI) Guidelines on Digital Lending dated September 02, 2022, and subsequent circulars.

2. Information We Collect

We collect only such information as is strictly necessary and proportional for verifying your identity, determining your credit eligibility, facilitating loan disbursal, and servicing your loan repayments.

A. Personal & KYC Identification Data

• Basic Identity Information: Full legal name, date of birth, gender, marital status, residential address, and father's / mother's name.
• Government Identifiers: Permanent Account Number (PAN) and Aadhaar number (collected solely via voluntary e-KYC masked format / DigiLocker verification without storing unencrypted raw Aadhaar numbers).
• Contact Credentials: Active personal telephone number, verified email address, and emergency alternative contact details.

B. Professional, Employment & Financial Data

• Employment Profile: Employer/organization name, office address, job designation, total work experience, and official corporate email address.
• Income Records: Monthly net in-hand salary, income tax returns (ITR), salary pay slips, and 3 to 6 months of bank account statements.
• Banking Details: Bank name, account number, IFSC code, and branch details necessary for loan disbursals and e-NACH auto-debit setup.
• Credit Information: Credit score and detailed credit history fetched from authorized Credit Information Companies (TransUnion CIBIL, Equifax, Experian, and CRIF High Mark) with your express one-time consent.

C. Strictly Prohibited Data Categories (What We Do NOT Collect)

In strict accordance with RBI Digital Lending Directives, TheCredPe DOES NOT access, request, or store:

• Your personal contacts or contact books.
• Your call logs, SMS logs, or messaging history.
• Your device gallery, photos, media storage, or camera rolls.
• Continuous background GPS tracking.

3. Purpose and Legal Grounds for Data Processing

Your data is processed strictly based on your explicit consent for the following defined purposes:

1. Credit Underwriting & Risk Evaluation: Enabling credit appraisal to assess your creditworthiness, affordability, and loan sizing.
2. Regulatory KYC Verification: Complying with statutory Know-Your-Customer (KYC) and Anti-Money Laundering (AML) mandates prescribed under the Prevention of Money Laundering Act, 2002 (PMLA).
3. Direct Disbursement & Repayment: Executing instant direct IMPS/NEFT fund transfers and establishing automated NACH mandates.
4. Communication & Servicing: Dispatching Key Fact Statements (KFS), repayment schedules, transaction receipts, payment reminders, and customer support notifications.
5. Fraud Detection: Detecting and mitigating potential identity theft, credential stuffing, or fraudulent applications.

4. Information Sharing & Third-Party Disclosures

TheCredPe does not sell, rent, or lease your private data to third-party advertisers or brokers. Your data is shared exclusively on a need-to-know basis with:

• Authorized Lending & Financial Institutions: For credit evaluation, risk analysis, account verification, and statutory loan fulfillment.
• Authorized Credit Information Companies: TransUnion CIBIL, Equifax, Experian, and CRIF High Mark to record credit inquiries and update repayment performance.
• Payment Gateways & NPCI: The National Payments Corporation of India (NPCI) and authorized RBI-licensed Payment Aggregators for e-NACH and repayment processing.
• Government & Law Enforcement Agencies: When strictly mandated by statutory subpoena, court decree, or legal compliance under applicable Indian laws.

5. Data Security Measures

We implement industry-leading technical and organizational safeguards to ensure absolute data defense:

• Encryption: All data transmitted over our web portal is encrypted using TLS 1.3 protocols. All sensitive databases are protected using AES-256 bit encryption at rest.
• Server Localization: All user data, databases, and server logs reside securely on Tier-IV cloud infrastructure located strictly within the geographical boundaries of the Republic of India.
• Access Control: Strict role-based least-privilege access with Multi-Factor Authentication (MFA) and immutable audit trails for every access event.

6. Your Rights as a Data Principal

Under the DPDP Act 2023 and RBI regulations, you enjoy comprehensive rights over your personal data:

• Right to Review: Request a complete summary of the personal data held and processed about you.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated personal information.
• Right to Withdraw Consent: You may withdraw your consent for optional communications at any time. For active loan agreements, data required for legal and accounting compliance must be retained until full loan closure.
• Right to Erasure: Following full loan settlement and expiration of statutory regulatory retention periods, you may demand deletion of your records.

7. Data Protection Officer (DPO) Contact Details

For any privacy inquiries, consent withdrawals, or data rights requests, you may contact our designated Data Protection Officer: