Privacy Policy

Rewafin AI Private Limited

1. Introduction

Rewafin AI Private Limited ("Rewafin", "we", "us", or "our") is committed to respecting individual privacy and protecting personal information processed through our website, business communications and technology services.

This Privacy Policy explains how we collect, use, store, protect, share and manage personal information when individuals visit our website, contact us, request product demonstrations or otherwise interact with Rewafin.

Our approach to personal data protection is guided by applicable Indian laws, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and other applicable information technology, privacy and regulatory requirements, as and when their relevant provisions are in force.

This Privacy Policy applies to our public website at https://www.rewafin.ai/ and our related business interactions.

Personal information processed through Rewafin's enterprise technology platform on behalf of financial institution customers is additionally governed by the applicable customer agreements, data processing arrangements and legal requirements.

2. About Rewafin

Rewafin AI Private Limited is an India-based financial technology company headquartered in GIFT City, Gandhinagar, Gujarat.

Rewafin operates as a Technology Service Provider, offering an AI-native, modular technology platform for financial institutions.

Our technology solutions support different stages of the lending lifecycle, including:

• Loan Origination System (LOS)
• Loan Management System (LMS)
• Collections Management
• Enterprise Resource Planning (ERP)
• Lending analytics and operational intelligence
• Related technology integrations and workflows

Rewafin is a technology platform provider and does not independently operate as a bank, Non-Banking Financial Company (NBFC), lending institution or Lending Service Provider (LSP).

3. Information We Collect

We collect information that is reasonably necessary to operate our website, respond to business enquiries, provide technology services and maintain appropriate business communications.

3.1 Information Provided Directly

When you contact us or submit an enquiry through our website, we may collect:

• Full name
• Business email address
• Contact number
• Company or financial institution name
• Job title or professional designation
• Business requirements and areas of interest
• Information submitted through contact or demonstration request forms
• Other information voluntarily provided in business communications

3.2 Website Usage and Technical Information

When you visit our website, we may collect certain technical and usage information, including:

• Internet Protocol (IP) address
• Browser type and version
• Device and operating system information
• Pages visited and interactions with website content
• Approximate geographical information derived from technical data
• Referral sources
• Visit duration and related website usage information

Some of this information is processed through Google Analytics when the visitor has provided the applicable analytics consent.

3.3 Business Communication Information

We may retain information shared through:

• Business enquiries
• Product demonstration requests
• Email communications
• Meetings and discussions
• Partnership enquiries
• Customer support and service communications

We request that visitors avoid submitting confidential borrower records, passwords, financial account credentials or other sensitive information through general website enquiry forms.

4. How We Use Personal Information

We process personal information for legitimate and lawful business purposes, including:

1. Responding to enquiries and communication requests.
2. Arranging product demonstrations and business meetings.
3. Providing information about our technology solutions.
4. Evaluating prospective business relationships.
5. Maintaining communication with existing and prospective customers.
6. Improving website performance and user experience.
7. Understanding website traffic and engagement.
8. Measuring contact form submissions and demonstration enquiries through appropriately configured analytics.
9. Maintaining website and information security.
10. Preventing misuse, fraud and unauthorised activities.
11. Fulfilling applicable contractual, statutory and regulatory obligations.
12. Protecting our legal rights and resolving disputes.

We do not use information collected through our public website for independent lending, credit approval or borrower underwriting activities.

5. Lawful Processing and Consent

We process personal information only where a lawful basis exists under applicable law.

Where consent is required, we seek consent for the relevant purpose and provide appropriate choices regarding the processing of personal information.

Visitors may withdraw consent where applicable.

Withdrawal of consent does not invalidate processing that was lawful before the withdrawal and does not prevent processing that is otherwise permitted or required by law.

6. Cookies and Website Analytics

Our website uses cookies and similar technologies to support website functionality and, where consent is provided, website analytics.

6.1 Necessary Cookies

Necessary cookies or comparable browser storage mechanisms may be used to support essential website functionality, security, session management and storage of visitor preferences.

These technologies are used where necessary for the operation of the website.

6.2 Analytics Cookies

Rewafin uses Google Analytics to understand website traffic and visitor interactions.

Analytics information helps us understand:

• How visitors access our website.
• Which pages are viewed.
• General website engagement patterns.
• Website performance.
• Contact form and demonstration enquiry conversion activity.

Google Analytics is configured to respect the website's cookie consent preferences.

Non-essential Google Analytics tracking does not activate before the visitor provides the required consent.

6.3 Cookie Consent Management

Our website provides a cookie consent mechanism with the following choices:

• Accept All
• Reject Non-Essential
• Manage Preferences

Visitors can choose whether to permit non-essential analytics cookies.

Cookie preferences remain effective across website navigation and page refreshes.

Visitors can also revisit their cookie preferences and withdraw or modify their consent through the website's cookie settings functionality.

When analytics consent is rejected or withdrawn, Google Analytics tracking is disabled in accordance with the website's implemented consent controls.

6.4 Third-Party Resources

Certain website functions may involve requests to external service providers.

Where external resources are used, the relevant provider may receive technical information necessary to process the request, such as an IP address and browser-related information.

We aim to minimise unnecessary third-party data exposure and apply appropriate privacy and security considerations when selecting external services.

7. Google Analytics and Data Protection

Google Analytics is used for website measurement and performance analysis.

Rewafin uses analytics to understand general visitor activity and measure business enquiry interactions.

Analytics implementation is intended to avoid transmitting personal information from contact and demonstration forms, including names, email addresses, phone numbers and free-text submissions, through analytics events.

Analytics data may be processed by Google in accordance with its applicable service terms, data processing arrangements and privacy practices.

Information about Google's privacy practices is available at:

https://policies.google.com/privacy

Visitors can manage analytics consent through the cookie preference controls available on our website.

8. Information Processed on Behalf of Financial Institutions

Rewafin provides enterprise technology services to financial institutions.

In providing these services, Rewafin may process information relating to borrowers, loan applicants, customers, employees or other individuals on behalf of its financial institution customers.

Such processing is undertaken within the scope of the relevant technology services and contractual arrangements.

Where Rewafin acts as a Data Processor, the relevant financial institution or other applicable Data Fiduciary determines the purposes and lawful basis of processing and provides the applicable processing instructions.

Rewafin does not independently determine lending eligibility, grant loans or assume the role of a regulated lender through the provision of its technology platform.

Responsibilities relating to borrower disclosures, credit decisions, lending conduct and customer grievance redressal remain with the relevant financial institution, subject to applicable law and contractual arrangements.

Individuals with enquiries about a specific loan, borrower account or financial institution's processing activities should ordinarily contact the relevant financial institution.

9. Data Hosting and Storage

Rewafin uses a Rewafin-managed cloud hosting model for its enterprise technology platform.

Customer and borrower data processed within this hosting environment is stored on infrastructure located in India.

Backup data is maintained in a separate data centre located in India.

The company follows a consistent hosting and storage model across its financial institution customers.

Website analytics and other third-party service processing are distinct from the hosting of customer and borrower data within Rewafin's enterprise platform and may be subject to the respective service providers' processing arrangements.

10. Data Security

Rewafin maintains technical and organisational security measures intended to protect information against unauthorised access, misuse, alteration, disclosure and loss.

Our security framework includes:

Role-Based Access Control

Access to systems and information is managed through defined user roles and permissions.

Multi-Factor Authentication

Multi-factor authentication is implemented as part of the platform's access security controls.

Data Encryption

Encryption is implemented for data at rest and in transit.

System Activity and Audit Logs

System activity and audit logging mechanisms support operational traceability and security oversight.

Backups and Disaster Recovery

Backup and disaster recovery arrangements are implemented to support data availability and business continuity.

Data Retention and Deletion Controls

Controls are available to support the management of data retention and deletion in accordance with applicable requirements.

Security Monitoring and Incident Management

Security monitoring and incident management procedures are maintained to identify, assess and respond to relevant security events.

While we apply security measures appropriate to our operations, no electronic system can be guaranteed to be completely secure.

11. Sharing of Personal Information

We may share personal information with authorised parties where necessary for lawful business purposes.

These may include:

• Cloud infrastructure and technology service providers.
• Website hosting and maintenance providers.
• Analytics service providers, subject to applicable consent requirements.
• Communication and business support service providers.
• Professional advisers, auditors and legal consultants.
• Government authorities or regulators where disclosure is legally required.

Such sharing is subject to applicable legal requirements, appropriate safeguards and relevant contractual arrangements.

Rewafin does not sell personal information as a standalone commercial product.

12. Data Retention and Deletion

Personal information is retained for as long as necessary for the purpose for which it was collected, subject to applicable legal, contractual and regulatory requirements.

Retention periods may differ depending on the nature of the information, the relevant business purpose and the applicable customer agreement.

When personal information is no longer required, appropriate deletion, anonymisation or other lawful disposal measures are applied, subject to applicable retention obligations.

For information processed on behalf of financial institution customers, retention and deletion arrangements are governed by the relevant customer agreement and applicable legal requirements.

13. International Data Processing

Customer and borrower data within Rewafin's managed enterprise hosting environment is stored in India, with backups maintained in a separate Indian data centre.

Certain external website services, including Google Analytics, may involve processing by third-party service providers outside India.

Such processing is subject to applicable law and the relevant service provider arrangements.

Where specific regulatory data localisation requirements apply, the relevant customer and service arrangements must comply with those requirements.

14. Your Privacy Rights

Subject to applicable law and the commencement of relevant legal provisions, individuals may have rights concerning their personal information, including:

• Accessing information about the processing of their personal data.
• Requesting correction or updating of inaccurate personal data.
• Requesting erasure where legally applicable.
• Withdrawing consent where processing is based on consent.
• Raising privacy-related grievances.
• Exercising other rights provided under applicable data protection laws.

To submit a privacy request or grievance relating to information handled by Rewafin, please contact:

info@rewafin.ai

Where a request concerns personal information processed on behalf of a financial institution, we may direct the individual to the relevant institution or coordinate with that institution as appropriate.

15. Children's Privacy

Our public website and business services are intended primarily for financial institutions, businesses and professional users.

We do not knowingly solicit personal information from children through our general business website.

If we become aware of personal information collected from a child in circumstances not permitted by applicable law, we will take appropriate corrective action.

16. Third-Party Websites

Our website may contain links to external websites and services.

We are not responsible for the content, security or privacy practices of websites operated by independent third parties.

Visitors are encouraged to review the privacy policies of external services before sharing personal information.

17. Personal Data Breaches

In the event of a personal data breach, Rewafin will assess the incident and take appropriate containment, investigation, remediation and notification measures.

Where notification is required under applicable law or contractual obligations, we will provide the necessary information to the relevant parties and authorities in accordance with those requirements.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology practices, legal requirements or business operations.

Updated versions will be published on this website.

Material changes will be communicated through appropriate means where required by applicable law.

19. Privacy Enquiries and Grievance Contact

For questions, privacy requests or grievances relating to personal information processed by Rewafin, please contact:

Rewafin AI Private Limited

Office No. 1105, 11th Floor,
Regalia by Nakshatra, GIFT City,
Gandhinagar, Gujarat – 382050, India.

Email: info@rewafin.ai

Website: https://www.rewafin.ai/

We will review and address privacy-related requests and grievances in accordance with applicable legal requirements.