1. General

This Privacy Policy is framed in accordance with Section 43A of the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023, and the Reserve Bank of India’s Digital Lending Guidelines (2025).

Next Capital, or any person acting on its behalf, collects, stores, processes, and discloses personal information only for lawful purposes, under valid contracts, and in compliance with applicable regulations. This Policy is published on our website and is available to all providers of information.

Ownership and Technology Disclosure

Next Capital is a brand name under BILLUS INVESTMENTS PRIVATE LIMITED (hereinafter referred to as the “Company”) CIN- U67120DL1997PTC085697, (R.B.I. Reg. No-14.01519). The Next Capital mobile application is owned and operated by BILLUS INVESTMENTS PRIVATE LIMITED, a company incorporated under the Companies Act, 2013, having its registered office at SF-19, Aditya Mega Mall, Near Karkardooma Court, CBD East, Delhi, India – 110032.

LILLUS INVESTMENTS PRIVATE LIMITED is solely responsible for the design, development, operation, maintenance, and support of the Next Capital platform.

BILLUS INVESTMENTS PRIVATE LIMITED is a Reserve Bank of India–registered Non-Banking Financial Company (NBFC) (Reg. No-14.01519) and is solely responsible for all credit appraisal, loan approval, disbursement, and regulatory compliance for loans originated via the Next Capital platform.

All loan applications facilitated through Next Capital are approved, sanctioned, and disbursed solely by BILLUS INVESTMENTS PRIVATE LIMITED, in compliance with applicable RBI guidelines.

Lending Partner Details:

BILLUS INVESTMENTS PRIVATE LIMITED ( Reg No-14.01519)

BILLUS INVESTMENTS PRIVATE LIMITED is an RBI-registered NBFC and is responsible for all credit appraisal, loan approval, disbursement, and regulatory compliance for loans originated via the Next Capital platform.

2. Purpose

Next Capital is committed to protecting the privacy of its users and members, and to maintaining the confidentiality of data provided to us from time to time. We are strongly committed to safeguarding personal information, including but not limited to Sensitive Personal Data and Financial Information, that our customers share with us. We take all reasonable measures to protect such information from unauthorized access, use, or disclosure.

This Privacy Policy provides details about how your data is collected, stored, processed, and used by Next Capital. You are advised to carefully read this Privacy Policy before using our services.

This Policy applies to all users of our website, mobile applications, and services. By accessing or using our platform, you consent to the collection, use, and disclosure of your personal information in accordance with this Privacy Policy. If you do not agree with the terms of this Policy, you may refrain from using our services.

For any questions, concerns, or requests regarding this Privacy Policy, you may contact us at customer.care@nextcapital.in

This Privacy Policy applies to all of our ongoing online activities, including website visitors and mobile application users, and covers the information that they provide or that is collected during their use of Next Capital. Information collected offline or through channels other than our website or mobile application does not fall within the scope of this Privacy Policy.

3. Definitions

For the purposes of this Privacy Policy:

1. “We,” “Our,” and “Us” refer to Next Capital (a brand name under BILLUS INVESTMENTS PRIVATE LIMITED).
2. “Site” refers to the Next Capital website, mobile application, and any digital applications provided by us, which include a link to this Privacy Policy.
3. “User,” “You,” or “Your” refers to anyone who visits, accesses, browses, or uses the Next Capital website, mobile application, or services.
4. “Personal Information” means any information that relates to a natural person, which either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person.
5. “Personal and Financial Information” refers to information that is generally not available in the public domain and is of a sensitive nature, such as passwords, financial details, biometric data, medical records, physical, physiological, and mental health conditions, and sexual orientation.
6. “Consent” means an explicit, freely given, specific, informed, and unambiguous indication of agreement by a user for the processing of their personal data for a defined purpose.
7. “Platform” refers to the digital infrastructure provided by Next Capital, including our mobile application, website, and any associated software or interface.

4. Collection of Information

While availing of service or products or using the site, Next Capital may collect and process information from the customers including sensitive information that is confidential in nature but not limited to the below mentioned:

1. Information that the users provide to Next Capital by filling in forms on the website. This includes contact information such as name, email address, mailing address, phone number, financial details, family details, banking relationships, and transaction history, etc.
2. We also collect information through supporting documents collected as per Know Your Customer (KYC) guidelines issued by the Reserve Bank of India, including KYC documents (PAN, Aadhaar, photograph), contact details (name, email, mobile, address), bank details (account number, IFSC), employment and income information, and financial SMS metadata necessary for loan risk assessment and other documents like statements of accounts, financial statements, etc. on behalf of our lending partner for underwriting purposes.
3. Information that the users provide while registering for an account with us, such as name, address, email address, and telephone number. We may collect device metadata (IP address, device ID, OS version, installed application list), solely for fraud detection, service improvements, and security.
4. Other personal information provided by third parties such as credit bureaus and identity verification services.
5. To complete your onboarding/KYC, we may request one-time access to your device’s camera and location, strictly with your explicit consent.
6. We may read the headers of all SMS to check the type of sender. We only read the indicative SMS content from 6-digit alpha numerical numbers for verification purposes. Pertinent information such as sender names, SMS content, received timestamps are periodically collected for the purpose of provision of financial and allied services and the data is transmitted to third parties. It is important to note that we do not read or analyze personal or OTP messages, except OTP messages sent by us, which are linked to our purpose of use during the lifetime of the app installed. This data may be used to verify financial statistics such as income, spending patterns which help us in the credit evaluation and may help us in facilitating higher limits, faster approval ratesand for fraud detection and prevention.
7. We collect metadata about installed and system applications on your device—including application name, package name, install/update time, installer source, version name, and version code. This information may be collected even when the app is closed or not actively in use.
8. The data is securely uploaded to our trusted device intelligence partner, Credeau (via https://devicesync.credeau.com) to support identity verification, fraud detection (e.g., presence of VPNs, gaming or high-risk apps), underwriting, and offering tailored credit limits. These insights help us provide faster approvals and more relevant credit offers. Data collection is initiated only after your explicit consent and is handled in accordance with applicable privacy and data protection policies.
9. Next Capital seeks one-time permission to collect and monitor the information about the location of the customer’s device to provide serviceability of loan application, to reduce risk associated with the loan application, and to provide pre-approved customized loan offers. This also helps us to facilitate verification of the address, making a better credit risk decision, and know your customer (KYC) process.
10. Next Capital collects limited device-related information to enhance user safety, prevent fraud, and ensure secure digital lending operations. This may include details such as device model, operating system version, available RAM/storage. We do not collect permanently identifiable information such as IMEI or serial numbers, in compliance with Google Play policies and privacy regulations. Next Capital requests Phone State permission strictly to verify the device’s active SIM and network status at the time of onboarding and disbursement, helping us ensure that the transaction corresponds to the rightful customer and is not spoofed. All such access is performed with your explicit, informed consent, and in accordance with RBI’s digital lending framework and applicable Indian privacy laws.
11. We do not collect or store biometric data.
12. Information that you provide to Next Capital when interacting with our customer support team or other team members via phone, email, online form, or other correspondence.
13. Personal information stored with third parties that you choose to provide to Next Capital, such as social media account information and your social media contacts. By linking your third-party accounts or using third-party sign-in services, you authorize Next Capital to have access to this information, and you agree that Next Capital may collect and use this information in accordance with this Privacy Policy.
14. Personal testimonial information or endorsements that you voluntarily provide to us and which we may display with your name on the Next Capital Sites with your consent. To update or delete your testimonial, contact us at customer.care@nextcapital.in
15. Next Capital App is hosted in India and we ensure that every data or information that we collect from you is stored in servers located in India and the same is in compliance with all the statutory/regulatory obligations.
16. We display just-in-time consent screens for permissions like SMS, location, phone state, and app list in accordance with Google Play policy.

When the user uses the site, our servers automatically record certain information that the user’s web browser sends whenever the user visits any website. Such information is known as “LOG FILES.” These server logs may include information such as the user’s web request, Internet Protocol (IP) address, browser type, referring/exit pages and URLs, number of clicks, domain names, landing pages, pages viewed, and other such information. We use this information, which may or may not identify users, to analyze trends, administer the site, track user’s movements around the site, and gather demographic information about the user base as a whole. We do not access your contacts or call logs under any circumstance. Access to SMS, gallery, or location is strictly limited to specific, legitimate purposes such as fraud detection, credit risk assessment, or identity verification. Such data is collected only after obtaining your explicit and informed consent, in compliance with applicable laws and platform policies.

5. How We Use Your Information

We use/process your information to:

• Authenticate your identity to comply with the RBI and NBFC laws and regulations.
• Evaluate your creditworthiness and provide loans through our NBFC, BILLUS INVESTMENTS PRIVATE LIMITED.
• Process loan disbursement, collection, and repayments.
• Monitor, detect, and prevent fraud, financial crimes, money laundering, or any unauthorized access.
• Improve and enhance user experience, application/service features, and security of our platforms.
• Provide client support.
• Send promotional or service-related emails, SMS, phone calls, or any other form of communication (with your explicit consent).
• To help our legal team investigate violations of the terms of use of this policy or defend legal claims against us.
• To disclose information to applicable law enforcement/regulatory authorities in compliance with court orders, summons, or requests under special circumstances.

6. Sharing and Transfer of Information

Next Capital may share information with individuals and body corporate in the course of normal business operations, and the customer has subscribed for, and any activity related to these services such as collection of the fee. We share your information only with regulated partners and third parties under strict confidentiality agreements.

It may become necessary for Next Capital to disclose the customer’s personal information to its Lending partner or agents in the course of normal business operations for the above-referred purpose. Your personal data is shared only with: Regulated lending partners (Banks/NBFCs), Credit Information Companies (e.g., CIBIL, Experian), Third-party service providers (e.g., e-KYC, e-sign, payment gateways), and Government/regulatory bodies as mandated by law (e.g., RBI, tax authorities, law enforcement).

However, these parties would be required to use the information obtained from Next Capital for such purposes exclusively and protect the personal information, including but not restricted to, Sensitive Personal and Financial Information under a strict code of confidentiality.

We will not voluntarily disclose your personal information to any non-connected third party but in certain circumstances, we may do so if we are required by court order, by Government Authorities, by law enforcement authorities, by statutory authorities or by other legal processes or where it becomes necessary to do so to protect the rights or property of the site and/or its group companies/affiliates, etc. We may also disclose your information to a third party as part of a merger, cooperation towards delivering services or transfer, or any restructuring.

We will only use your personal information data for the purposes for which we collect it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

7. Data Retention and Deletion

Next Capital shall not retain personal information longer than is necessary to fulfil the purposes for which it was collected and as permitted by applicable law. However, the Lending partners will retain your personal information as needed during the tenure of loan and even after termination of account to comply with our legal and regulatory obligations, resolve disputes, conclude any activities related to the cancellation of an account, investigate, or prevent fraud and other inappropriate activity, enforce our agreements, and for other business reasons.

Your data may also be retained temporarily in backup systems to ensure disaster recovery, system restoration, or legal hold purposes, although access will be restricted, and deletion will be scheduled in accordance with our internal retention protocols.

By continuing to use our services, you agree to this data retention policy. You may contact our Grievance Officer at any time to exercise your right to access, correct, or request deletion of your personal data.

Grievance Officer: Abhinav Malik

Email: grievanceofficer@nextcapital.in

Address: SF-19, Aditya Mega Mall, Near Karkardooma Court, CBD East, Delhi, India – 110032.

Customers can also contact us at customer.care@nextcapital.in for assistance with data deletion requests.

8. Data Security

We at Next Capital are strongly committed to protecting the privacy of our customers and have taken all necessary and reasonable measures to protect the confidentiality of customer information and its transmission through the world wide web. Next Capital shall not be held liable for disclosure of the confidential information when in accordance with this Privacy Policy or in terms of the agreements, if any, with the customer. We regularly review and enhance our data protection practices to keep pace with evolving regulatory requirements and emerging threats in the digital lending ecosystem.

Access Controls: Access to personal data is role-based and restricted to authorized personnel on a need-to-know basis.

Network and Application Security: We implement regular vulnerability assessments, firewall protection, anti-malware controls, intrusion detection systems, and secure coding practices.

Data Minimization: We ensure data is collected and retained only to the extent necessary for the lawful purpose for which it was processed.

You are responsible formaintaining the security of your account credentials and other authentication involved in obtaining access to password-protected or secure areas. Next Capital will not bear any liability in respect of such unauthorized use of your account.

9. Link to Third Party Websites

Our platform may contain hyperlinks or redirections to third-party websites, mobile applications, or services that are not operated or controlled by Next Capital. These links are provided for your convenience and informational purposes only. The inclusion of a link does not imply any endorsement by Next Capital of the third-party website, the website’s provider, or the information on the third-party website. We do not endorse, monitor, or have any control over the privacy practices, security measures, content, or terms of use of such third-party platforms. If the users submit personal information to any of those websites, such information is governed by the privacy policies of such third-party websites and Next Capital disclaims all responsibility or liability with respect to these policies or the websites.

We strongly advise you to review the privacy policies and security practices of any third-party website or service you choose to engage with, especially before submitting any personal, financial, or sensitive data. Next Capital disclaims any responsibility or liability for any loss or damage that may arise from your use of such third-party sites, or your reliance on any information contained therein.

Use of third-party services (such as payment gateways, e-KYC vendors, or credit bureaus) via our platform is subject to additional privacy controls that will be explicitly communicated to you at the time of interaction, wherever applicable.

10. Children’s Information

Another part of our priority is to ensure protection for children while using the internet. We encourage parents and guardians of children to observe and participate in monitoring and/or guiding their online activities. Next Capital will never knowingly collect any Personal Identifiable Information from children below the age of twenty-one. If you think that your child has divulged any such information on our website, we strongly urge you to contact us immediately. We assure you of prompt action in removing any such information available in our records.

As part of our loan eligibility checks and compliance with the Know Your Customer (KYC) norms prescribed by the Reserve Bank of India, we require documentary age verification at the time of onboarding. If we become aware that we have inadvertently collected personal data from a child, we will take immediate steps to delete or anonymize such data from our systems. By using our services, you affirm that you are at least 21 years of age and legally eligible to enter into a binding contract under Indian law.

11. Consent

By accessing, registering, or using the Next Capital platform (including our website, mobile application, or digital services), you explicitly provide your free, informed, specific, and unambiguous consent to the collection, processing, storage, use, and disclosure of your personal data and sensitive personal data as outlined in this Privacy Policy. This consent is provided in accordance with the provisions of the Digital Personal Data Protection Act, 2023, and the applicable regulatory framework of the Reserve Bank of India (RBI).

If you do not agree with the Policy, you may refrain from using our services. You may withdraw your consent at any time by writing to our Grievance Officer. Upon receipt of such a request, we will cease processing your personal data for the purposes for which consent was originally granted, unless such processing is required: To comply with a legal obligation, for ongoing contractual obligations (e.g., servicing an active loan), or for the establishment, exercise, or defence of legal claims.

Please note that withdrawal of consent for essential data (e.g., KYC, repayment details) may affect your ability to access or continue using certain services. In certain limited cases, we may process your data without consent if it is: Necessary for the performance of a contract to which you are a party, required under a legal obligation, in the interest of credit risk assessment by regulated lending partners, or to detect or prevent fraud, cybercrime, or misuse of our services. Your continued use of our services following changes in privacy policy constitutes your reaffirmation of the consent provided, unless explicitly withdrawn.

12. General

Next Capital reserves the right to amend or update this Privacy Policy periodically to reflect changes in legal or regulatory obligations, business practices, or service enhancements. Any changes will be effective prospectively and will be communicated through our website, app, or other appropriate means. We recommend reviewing this policy at regular intervals.

This Privacy Policy does not confer any rights or remedies upon any third party, nor does it create any contractual or legal obligations beyond those mandated by law or explicitly agreed to in our service agreements.

This Privacy Policy shall be governed by and interpreted in accordance with the laws of India, and any dispute arising out of this privacy policy must be resolved through arbitration pursuant to the Arbitration and Conciliation Act of 1996. The said arbitration shall be conducted in Gurugram, Haryana, in English/Hindi.

If any provision of this Privacy Policy is found to be invalid or unenforceable under applicable law, such provision shall be severed, and the remainder of the policy shall continue in full force and effect.

In case of any ambiguity or conflict in interpretation, the English version of this policy shall prevail. Headings are for reference purposes only and do not affect interpretation.

13. Disclaimer

The information, content, and materials provided on the Next Capital website, mobile application, and related platforms are made available on an “as is” and “as available” basis, for general informational purposes only. All the information on our website is published in good faith and for general information purposes only. Next Capital does not make any warranties about the completeness, reliability, and accuracy of this information. Any action you take upon the information you find on this website is strictly at your own risk. We will not be liable for any losses and/or damages in connection with the use of our site.

From our site, you can visit other sites by following hyperlinks to such external sites. While we strive to provide only quality links to useful and ethical websites, we have no control over the content and nature of these sites. These links to other websites do not imply a recommendation for all the content found on these sites. Site owners and content may change without notice and may occur before we have the opportunity to remove a link that may have gone ‘bad’.

Please be also aware that when you leave our website, other sites may have different privacy policies and terms that are beyond our control. Please be sure to check the Privacy Policies of these sites as well as their “Terms of Service” before engaging in any business or uploading any information.

Nothing on our platform constitutes financial, legal, or professional advice. You should independently verify any information before relying on it and consult appropriate advisors where necessary.

Next Capital shall not be liable for any direct, indirect, incidental, consequential, or punitive damages, including but not limited to loss of profits, loss of data, or loss of business opportunities arising out of or in connection with your access or use of the platform or reliance on any material provided therein.

We do not guarantee that access to our platform will be uninterrupted, error-free, or free from viruses or other harmful components. You are responsible for implementing adequate safeguards before downloading any material from our platform.

14. Review of the Policy

The Policy should be subjected to an annual review by the management and modifications, if any warranted, to ensure that it remains accurate, complete, and aligned with applicable legal, regulatory, and operational requirements, should be taken up with the approval of the Board. If there are any amendments in the regulations, revision in the policy should be staged for the Board’s approval in the immediately ensuing Board Meeting, after the amendments are notified by the regulation. The most recent version of the Privacy Policy will always be available on our website and mobile application. Users are encouraged to review this policy regularly to remain informed. Continued use of our services after such changes will constitute acceptance of the revised Policy.

15. Connect With Us

If you have any concerns related to this policy or want to submit a data deletion request, please contact us at:

Email: customer.care@nextcapital.in

Grievance Officer Email: grievanceofficer@nextcapital.in

Address: SF-19, Aditya Mega Mall, Near Karkardooma Court, CBD East, Delhi, India – 110032.

Annexure A – Device Permissions Disclosure

All permissions are used strictly for the purposes stated below and in compliance with applicable laws and Google Play policies:

• Camera & Microphone: Used solely for KYC verification, selfies, and document capture.
• Location: Used only for serviceability checks, address verification, fraud detection, and regulatory compliance.
• Storage: Uploading required documents and statements.
• Device Information: Security monitoring, analytics, and fraud prevention.
• SMS (Limited Access): Accessed only for one-time password (OTP) verification and financial data analysis for credit assessment, in compliance with Google Play Restricted Permissions policy. We do not read personal or promotional messages.
• App List: Collected for fraud detection and device intelligence purposes only, with your explicit consent.
• Phone State: Used to verify the device’s active SIM and network status at the time of onboarding and disbursement, to prevent spoofing and ensure transaction security.