Note: Next Capital is a mobile application owned by Kohinoor Fintech Private Limited (CIN: U63119HR2026PTC151787), a company registered under the Companies Act, 2013. Please refer to its {Privacy Policy}.

Our lending partner is Billus Investments Private Limited, a registered NBFC (CIN: U67120DL1997PTC085697). Please refer to its Privacy Policy.

Billus Investments Private Limited (RBI Registered NBFC)

CIN: U67120DL1997PTC085697

Registered Office: SF-19, Aditya Mega Mall, Near Karkardooma Court, CBD East, Delhi, India – 110032

We, at BILLUS INVESTMENTS PRIVATE LIMITED, an RBI Approved NBFC (“Billus” or “We”), understand Privacy and its value. Therefore, it is all the more important for us to make You (“You” or “Customer” or “User”), its website/mobile application Next Capital (“Platform” – owned & operated by Kohinoor Fintech Private Limited) (collectively, the “Platform”), understand the reason behind collection of your information and its usage and the manner in which we collect, use, store and share information about you (“Privacy Policy”).

This Privacy Policy has been prepared in compliance with:

• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
• Digital Lending Directions 2025 issued by the Reserve Bank of India (RBI).
• Digital Personal Data Protection Act, 2023.
• Other applicable acts, regulations and rules which require the publishing of a privacy policy for handling of or dealing in personal information including sensitive personal data or information and all applicable laws, regulations, guidelines provided by applicable regulatory authorities including but not limited to the RBI.

CONSENT

General Consent

You hereby provide your explicit, informed, and freely given consent for the collection, processing, storage, sharing, and usage of your data by BILLUS INVESTMENTS PRIVATE LIMITED (“Billus”), solely for the purposes described in this Privacy Policy, and in compliance with applicable Indian laws and regulations.

Your consent is obtained through clear and auditable means, including (but not limited to) OTP-based confirmation, electronic forms, and in-app notifications, depending on the nature of the data being collected.

We will never collect or use any personal data, financial data, or device-level data without your specific consent for that category of data.

SMS Consent

• We only read the One-Time Password (OTP) SMS sent by us to your registered mobile number, for login purposes.
• We do not read any financial data from your SMS.
• We do not access, read, or store any other SMS, including personal messages, private conversations, promotional content, or OTPs sent by others.

Location & Device Permissions (Next Capital – owned & operated by Kohinoor Fintech Private Limited)

Location: One-time permission is sought to collect and monitor device location for:

• serviceability of loan applications
• risk reduction in loan application processing
• providing pre-approved/customised loan offers
• address verification, better credit risk decisions, and KYC purposes

Device Information: Limited device-related information collected includes:

• device model
• operating system version
• available RAM/storage

We do not collect permanently identifiable information (e.g., IMEI, serial numbers).

Phone State Permission: Requested strictly to:

• verify active SIM and network status at onboarding/disbursement
• ensure the transaction corresponds to the rightful customer
• prevent spoofing

Your consent specifically includes:

• Collection of information required for credit assessment and underwriting of loan products and value-added services.
• Access to your mobile device’s location, camera, and microphone only for e-KYC or video KYC verification purposes.
• Access to your credit bureau data, bank statements, GST returns, and related information (only after express consent for each instance).
• Secure sharing of personal data with regulated entities and service providers for service delivery.

You may withdraw consent anytime by contacting our Grievance Officer or through Platform settings. Withdrawal will not affect prior lawful processing but may impact your ability to access certain services.

We ensure disclosure of the identity of Regulated Entities (RE), Lending Service Providers (LSP), and Digital Lending Apps (DLA) at every stage (platform interface, sanction letter, KFS, loan agreement).

COLLECTION OF INFORMATION

The collection of information is solely for delivering regulated digital lending and non-lending services, in line with:

• RBI Digital Lending Directions, 2025
• Digital Personal Data Protection (DPDP) Act
• IT Act and Rules

Part A: Lending Services – Information for loan facilitation, underwriting, sanction, and disbursal.

Part B: Non-Lending Services – Information for user registration and value-added services.

Categories of Information Collected

User Personal Information

• Full name, email ID, PAN, GST details, address, mobile number, postal code, banking details

Social Account Information

• Option to register using Google account → collection of email ID and public profile details (name, email).

Device Information & Installed Apps Data

• Unique identifiers, log information (IP, crashes, search queries, date/time), performance data, diagnostic data.
• Used for app functionality, troubleshooting, updates, and customised experience.

Location, Camera, Microphone Access

• Location → address verification, KYC, onboarding
• Camera → document scanning for KYC
• Microphone → Video KYC recording (regulatory compliance)

Third-Party Information

• Credit bureau data, NSDL, payment gateways
• Bank account/UPI details for repayments

User-Provided Information

• Form submissions, registration details, correspondence, loan applications, KYC documents, etc.

Data Storage & Non-Personal Data

• Storage only in India (basic personal info retained)
• Aggregated analytics (demographics, usage, behaviour)
• Cookies for identification and user experience improvement

PURPOSE OF COLLECTION & USE OF INFORMATION

We use collected information to:

• Verify identity and complete KYC (as per RBI rules)
• Assess creditworthiness and loan eligibility
• Process loan applications, documentation, disbursement, and repayment
• Provide loan servicing, repayment reminders, and financial literacy support
• Detect/prevent fraud, money laundering, terrorism financing, and unlawful activities
• Troubleshoot, resolve disputes, and improve safety
• Deliver personalized experiences, offers, and targeted communications

DISCLOSURE AND SHARING OF INFORMATION

We may share your information with third parties, strictly on a need-to-know basis, and only for lawful purposes:

With RBI-Registered Financial Institutions: We may share your KYC data, credit-related information, repayment behaviour, and other required personal details with RBI-registered NBFCs, banks, or other regulated financial entities to provide you with loan products and related financial services.

With Service Providers: We may employ third-party service providers (such as Kohinoor Fintech Private Limited for software and technology support) to perform services on our behalf, including technology infrastructure, payment gateways, customer support, credit bureau checks, fraud prevention tools, and data analytics.

With Credit Bureaus: With your explicit consent, we may share your loan performance details with licensed credit bureaus, which may impact your credit score and profile.

For Legal Compliance: We may disclose your personal information if required to do so by law or if we in good faith believe that such disclosure is reasonably necessary to respond to court orders, subpoenas, notices, or other legal processes.

For Corporate Transactions: In the event of a merger, acquisition, sale of assets, restructuring, amalgamation, or financing, your data may be transferred to the successor entity, subject to confidentiality obligations and applicable law.

We will not sell or rent your personal information to any third party without your explicit consent.

DATA RETENTION POLICY

All personal and financial data collected from you is retained only as long as necessary to fulfil the purposes outlined in this Privacy Policy or as required by applicable law, whichever is longer.

As mandated under the RBI’s Digital Lending Guidelines, no personal information, financial information, or device data collected through the Next Capital app (owned & operated by Kohinoor Fintech Private Limited) shall be stored by Lending Service Providers (LSPs) or Digital Lending Apps (DLAs). All such data is stored only with the Regulated Entity i.e., Billus Investments Private Limited, in servers located in India.

Retention timelines:

• KYC and credit underwriting records: minimum 10 years (as per PMLA/Prevention of Money Laundering Act requirements).
• Loan documentation and repayment records: minimum 8 years after closure.
• Customer grievances and correspondence: minimum 5 years.
• Non-personal aggregated data: retained indefinitely for research/analysis.

Data may be retained for longer periods if required for legal, regulatory, or audit purposes.

THIRD-PARTY LINKS, SDKs, AND TECHNOLOGY PARTNERS

The Next Capital app (owned & operated by Kohinoor Fintech Private Limited) may include links to third-party websites or SDKs for the purpose of delivering services such as:

• e-KYC verification,
• OTP-based authentication,
• digital signatures,
• payment gateways,
• credit bureau integrations,
• analytics and performance monitoring.

While we ensure that all third-party SDKs or partners are compliant with applicable Indian laws and RBI guidelines, we do not control the privacy practices of these third-party entities. Therefore, we encourage you to review their respective privacy policies when you interact with them through our Platform.

Billus expressly disclaims liability for any misuse of data by such third parties beyond our control. However, we exercise due diligence in onboarding and monitoring all third-party partners, including executing confidentiality agreements, data protection clauses, and audit rights.

COOKIES AND TRACKING TECHNOLOGIES

We use cookies, pixel tags, and similar technologies to enhance your browsing experience, analyse user traffic, and provide customized content. Cookies allow us to recognize your browser, remember your preferences, and understand your usage patterns.

You may disable cookies from your browser settings, but please note that certain features of the Next Capital platform (owned & operated by Kohinoor Fintech Private Limited) may not function properly if cookies are disabled.

We do not permit any third-party advertising cookies or behavioural trackers on our lending app or website, in compliance with RBI’s Digital Lending Guidelines.

SECURITY PRACTICES AND PROCEDURES

We maintain strict physical, electronic, and procedural safeguards to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

All information is encrypted in transit and at rest, using industry-standard protocols.

Data storage is limited to secure servers physically located in India.

Payment information is not stored by us. All card/bank/UPI data is processed directly by authorized payment gateways that are PCI-DSS compliant.

Access to sensitive data is strictly role-based, monitored, and logged.

Regular internal audits, vulnerability assessments, and penetration tests are conducted.

Employees and service providers are bound by confidentiality agreements and subject to disciplinary actions for violations.

Despite our best efforts, no transmission over the Internet or storage system can be guaranteed as 100% secure. By using the Next Capital platform (owned & operated by Kohinoor Fintech Private Limited), you acknowledge this inherent risk.

USER RIGHTS

As a User of the Next Capital Platform (owned & operated by Kohinoor Fintech Private Limited), you are entitled to the following rights under the Digital Personal Data Protection Act, 2023 and RBI’s Digital Lending Guidelines:

Right to Access: You have the right to request access to the personal data we hold about you, along with details about how it is being processed and for what purpose.

Right to Rectification: You may request correction or updation of any inaccurate or incomplete personal data.

Right to Withdraw Consent: You may withdraw consent previously provided for specific processing activities at any time. Please note that such withdrawal will not affect the legality of processing prior to the withdrawal. Withdrawal of consent may, however, affect our ability to provide certain services.

Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to statutory and regulatory record-keeping requirements.

Right to Restrict Processing: You have the right to request restriction on the processing of your personal data under certain circumstances, such as pending verification of contested accuracy.

Right to Data Portability: Subject to applicable law, you may request a copy of your personal data in a machine-readable format to be transferred to another financial service provider.

Right to Grievance Redressal: You have the right to raise grievances or complaints regarding the handling of your data, and to expect resolution within the timelines prescribed under RBI and IT rules.

We will process all such requests in accordance with applicable Indian laws. To exercise your rights, please contact our Grievance Officer (details below).

GRIEVANCE OFFICER

In accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the RBI’s Digital Lending Guidelines, the name and contact details of the Grievance Officer are provided below

Grievance Officer – Billus Investments Private Limited

Email: support@nextcapital.com

Phone: 9899135137

The Grievance Officer shall acknowledge your complaint within 24 hours of receipt and endeavour to resolve the same within 30 days, as per RBI’s regulatory framework.

DISPUTE RESOLUTION AND JURISDICTION

It is expressly agreed by the Parties hereto that the formation, interpretation, and performance of this Privacy Policy and any disputes arising here from will be resolved through a two-step Alternate Dispute Resolution (ADR) mechanism. The Parties further agree that the provisions of this Section shall survive even after the termination or expiry of the Privacy Policy and/or Terms of Use.

Mediation: In case of any dispute, the Parties shall attempt to resolve the same amicably through mutual discussion. If an amicable resolution cannot be reached within thirty (30) days of the dispute arising, the matter shall be escalated to arbitration.

Arbitration: Any unresolved dispute shall be referred to arbitration under the Arbitration and Conciliation Act, 1996. The arbitration shall be conducted by a sole arbitrator appointed by Billus Investments Private Limited. The proceedings shall be conducted in English, and the seat of arbitration shall be New Delhi, India. The arbitral award shall be final and binding on both Parties.

The Parties agree that the Courts in New Delhi, India shall have exclusive jurisdiction over any disputes that may arise out of or in relation to this Privacy Policy, Terms of Use, or the services offered on the Next Capital Platform (owned & operated by Kohinoor Fintech Private Limited).

GOVERNING LAW

This Privacy Policy shall be governed by, interpreted, and construed in accordance with the laws of India, without regard to conflict of law principles.

UPDATES TO THIS PRIVACY POLICY

Billus reserves the sole and exclusive right to amend, modify, or update this Privacy Policy at any time without prior notice to the User. The revised Privacy Policy will be posted on the Next Capital Platform (owned & operated by Kohinoor Fintech Private Limited) with an updated “Last Modified” date.

We encourage Users to periodically review this Privacy Policy to remain informed of how their data is being protected and processed. Continued use of the Platform following any such changes shall be deemed to signify your acceptance of the modified Privacy Policy.

ACKNOWLEDGEMENT

By accessing the Next Capital Platform (owned & operated by Kohinoor Fintech Private Limited) and availing services of Billus Investments Private Limited, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.