Digital Lending Policy

Digital Lending Policy

1. Purpose, Scope and Regulatory Framework

This Digital Lending Policy ("Policy") governs all lending activity undertaken by Girdhar Finlease Private Limited ("GFPL"/"the Company"), an NBFC – Investment and Credit Company registered with the Reserve Bank of India, where the customer journey is carried out predominantly through digital channels – including seamless digital onboarding, credit assessment, disbursement, servicing and recovery, with limited or no physical interface. It applies to the Company's own websites and applications and to every Digital Lending App or platform operated by a Lending Service Provider engaged by the Company, presently 30DaysLoan (www.30daysloan.com) and FundsMama (www.fundsmama.com).

The Policy is framed pursuant to the Reserve Bank of India (Digital Lending) Directions, 2025 and is read with: the RBI Master Direction – Non-Banking Financial Company Scale Based Regulation Directions, 2023 (including the Fair Practices Code); the RBI circular on Key Facts Statement for Loans and Advances dated April 15, 2024; the RBI circular on Fair Lending Practice – Penal Charges in Loan Accounts; the Guidelines on Default Loss Guarantee in Digital Lending; the RBI Master Direction – Know Your Customer, 2016 and the Prevention of Money Laundering Act, 2002; the Master Direction on Outsourcing of Information Technology Services, 2023 and the Master Direction on Managing Risks and Code of Conduct in Outsourcing of Financial Services; the Credit Information Companies (Regulation) Act, 2005; the Digital Personal Data Protection Act, 2023 with the DPDP Rules, 2025; and the Reserve Bank – Integrated Ombudsman Scheme, 2021.

It covers all digitally sourced products of the Company, with specific additional guardrails for the short-term personal loan (30-day / "payday" type) product set out in Section 8, which the Board considers a higher-conduct-risk product warranting enhanced safeguards.

2. Definitions

• Digital Lending: a remote and automated lending process, largely by use of seamless digital technologies for customer acquisition, credit assessment, loan approval, disbursement, recovery and associated customer service.
• Digital Lending App / Platform (DLA): a mobile or web-based application with a user interface that facilitates digital lending services, whether operated by the Company or by an LSP engaged by it.
• Lending Service Provider (LSP): an agent of the Company that carries out one or more of the Company's functions or part thereof in customer acquisition, underwriting support, pricing support, servicing, monitoring, recovery of specific loans or loan portfolios, in conformity with applicable outsourcing directions.
• Key Facts Statement (KFS): the standardised statement of key facts of a loan agreement provided to the borrower in a format prescribed by RBI, in a language understood by the borrower.
• Annual Percentage Rate (APR): the all-inclusive annualised cost of a digital loan to the borrower, including interest and all charges levied by the Company, computed as per the KFS circular.
• Cooling-off / Look-up Period: the period after loan disbursal within which the borrower may exit the loan by paying the principal and proportionate APR, without penalty.
• Default Loss Guarantee (DLG): a contractual arrangement under which a third party guarantees to compensate the Company for loss due to default up to a specified percentage of the loan portfolio.
• Data Principal, Data Fiduciary, Data Processor: as defined in the DPDP Act, 2023.

3. Governance and Board Oversight

• This Policy is approved by the Board of Directors, which retains ultimate responsibility for digital lending conduct, including the acts and omissions of LSPs and DLAs engaged by the Company.
• A Digital Lending Oversight Committee – comprising the Managing Director/CEO, Chief Compliance Officer, Chief Risk Officer, Head of Technology and Head of Operations – meets at least quarterly to review DLA/LSP performance, complaint trends, conduct incidents, portfolio quality, data-protection posture and regulatory developments, and reports to the Board.
• The Chief Compliance Officer is the owner of this Policy. No DLA may be launched, and no LSP engaged, without prior written compliance clearance and, for material arrangements, Board or Committee approval.
• The Company remains responsible to the borrower for all acts of its LSPs and DLAs, including conduct of digital collections, and cannot contract out of this responsibility.
• The Board reviews at least annually: this Policy, the LSP panel, the DLG framework, the interest-rate model and gradation of risk, the complaints MIS, and the internal-audit report on digital lending.

4. Regulatory Registrations and Reporting of DLAs

• The Company shall report and keep updated the details of all DLAs – whether its own or those of its LSPs – on the RBI's Centralised Information Management System (CIMS) portal, in the manner and within the timelines specified by RBI. Reporting is a compliance precondition to the DLA going live.
• Any addition, modification, rebranding, transfer or discontinuation of a DLA, or any change in the LSP operating it, shall be reported promptly on CIMS and recorded in the Company's DLA register.
• The DLA register (maintained by Compliance) records for each app: name, operating entity, URL/store listing, products offered, date of go-live, CIMS reporting date, agreement reference, and current status.
• The Company shall not permit any DLA or LSP to lend in its own name or to hold out as the lender; GFPL is disclosed as the lender at all times, including on the DLA landing page, in offers and in all loan documentation.

5. Engagement of Lending Service Providers

5.1 Due diligence before engagement

Enhanced due diligence is conducted and documented before any LSP is engaged, covering at minimum: constitution, ownership and management; technical and operational capability; data-protection and cyber-security posture (including certifications, storage locations and sub-processors); financial soundness; conduct and litigation history; adverse regulatory or law-enforcement action; existing lender relationships; and the specific device permissions and data fields the DLA proposes to collect. The due-diligence template is at Annexure B.

5.2 Mandatory terms of the LSP agreement

• The LSP acts solely as the agent of the Company and shall not represent itself as a lender;
• prohibition on collecting any fee, charge or commission from the borrower – all LSP remuneration is paid by the Company;
• prohibition on the flow of loan disbursement or repayment monies through any account of the LSP or any third party (Section 10);
• compliance with device-permission restrictions, consent architecture, data-storage localisation and DPDP obligations (Sections 6 and 12);
• display of the Company's name and the Nodal Grievance Redressal Officer's details on the DLA and its website;
• adherence to the Fair Practices Code and the Company's Recovery SOP, including contact-hour norms and the prohibition on harassment;
• audit and inspection rights for the Company, its internal and statutory auditors and the Reserve Bank of India, including access to LSP premises, systems and records relating to the Company's business;
• breach-notification obligations, business-continuity commitments, exit-management and data-deletion obligations with certificates;
• no sub-contracting of any regulated activity without the Company's prior written consent;
• indemnity, termination for conduct breach, and consequences including suspension of sourcing.

5.3 Public disclosure of LSPs

The Company shall publish and keep current, in a dedicated digital-lending section of its website, the list of all LSPs engaged by it, the DLAs operated by or through them, the products offered on each, and the roles performed by each LSP in the customer journey. The same disclosure is mirrored on each DLA.

5.4 Multi-lender platforms

Where a DLA of an LSP facilitates loans from multiple lenders, the Company shall satisfy itself, on an ongoing basis, that the platform provides the borrower a digital view of all offers from willing lenders matched to the borrower's request, presented in a consistent, unbiased manner – with the name of each lender, the amount, tenure, APR and other key terms displayed so that a like-for-like comparison is possible, and without any favoured placement, dark patterns, default pre-selection or deceptive design that steers the borrower to a particular lender. Any such platform must include the Company's offer wherever the Company is willing to lend. Non-conformity is a ground for suspension of the arrangement.

6. Customer Onboarding, Consent and Device Permissions

• KYC is completed as per the RBI KYC Master Direction, using Aadhaar offline verification/DigiLocker, PAN validation, Video-KYC (V-CIP) and CKYC, through authorised service providers under written agreements. Biometric data is not stored by the Company or any LSP.
• Consent is obtained granularly and per purpose – separately for KYC verification, credit-bureau enquiry, Account Aggregator access, bank-statement analysis, e-sign and e-mandate registration – by clear affirmative action, with date-and-time-stamped, tamper-evident logs. Bundled or blanket consent is prohibited.
• The borrower must be given the option to accept or deny consent for use of specific data, to restrict disclosure to third parties, to revoke previously granted consent, and to require deletion of data collected – subject to statutory retention.
• Device permissions: DLAs shall not access mobile phone contacts, call logs, telephony functions, the media gallery or files. Access to the camera, microphone and location is permitted only on a one-time, need-based basis for onboarding/KYC purposes, with explicit consent, and must be capable of being denied or subsequently revoked through device settings without the borrower losing access to servicing functions already availed.
• Every consent notice is presented in clear, plain language, independently understandable, in English and – on request – in the borrower's preferred language, and is retained for a minimum of seven years.
• No data shall be collected that is not necessary for the specified purpose; application forms and API scopes are reviewed at least annually to remove non-essential fields.

7. Credit Assessment and Responsible Lending

• Before every sanction, the Company shall capture and record a minimum assessment of the borrower's age, occupation and income, together with a credit-bureau enquiry and, where consented, analysis of bank-statement or Account Aggregator data. Automated decisioning is permitted only within board-approved rules; the rationale and inputs of every decision are logged and retrievable for audit.
• Repayment capacity, not collateral or coercive recovery, is the basis of lending. Loan amount and tenure shall be calibrated to assessed disposable income; the Board sets maximum obligation-to-income thresholds in the Credit Policy.
• Existing indebtedness of the applicant, including live loans of a similar short-tenure nature reported by CICs, is examined; the Company shall not extend a fresh short-term loan where the aggregate obligation would exceed the board-approved threshold.
• Credit limits shall be increased only upon the borrower's explicit request and after fresh evaluation – never automatically or unilaterally.
• Algorithmic and model-based decisioning is subject to periodic validation for accuracy, stability and absence of unlawful discrimination, and to algorithmic due diligence where the Company is notified as a Significant Data Fiduciary.

8. Additional Guardrails – Short-Term (30-Day / "Payday" Type) Loans

Why enhanced safeguards apply to this product

Short-tenure, small-ticket digital credit carries elevated conduct risk: even modest absolute fees translate into a high APR, and repeat borrowing can produce debt cycles. The Board therefore adopts the following guardrails in addition to all other provisions of this Policy. These are Board commitments and, where stricter than regulation, are to be treated as binding internal standards.

• APR prominence: the KFS shall display the APR prominently and, in the digital journey, the total amount repayable in rupees shall be shown on the same screen as the loan offer, before acceptance. Marketing shall not quote a daily or monthly rate without the equivalent APR displayed with equal prominence.
• No automatic rollover or evergreening: the Company shall not roll over, renew or refinance a short-term loan automatically. Any subsequent loan is a fresh credit decision requiring a fresh application, fresh assessment, fresh KFS and a fresh consent trail, and shall not be sanctioned merely to repay an existing loan of the Company.
• Repeat-borrowing controls: the Credit Policy shall specify a maximum number of consecutive short-term loans to the same borrower within a rolling twelve-month period and a cooling gap between closure of one such loan and sanction of the next; breaches require documented senior-management approval and are reported to the Committee.
• Charge cap discipline: total charges (excluding statutory taxes and contingent penal charges) on a short-term loan shall not exceed the ceiling set by the Board in the Credit Policy, and all such charges must appear in the KFS.
• Cooling-off: as per Section 9, with the Board adopting a uniform three-day cooling-off across channels and tenures for this product.
• Penal charges on this product are levied on the overdue amount only, are not capitalised and do not compound; the quantum is reviewed annually by the Board for reasonableness relative to loan size.
• Vulnerability screening: where the journey discloses indicators of financial distress (e.g., repeated mandate failures, multiple recent enquiries, borrowing solely to repay existing debt), the application shall be routed for manual review rather than automated approval.

9. Key Facts Statement, Cooling-Off and Documentation

• Before execution of the loan contract, the borrower shall be provided a KFS in the RBI-prescribed format, containing the sanctioned amount, tenure, interest rate and APR, the repayment schedule, all fees and charges (including penal charges and pre-payment terms), details of the cooling-off period, the recovery mechanism and recovery-agent norms, and the contact details of the Nodal Grievance Redressal Officer. Anything not disclosed in the KFS shall not be charged at any stage without the borrower's explicit consent.
• The KFS carries a validity period of at least three working days for loans of tenor seven days or more, and one working day for shorter tenors, within which the borrower may accept the terms.
• Cooling-off period: the borrower may exit the loan by repaying the principal and the proportionate APR, without any penalty, within a period of not less than one day for loans of tenor below seven days and three days for loans of tenor of seven days or more. The Company adopts three days from the date of disbursal as its uniform standard.
• On execution, digitally signed copies of the KFS, loan agreement/summary, sanction letter, the privacy policies of the Company and the LSP, and details of the recovery mechanism and grievance officer are automatically delivered to the borrower's registered email and/or SMS.
• Loan documents may be executed by Aadhaar e-Sign or other legally valid electronic signature under the Information Technology Act, 2000, with a preserved audit trail.

10. Disbursement, Repayment and Fee Flows

• Disbursement is made directly into the borrower's bank account, verified through penny-drop or penny-less validation, by electronic transfer. Disbursal to any account of an LSP, agent, employee or other third party is prohibited, save for statutorily permitted disbursals to an identified end-beneficiary for a specified end-use.
• Repayment is received directly into the Company's designated bank account through e-NACH/UPI Autopay mandate, NEFT/IMPS/UPI or the Company's payment gateway/payment link, with the payee always displaying as "Girdhar Finlease Private Limited". No pass-through, pool or nodal account of an LSP shall be used for borrower repayments.
• No fee, charge or commission payable to an LSP shall be collected from the borrower. All LSP remuneration is settled by the Company directly under the LSP agreement.
• Where cash is unavoidably received on a delinquent account, it is receipted through the system, deposited into the Company's bank account the same working day, and kept within the limits of the Income-tax Act, 1961.
• Reconciliation of disbursement and collection flows against LSP records is performed daily by Operations, with exceptions escalated within 24 hours.

11. Interest, Fees and Transparency

• The Board approves the interest-rate model and gradation of risk, and the range of rates and charges for each digital product; these are published on the Company's website along with the approach to gradation of risk.
• Rates shall not be excessive and shall bear a reasonable relationship to the cost of funds, risk premium, operating cost and margin, and are reviewed at least annually.
• All charges are disclosed in the KFS and in the tariff card published on the website and every DLA. Contingent charges (penal, bounce, foreclosure) are separately disclosed and excluded from APR computation, as prescribed.
• The Company shall not levy any charge that has not been disclosed to the borrower in advance, nor increase charges retrospectively.

12. Data Governance, Storage and Privacy

• All data collected by the Company, its LSPs and DLAs in the digital lending journey shall be stored on servers located in India. Where any component of processing occurs outside India, the authoritative copy resides in India and offshore retention is not permitted beyond what regulation allows; vendor residency is verified at onboarding and re-verified half-yearly.
• Data collection is limited to what is necessary for the stated purpose; the Company maintains a Record of Processing mapping each data field to purpose, lawful basis, system, processor, storage location and retention period.
• Personal data is processed in accordance with the Company's Privacy Policy, Data Storage and Sharing Policy. Breach handling follows the DPDP Rules (intimation to affected data principals without delay; detailed report to the Data Protection Board within 72 hours) and CERT-In/RBI reporting timelines.
• The borrower may seek access, correction, erasure and withdrawal of consent through the DLA or the Data Protection Officer; requests are actioned within published timelines and flow down to processors.
• No customer data shall be used for any purpose beyond the consented purposes, and shall not be used for training third-party artificial-intelligence models unless expressly permitted in writing under contract with appropriate safeguards.

13. Technology, Security and DLA Standards

• Every DLA shall meet the Company's minimum technology standards: encrypted transport (TLS 1.2+), encryption at rest, secure authentication and session management, protection against common application vulnerabilities, and no storage of credentials or OTPs in plain text.
• Vulnerability assessment and penetration testing of each DLA at least annually and after material change, with closure of findings tracked by the Committee.
• Access to production data is role-based, least-privilege, MFA-protected and logged; logs are retained for a minimum of one year.
• Change management, source-code control and secure SDLC practices apply to the Company's own apps and are required by contract of LSPs.
• Business continuity and disaster recovery arrangements are documented and tested at least annually, including for LSP-operated DLAs, with defined recovery objectives.
• The DLA shall clearly display the Company's name, logo and NBFC registration status, the LSP's identity and role, links to this Policy summary, the Privacy Policy, the tariff card, the LSP list, the grievance mechanism and the RBI CMS and Sachet portals.

14. Default Loss Guarantee (DLG) Arrangements

• The Company may enter into DLG arrangements only under a Board-approved framework and only with eligible counterparties permitted under the RBI Guidelines on Default Loss Guarantee in Digital Lending, supported by an explicit, legally enforceable written contract.
• Total DLG cover on any outstanding portfolio identified upfront shall not exceed five per cent of the amount of that loan portfolio, and shall be in the permitted forms (cash deposit, fixed deposit with lien, or bank guarantee).
• DLG shall not substitute for credit appraisal: the Company continues to underwrite each loan on its own credit standards, and DLG-backed portfolios are subject to the same recognition of non-performing assets and provisioning as any other portfolio.
• The Company shall invoke DLG within the prescribed timeline from the loan becoming overdue, maintain the prescribed disclosures on its website regarding DLG-covered portfolios and the identity of DLG providers, and report DLG arrangements to the Board quarterly.
• Any structure that has the effect of transferring credit risk beyond the permitted DLG limits, or of allowing an LSP to bear or share credit risk outside the framework, is prohibited.

15. Recovery in the Digital Lending Journey

• Recovery is governed by the Company's Internal SOP for Recovery, which applies equally to in-house teams, LSPs and empanelled recovery agents.
• At or before the time of first contact by a recovery agent, the Company shall communicate to the borrower – through the DLA, SMS and/or email – the name and contact details of the recovery agent or agency authorised to approach them.
• Contact is permitted only between 08:00 and 19:00 hours; harassment, intimidation, threats, obscene language, public shaming, disclosure of the debt to unconnected third parties, and misuse of any contact data are absolutely prohibited and constitute grounds for termination of the agent and disciplinary action.
• The recovery mechanism and the escalation route for recovery-related complaints are disclosed in the KFS and on the DLA.
• The Company monitors recovery conduct through call recordings, mystery checks and complaint analysis; recovery-conduct complaints receive priority handling.

16. Grievance Redressal

The Company has appointed a Nodal Grievance Redressal Officer (NGRO) to deal with digital lending and LSP-related complaints. Name: Mr. Sudhakar; Email: grievance@girdharfinlease.com; Phone: 9899719995; Address: A-27 3rd Floor, Sector-03, Noida, Gautam Buddha Nagar, Uttar Pradesh – 201301. Customer support for the digital journey: info@30daysloan.com.

• The NGRO's name, designation, email, telephone number and address are displayed prominently on the Company's website, on every DLA, on each LSP's website, and in the KFS.
• Complaints received on any DLA or LSP channel are routed to the Company's complaint-management system and tracked to closure; GFPL is responsible for resolving complaints against its LSPs and agents.
• If a complaint is not resolved within 30 days, the borrower may lodge a complaint on the RBI Complaint Management System (https://cms.rbi.org.in) under the Reserve Bank – Integrated Ombudsman Scheme, 2021, or with the Centralised Receipt and Processing Centre, RBI, 4th Floor, Sector 17, Chandigarh – 160017 (toll-free 14448). Information on unauthorised lending apps may be reported on the RBI Sachet portal (https://sachet.rbi.org.in).
• Complaint MIS – volumes, categories, ageing, root causes and Ombudsman cases – is placed before the Committee monthly and the Board quarterly.

17. Credit Information Reporting

All loans sourced digitally, irrespective of tenure or amount, are reported to all Credit Information Companies with which the Company is a member, in the prescribed frequency and format, including closure and settlement status. Corrections attributable to the Company are effected within statutory timelines, with compensation paid where prescribed. Borrowers are informed in the KFS that their credit conduct will be reported and may affect their credit score.

18. Advertising, Marketing and Customer Communication

• No advertisement or communication shall be misleading, exaggerate approval certainty, promise guaranteed disbursal irrespective of eligibility, obscure the cost of credit, or use urgency-based dark patterns.
• All creatives, landing pages and DLA copy – including those of LSPs – require Compliance vetting before release; a record of approved creatives is maintained.
• The Company's name as lender and its NBFC status are stated in all customer-facing communication; LSP branding shall not obscure the identity of the lender.
• Promotional communications are sent only with separate consent and honour opt-out and telecom preference regulations; transactional and regulatory communications are always delivered.

19. Outsourcing Risk, Continuity and Exit

Digital lending arrangements are outsourcing arrangements and are governed additionally by the Company's Outsourcing Policy. Material arrangements require Board or Committee approval, are recorded in the outsourcing register, and carry documented exit plans covering portability of the loan book, migration of servicing, transfer or deletion of data with certificates, and continuity of grievance redressal. Concentration risk arising from dependence on a single LSP or technology provider is assessed at least annually. Outsourcing does not diminish the Company's obligations to its borrowers or to RBI.

20. Monitoring, Audit and Reporting

21. Non-Compliance and Consequence Management

Breach of this Policy by an employee attracts disciplinary action up to and including termination. Breach by an LSP, DLA operator or recovery agent attracts consequences under the applicable agreement, including suspension of sourcing, withholding of fees, indemnity claims and termination, and where warranted, reporting to law-enforcement or regulatory authorities. Repeat conduct failures are escalated to the Board.

22. Policy Review

This Policy shall be reviewed by the Board at least annually and earlier upon material regulatory change, supervisory feedback, launch of a new digital product or channel, or a significant conduct or data incident. This Policy takes effect from 10.04.2026 upon Board approval.

Annexure A – Website and DLA Disclosure Checklist

The following must be present, current and easily accessible in the dedicated digital-lending section of the Company's website and, as applicable, on every DLA. Compliance verifies quarterly and records the verification.

Annexure B – LSP / DLA Due-Diligence Checklist

Due diligence is refreshed annually, and immediately upon any change in ownership, technology stack, hosting location, sub-processor or conduct incident. Findings and the approval decision are recorded and placed before the Digital Lending Oversight Committee.