I. Overview

This Privacy Policy (“Policy”) is issued by Barwala Leasing and Finance Private Limited (“BLF”), a Non-Banking Financial Company registered with the Reserve Bank of India and incorporated under the Companies Act, which runs its digital lending business under the brand name Cash Boxx. This Policy explains how BLF collects, uses, stores, and discloses the personal information and sensitive personal data of everyone who uses the Cash Boxx website, mobile application, and connected digital services (together, the “Platform”).

This Policy has been drawn up to comply with:

1. Section 43A of the Information Technology Act, 2000, read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
2. the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
3. the Digital Personal Data Protection Act, 2023, and its rules as notified from time to time; and
4. the Reserve Bank of India’s Digital Lending Directions, 2025, and other RBI guidelines issued from time to time.

By visiting or using the Cash Boxx Platform, you agree to the collection, use, and disclosure of your personal information as described in this Policy. If you disagree with this Policy, in whole or in part, please do not use or access the Platform. For any query about this Policy, please write to us at care@cashboxx.in.

II. Definitions

For this Policy, the following terms carry the meanings set out below:

1. “We”, “Our”, “Us” mean Cash Boxx, the digital lending platform of Barwala Leasing and Finance Private Limited.
2. “Platform” means the Cash Boxx website (www.cashboxx.in), mobile application, and every connected digital interface and service.
3. “User”, “You”, “Your” mean any person who visits, accesses, or uses the Cash Boxx Platform.
4. “Personal Information” means any information relating to a natural person that, alone or together with other information reasonably available, can identify that person.
5. “Sensitive Personal Data or Information” (SPDI) means personal information such as financial details, passwords, health records, biometric data, and any other category of information that applicable law treats as sensitive.
6. “Consent” means an explicit, freely given, specific, informed, and unambiguous indication of your agreement to a defined use of your personal data.
7. “Lender” means Barwala Leasing and Finance Private Limited, acting in its capacity as an RBI-registered NBFC when sanctioning and disbursing loans to eligible users through the Cash Boxx Platform. Every lending activity is carried out directly by BLF.

III. Consent

By accessing, registering on, or using the Cash Boxx Platform, you give your explicit, freely given, specific, informed, and unambiguous consent to the collection, processing, storage, use, and disclosure of your personal information and sensitive personal data as this Policy describes. This consent is taken and maintained in line with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the RBI Digital Lending Directions, 2025.

Consent is captured through clear, auditable means, such as OTP-based confirmation, electronic forms, and in-app notifications, depending on the category of data involved. We will not collect or use any personal, financial, or device-level data without your specific and explicit consent for that particular category.

Your consent specifically covers:

1. collecting information needed for credit assessment, KYC verification, and underwriting of loans offered by BLF through the Cash Boxx Platform;
2. one-time access to your device’s camera and microphone, solely for video KYC or e-KYC verification, as RBI guidelines require;
3. access to your credit bureau data, financial SMS metadata, and related information, only after you have given express, recorded consent for each instance; and
4. secure processing of your personal data by Cash Boxx to deliver the services you have requested or availed.

You can withdraw your consent at any time by writing to our Grievance Redressal Officer at gro@cashboxx.in. Please note, however, that:

1. withdrawing consent does not affect the lawfulness of any processing carried out before that withdrawal;
2. withdrawing consent for essential data, such as KYC information or repayment details, may limit your ability to keep using certain services, and it does not remove any obligation arising from an active loan account; and
3. we retain the right to keep processing your data to the extent needed to service an active loan, meet legal or regulatory obligations, or pursue or defend a legal claim.

TO USE ANY CASH BOXX SERVICE, PLEASE MAKE SURE YOU READ, UNDERSTAND, ACKNOWLEDGE, AND UNCONDITIONALLY AGREE TO BE BOUND BY THIS POLICY. IF YOU DO NOT AGREE WITH THIS POLICY, IN WHOLE OR IN PART, PLEASE DO NOT USE, ACCESS, DOWNLOAD, OR INSTALL THE PLATFORM OR ANY PART OF IT.

IV. What We Collect

Cash Boxx collects information from you only to deliver regulated digital lending services in line with applicable Indian law, including the RBI Digital Lending Directions, 2025, and the Information Technology Act, 2000. The categories collected are set out below.

Identity and Contact Information

When you register on or use the Platform, we collect information you provide, such as:

1. full name, date of birth, gender, and photograph;
2. email address, mobile number, and residential address, including postal code;
3. PAN, Aadhaar (masked where applicable), and other KYC documents required under RBI guidelines;
4. employment details and income information; and
5. bank account number and IFSC code, for disbursing and collecting loan repayments.

Financial and Credit Information

For credit assessment and underwriting, we collect:

1. credit bureau reports and scores from authorized credit information companies such as CIBIL, Experian, CRIF High Mark, and Equifax, with your express consent; and
2. financial SMS metadata, used strictly for verification and credit evaluation. We do not read or store your personal messages or any OTP sent by a third party.

Device and Technical Information

When you access the Platform, we collect:

1. your device model, operating system version, and available storage, used solely for fraud detection and secure authentication. We do not collect permanent identifiers such as IMEI numbers;
2. your IP address, browser type, referring or exit URLs, and log data generated when you use the Platform, used for analytics and security;
3. metadata about applications installed on your device, such as application name, package name, install and update time, version name, and version code. This may be collected even when the app is not actively in use, and is used solely for fraud detection, credit underwriting, and offering you the right credit products; and
4. phone state information, limited to confirming the active SIM and network status at the time of onboarding and disbursement, so that we can confirm the transaction belongs to the rightful user.

Location Information

We collect your device’s location, on a one-time basis, to:

1. confirm that your loan application falls within our serviceable area;
2. support address verification and KYC compliance; and
3. improve credit risk assessment and fraud prevention.

We collect location data only with your explicit prior consent, and we do not collect it in the background when the app is not in active use.

Camera and Microphone Access

We request one-time access to your camera to capture KYC documents and a selfie for identity verification. We request microphone access solely to enable two-way communication during video KYC. Your audio during a video KYC session may be recorded to meet regulatory requirements.

Cookies and Log Files

The Platform uses cookies to recognize returning users, keep sessions intact, personalize your experience, and analyze how the Platform performs. Information gathered through cookies is stored securely and treated as confidential. You can decline cookies through your browser settings, though this may limit certain features of the Platform.

Some pages of the Platform may use web beacons alongside cookies to compile aggregated usage statistics, and these may also appear in email communications to measure their effectiveness.

Cash Boxx does not track users across third-party websites and does not allow third-party behavioral advertising tools on the Platform.

What We Do Not Collect

Cash Boxx does not collect or store biometric data. We do not access your contact list or call logs. We do not read your personal messages or any OTP other than the OTP that Cash Boxx itself sends for Platform-related purposes.

V. Why We Collect It

We use the information we collect from you only to:

1. establish your identity and complete KYC verification as the law requires;
2. assess your creditworthiness and process your loan application, including underwriting, risk assessment, and eligibility determination;
3. disburse loan amounts and enable repayment through the appropriate payment channels;
4. operate, maintain, improve, and personalize the Cash Boxx Platform;
5. keep you informed about your account, loan status, repayment schedule, and service updates;
6. send promotional communications and offers, where you have given consent, which you can withdraw at any time;
7. detect, prevent, and investigate fraud, cybercrime, and unauthorized activity;
8. meet legal, regulatory, and statutory obligations under applicable law;
9. resolve disputes, address complaints, and enforce contractual rights; and
10. carry out data analytics to improve our services, understand user behavior, and develop new products and features.

Cash Boxx does not use your personal data for purposes unconnected with the consent you originally gave, unless the law requires it or you give fresh, explicit consent. Cash Boxx does not sell, lease, or trade your personal data under any circumstances.

VI. Who We Share It With

Cash Boxx shares your personal information only where necessary, strictly for the purposes this Policy describes, and under appropriate confidentiality obligations. We do not share your personal data with unrelated third parties for commercial gain.

Your information may be shared with:

1. credit information companies regulated under the Credit Information Companies (Regulation) Act, 2005, such as CIBIL, Experian, CRIF High Mark, and Equifax, for credit assessment;
2. third-party service providers such as e-KYC vendors, e-sign providers, account aggregators, and payment gateways, engaged strictly to deliver the services you have requested;
3. government authorities, regulators, courts, and law enforcement agencies, where disclosure is required by law, court order, or regulatory direction; and
4. technology and device-intelligence partners engaged by Cash Boxx for identity verification, fraud detection, and credit underwriting, subject to appropriate data processing agreements and confidentiality obligations.

Every third party with whom we share your information is contractually bound to use it only for the purpose it was disclosed for, and to apply appropriate security measures to protect it.

We may also disclose personal information:

1. when a court order, statutory authority, government body, or law enforcement agency requires it;
2. to protect the rights, property, or security of Cash Boxx or BLF; or
3. in connection with a merger, acquisition, corporate restructuring, or amalgamation involving BLF, provided the receiving entity remains bound by this Policy with respect to your information.

VII. How We Protect Your Data

Cash Boxx takes the security and confidentiality of your personal information seriously and has put in place appropriate technical, administrative, and organizational measures to guard it against unauthorized access, use, disclosure, alteration, or destruction.

Our security practices include:

1. encrypting all data sent over the internet using SSL or an equivalent protocol;
2. role-based access controls, so that only authorized personnel can access personal data, strictly on a need-to-know basis;
3. regular vulnerability assessments, firewall protection, anti-malware controls, and intrusion detection and prevention systems;
4. OTP-based authentication to protect your account from unauthorized access;
5. application-level encryption and key management for stored data; and
6. separation of environments and segregation of duties, with documented, role-based access controls enforced across all systems.

All data and information we collect from you sits on servers based in India, consistent with the data localization requirements under the RBI Digital Lending Directions, 2025, and other applicable law.

You are responsible for keeping your own account credentials and authentication methods secure. Cash Boxx is not liable for unauthorized use of your account arising from your own failure to protect your credentials.

If a security breach affects your personal data, Cash Boxx will take the steps necessary to stop further misuse and reduce any risk of harm and will make reasonable efforts to notify you electronically so you can protect your interests, in line with applicable law.

VIII. How Long We Keep Your Data

Cash Boxx keeps your personal information only for as long as needed to fulfil the purpose it was collected for, or as applicable law and regulatory obligations require. Specifically:

1. if you have registered on the Platform but have not taken any loan or service, we keep your profile data for six years from your last submission of information or last activity, whichever is later;
2. if you have taken a loan or service through Cash Boxx, we keep your data for ten years from the last date of that service or your last activity, whichever is later; and
3. we may keep data for longer where the law requires it, or to resolve a dispute, enforce a contract, detect or prevent fraud, or meet a regulatory obligation.

We may also retain personal data temporarily in backup systems for disaster recovery or system restoration. Access to such backups is restricted, and deletion is scheduled under Cash Boxx’s internal data retention protocols.

You may ask, in writing, for your personal data to be deleted, by contacting our Grievance Redressal Officer at gro@cashboxx.in. We will only process a deletion request once every active service, transaction, and loan account has been closed. Once we receive a valid deletion request, we will purge or anonymize your data within thirty days, subject to any retention obligation under applicable law.

IX. Your Rights

You have the following rights over the personal data Cash Boxx collects and processes about you:

Access and Correction

You can ask to see the personal information we hold about you and request that we correct anything inaccurate, incomplete, or outdated. If you ask us to change your personal information, we may need supporting documents to verify the change.

Withdrawing Consent

You can withdraw your consent to the collection, use, or disclosure of your personal data at any time by writing to our Grievance Redressal Officer at gro@cashboxx.in. Once we receive a valid withdrawal request, Cash Boxx will stop processing your data for the relevant purpose, except where continued processing is required by law, a regulatory obligation, or to service an active loan.

Deletion

You can ask for your personal data to be deleted, subject to the conditions set out in Section VIII of this Policy. We will not process a deletion request while any service, loan, or transaction account remains active.

Opting Out of Marketing

You can withdraw your consent to promotional communications at any time by writing to us at care@cashboxx.in or using the opt-out option on the Platform. Opting out of marketing does not affect our ability to reach you about your account, loan status, or legal obligations.

Managing Privacy Permissions

You can change the device permissions you have given the Cash Boxx application at any time through your device settings. Please note that restricting some permissions may affect your ability to use certain features or services.

Reporting a Security Incident

You can report any suspected unauthorized use of your personal information to our Grievance Redressal Officer within ten days of becoming aware of it.

X. Links to Other Websites

The Cash Boxx Platform may contain links to third-party websites or applications that Cash Boxx or BLF does not operate or control. These links are provided purely for your convenience, and Cash Boxx does not monitor, endorse, or control the privacy practices, security, content, or terms of use of such third-party platforms.

If you give personal information to a third-party website you reach through the Cash Boxx Platform, that website’s own privacy policy governs it. Cash Boxx disclaims all liability arising from your use of third-party websites or your reliance on information found there. Please review the privacy policy of any third-party platform before sharing your personal or financial information with it.

XI. Children’s Privacy

The Cash Boxx Platform is not meant for anyone under 18 years of age. Cash Boxx does not knowingly collect personal information from minors, and its loan eligibility and KYC process requires documentary age verification at onboarding.

If a parent or guardian believes their child has given personal information on the Platform, please contact us right away at care@cashboxx.in. Cash Boxx will act promptly to delete or anonymize any such information from its systems.

By accessing or using the Cash Boxx Platform, you confirm that you are at least 18 years old and legally eligible to enter into binding contracts under Indian law.

XII. Changes to This Policy

Cash Boxx may amend or update this Policy at any time to reflect changes in applicable law, regulatory requirements, or its own business practices. Amendments will be published on the Cash Boxx Platform and, unless stated otherwise, will take effect immediately on posting. We encourage you to check this Policy from time to time to stay informed of updates.

If you keep using the Cash Boxx Platform after a revision to this Policy, that counts as your acceptance of the revised Policy.

BLF’s management will review this Policy as and when needed. Any change required by a change in applicable law or regulatory requirement will be placed before BLF’s Board of Directors for approval at its immediately following meeting after the change is notified.

XIII. General Provisions

This Policy is governed by, and will be interpreted under, the laws of the Republic of India. Any dispute arising from or connected with this Policy is subject to the exclusive jurisdiction of the courts at Delhi.

If any provision of this Policy is found invalid or unenforceable under applicable law, that provision will be severed, and the rest of the Policy will continue in full force and effect. Where there is any ambiguity or conflict in interpretation, the English version of this Policy will prevail. Section headings are included only for ease of reference and do not affect how the provisions are interpreted.

Nothing on the Cash Boxx Platform amounts to financial, legal, tax, or professional advice. You should independently verify any information and consult the appropriate professional advisor where needed. Cash Boxx/BLF is not liable for any direct, indirect, incidental, consequential, or punitive damage, including lost profit, lost data, or lost business opportunity, arising from or connected with your access to or use of the Platform, or your reliance on any material found on it. Cash Boxx does not promise that the Platform will always be available, error-free, or free of viruses or other harmful elements, and you are responsible for putting adequate safeguards on your own systems before downloading anything from the Platform.

XIV. Grievance Redressal

Cash Boxx has set up a three-level grievance redressal mechanism, as required under applicable law, to handle complaints and queries about how it processes personal data and to resolve any dispute arising from this Policy:

Level 1       Customer Support, Email: care@cashboxx.in, Phone: +91 8796466311

Level 2       Grievance Redressal Officer, Email: gro@cashboxx.in, Phone: +91 8796466411

Level 3       Principal Nodal Officer, Email: pno@cashboxx.in, Phone: +91 8796466440

Working Hours: Monday to Friday, 10:00 AM to 7:00 PM (IST). Website: www.cashboxx.in

We aim to acknowledge and respond to every grievance within 48 to 72 hours of receiving it. If you remain unsatisfied with the resolution offered, you may escalate the matter to the Reserve Bank of India’s Integrated Ombudsman Scheme at https://cms.rbi.org.in, or to any other appropriate regulatory authority.

You may also contact our Grievance Redressal Officer to exercise any of your data rights, including the right to access, correct, update, or ask for deletion of your personal data, subject to the terms of this Policy and applicable statutory obligations.