SUMMARY OF PRINCIPAL UNDERTAKINGS
This summary is provided for convenience only and does not substitute for the full text of this Policy.
The Company collects only such personal data as is necessary to enable a Data Principal to prepare for an application for business credit, namely account details, business details and documents voluntarily uploaded.
The Company does not sell personal data.
The Company does not disclose documents or personal data to any bank, lender, scheme authority or other third party except with the explicit, prior and specific consent of the Data Principal, or as required by law.
A Data Principal may access, correct and erase personal data, and may withdraw consent, at any time in the manner prescribed in this Policy.
BizPrep is a preparatory platform. The Company is not a bank, a non-banking financial company or a lender, and it does not adjudicate or guarantee any credit application.
1. INTRODUCTION AND SCOPE
BizPrep is a loan-readiness and compliance platform for micro, small and medium enterprises, and for Chartered Accountants and Chartered Accountancy firms, operated by Shridhi NextGen Ventures LLP, a limited liability partnership (LLPIN: ADC-5478) having its registered office at 704, 7th Floor, T-28, Lotus Panache, Sector 110, Maharishi Nagar, Gautam Buddha Nagar, Noida, Uttar Pradesh, India, 201304 (hereinafter the "Company", "BizPrep", "we", "us" or "our").
For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules framed under it, the Company acts as the "Data Fiduciary" in respect of the personal data that it collects from users of the Platform, save that, in respect of client information entered by Chartered Accountants, the Company acts jointly with the relevant Chartered Accountant as set out in Clause 9.
This Policy applies to the BizPrep website, mobile and web application, and every other service of the Company that refers to this Policy (collectively, the "Platform"). By registering for or using the Platform, the user acknowledges that he or she has read this Policy.
2. DEFINITIONS
In this Policy: "Data Principal" means the individual to whom the personal data relates, and includes a user of the Platform; "Personal Data" means any data about an individual who is identifiable by or in relation to such data; "Processing" has the meaning assigned in the DPDP Act; "Bizi" means the artificial-intelligence assistant forming part of the Platform; "BizVault" means the Platform dashboard made available to Chartered Accountants; and "CA" means a Chartered Accountant or a Chartered Accountancy firm using the Platform.
3. PERSONAL DATA COLLECTED
The Company may collect and process the following categories of Personal Data:
(a) Account information
Name, email address and mobile number;
Business name and the user’s capacity (business owner or CA/advisor);
Authentication credentials, being a password retained only in salted, hashed form; and
Where the user elects to sign in through Google, the name and email address furnished by Google, and no other Google account data.
(b) Business information
Udyam registration number as furnished by the user;
GSTIN and publicly available GST filing particulars;
Business constitution, sector, location, turnover range and credit requirement as entered by the user; and
Self-declared credit information, such as an approximate CIBIL score range.
(c) Documents uploaded by the user
Bank statements, GST returns, income-tax returns, financial statements and similar business documents; and
Identity documents such as the Permanent Account Number and Aadhaar. In the case of Aadhaar, only the masked form is stored by the Company.
(d) Bizi interactions
Queries submitted to Bizi, the responses generated, and any document text shared within the conversation.
(e) Payment information
Payments are processed by Razorpay. The Company receives confirmation of payment, the plan purchased and the amount paid. The Company does not receive or store card details, UPI PINs or net-banking credentials.
(f) Technical and usage information
Features used, device and browser type, IP address, session identifiers and error logs.
(g) Contact details obtained at events and through outreach
Contact particulars and responses furnished at trade fairs, events, webinars or in surveys.
(h) Client information entered by CAs
Information relating to a CA’s clients entered into BizVault, as described in Clause 9.
The Company does not knowingly seek Personal Data that is unnecessary for the purposes stated in this Policy. Users are requested not to upload material that is not required for the preparation of a credit application.
4. PURPOSES AND LEGAL BASIS OF PROCESSING
The Company processes Personal Data on the basis of the consent of the Data Principal, and for such legitimate uses as are recognised under the DPDP Act, for the following purposes:
creation and administration of the user’s account;
verification and analysis of documents (BizDocs), matching with government schemes (BizSchemes), computation of the readiness score (BizScore), preparation of a roadmap (BizMap) and preparation of application material (BizApply);
responding to queries through Bizi;
processing of payments and issue of receipts;
transmission of service communications, including reports, password resets and security notices;
maintenance of the security of the Platform, correction of errors and prevention of fraud;
compliance with applicable law; and
transmission of product updates and promotional communications, solely where the user has opted in and subject to withdrawal of such consent at any time.
Consent is sought through a clear notice stating the Personal Data to be processed and the purpose of processing. Where consent is sought for the use of artificial-intelligence features, the Company maintains a record of the version of the notice accepted. Withdrawal of consent shall be as easy as the giving of it.
The Company does not use documents uploaded by users to train artificial-intelligence models. Such documents are processed solely for the purpose of providing the document-analysis and related services of the Platform to the user. Any change to this position shall be made only upon obtaining the separate consent of the Data Principal.
5. DISCLOSURE OF PERSONAL DATA
Lenders, banks and scheme portals. Personal Data is disclosed to such persons only upon the explicit and specific consent of the Data Principal, after the Data Principal has been informed of the recipient and the data to be disclosed. Refusal of consent shall not prevent use of the remainder of the Platform.
Chartered Accountants. Where a user invites a CA, or a CA adds a user, the CA may access the information described in Clause 9.
Service providers. Personal Data may be made available to service providers who process it on behalf of the Company under written agreements and solely on the Company’s instructions, as listed in Clause 6.
Legal requirement. Personal Data may be disclosed where required by law or in compliance with a lawful order of a court or competent governmental authority.
Business transfer. In the event of a merger, acquisition, reconstitution or sale of the business, Personal Data may be transferred to the successor, which shall be bound to observe this Policy. Data Principals shall be notified in advance.
The Company does not sell Personal Data.
6. THIRD-PARTY SERVICE PROVIDERS
The Company engages the following categories of service providers:
Service Provider | Function | Data Involved |
Razorpay | Payment processing | Payment details (retained by the gateway and not by the Company) |
Google (Gemini API, paid tier) | Document analysis and operation of Bizi | Document text and messages necessary for the requested task |
Replit | Hosting and storage | All stored data, encrypted as described in Clause 11 |
Google Sign-In (optional) | Authentication | Name and email address |
7. ARTIFICIAL-INTELLIGENCE FEATURES
Bizi and certain document-analysis functions employ artificial intelligence. Such systems may produce errors. Their output constitutes guidance only, and does not constitute legal, tax, financial or professional advice or any assurance of loan approval. Users should verify material particulars with their Chartered Accountant or the relevant lender.
Data transmitted to the AI provider is limited to that necessary for the task requested, and the provider is contractually restrained from using such data to train its models.
8. COOKIES
The Platform uses only essential cookies that are necessary to maintain a logged-in session. The Company's website may use Google Analytics to count visits and understand which pages are read. Analytics cookies are enabled only after the user has accepted them through the cookie banner, and can be withdrawn at any time through the cookie settings. The Platform does not use advertising cookies.
9. CHARTERED ACCOUNTANT AND ADVISOR ACCOUNTS
A CA using BizVault undertakes that he or she has obtained the necessary permission from each client before entering that client’s information into the Platform.
A CA may view only those clients whom he or she has added, or who have invited him or her.
Client information entered by a CA remains associated with that client. Upon a client’s request for erasure, the Company shall erase the data and the CA shall cease to have access to it.
A CA’s access terminates upon removal by the client or closure of the CA’s account.
In respect of client information entered by a CA, the Company and the CA act jointly as Data Fiduciaries, each determining the purpose and means of processing in conjunction with the other. The CA is responsible for giving notice to, and obtaining the consent of, his or her clients, and the Company is responsible for the security and lawful processing of such information on the Platform, in each case in accordance with the DPDP Act.
10. RETENTION OF PERSONAL DATA
Personal Data is retained only for so long as is necessary for the purpose for which it was collected, or as required by law, in accordance with the following schedule:
Category of Data | Retention Period |
Account details | For the duration of the account and for 30 days following deletion |
Uploaded documents (bank statements, GST and KYC documents) | For the duration of the account or until deleted by the user; erased within 30 days of account deletion |
Generated reports and scores | For the duration of the account; deleted together with the account |
Bizi conversation history | 90 days, or until deleted by the user |
Payment and invoice records | 8 years, as required by applicable tax and accounting law |
Event and survey contacts | Until the Data Principal so requests, or 24 months from the last contact |
Security and error logs | 12 months |
Limited information may be retained for a longer period where required by law or where necessary for the establishment, exercise or defence of legal claims.
11. SECURITY SAFEGUARDS
The Company implements reasonable security safeguards, including:
transmission of data over HTTPS using TLS 1.2 or higher;
multi-layered encryption of stored data;
role-based access control, with access to documents restricted to authorised personnel and recorded in logs;
storage of passwords in hashed form and never in plain text;
restriction of access by interns and part-time personnel to that which their work requires, and their being bound by obligations of confidentiality; and
periodic review of security measures.
In the event of a personal data breach affecting a Data Principal, the Company shall notify the Data Protection Board of India and the affected Data Principal in the manner and within the time prescribed by law.
No system is wholly secure. Users are responsible for maintaining the confidentiality of their login credentials.
12. RIGHTS OF DATA PRINCIPALS
Subject to the DPDP Act and the rules thereunder, a Data Principal has the right to:
obtain a summary of the Personal Data processed and the processing activities undertaken;
seek correction, completion and updating of inaccurate or incomplete Personal Data;
seek erasure of Personal Data and closure of the account, unless retention is required by law;
withdraw consent at any time, without affecting the lawfulness of processing undertaken before withdrawal, it being acknowledged that certain features may thereupon cease to function;
nominate another individual to exercise these rights in the event of death or incapacity; and
have grievances redressed by the Grievance Officer and, if unsatisfied, to approach the Data Protection Board of India.
Requests may be addressed to contact@shridhinextgenventures.in. The Company shall respond within 30 days of receipt.
13. CHILDREN
The Platform is intended solely for persons who have attained eighteen years of age. The Company does not knowingly process the Personal Data of any person below that age. Where it is brought to the Company’s notice that such data has been furnished, the Company shall erase it.
14. STORAGE AND CROSS-BORDER TRANSFER
Personal Data is stored on servers located in India.
15. AMENDMENTS TO THIS POLICY
The Company may amend this Policy from time to time. In the case of a material change, registered users shall be notified by email and by notice within the Platform before the change takes effect. The Effective Date stated at the head of this Policy denotes the date of the latest revision.
16. GRIEVANCE OFFICER AND CONTACT
Queries, requests and grievances relating to this Policy may be addressed to:
Particular | Details |
Grievance Officer | Nikhita Shanker, Partner |
contact@shridhinextgenventures.in | |
Postal address | Shridhi NextGen Ventures LLP, 704, 7th Floor, T-28, Lotus Panache, Sector 110, Maharishi Nagar, Gautam Buddha Nagar, Noida, Uttar Pradesh, India, 201304 |
Response time | Acknowledgement within 48 hours; resolution within 30 days |
17. GOVERNING LAW AND JURISDICTION
This Policy shall be governed by and construed in accordance with the laws of India. Subject to any rights of the Data Principal under law, the courts at Noida, Uttar Pradesh shall have jurisdiction in respect of any dispute arising out of this Policy.