1. Scope & applicability
This DPDP Compliance Notice describes how BIG LOANS Capital Advisors LLP ("BIG LOANS") complies with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules notified thereunder, in respect of personal data processed in connection with our website (bigloans.in), advisory services, and client engagements.
This notice supplements our Privacy Policy and should be read together with it.
2. Our role as Data Fiduciary
Under the DPDP Act, BIG LOANS acts as a Data Fiduciary — the person who, alone or in conjunction with others, determines the purpose and means of processing of personal data. We collect and process the personal data of clients, enquirers, and website visitors (each a Data Principal) for the purposes described in our Privacy Policy.
When we engage third-party service providers (e.g. IT hosting, analytics, professional advisors), they act as Data Processors under contractual confidentiality and DPDP-compliant data-handling obligations.
3. Key DPDP definitions
For ease of reference, the key terms used in this notice are:
- Personal Data — any data about an individual who is identifiable by or in relation to such data
- Data Principal — the individual to whom the personal data relates (you, the user / client)
- Data Fiduciary — the person who determines the purpose and means of processing personal data (BIG LOANS)
- Data Processor — a person who processes personal data on behalf of a Data Fiduciary
- Significant Data Fiduciary — a Data Fiduciary notified as such by the Central Government, subject to enhanced obligations
- Consent — free, specific, informed, unconditional and unambiguous indication of the Data Principal's wishes
4. Lawful processing & consent
BIG LOANS processes personal data only on the basis of:
- Consent — for personal data collected through forms on this website, newsletter subscriptions, or shared during pre-engagement discussions
- Legitimate uses — for specific purposes recognised under Section 7 of the DPDP Act, including (a) compliance with judgment / decree / order, (b) responding to a medical emergency, (c) compliance with an obligation under law applicable in India
Notice before consent
Before obtaining your consent, we provide notice in clear and plain language describing:
- The personal data we intend to collect
- The specific purpose of processing
- The manner in which you may exercise your DPDP rights
- The manner in which you may make a complaint to the Data Protection Board of India
5. Data Principal rights
As a Data Principal, you have the following rights under the DPDP Act:
Right to information about personal data (Section 11)
You may request a summary of the personal data being processed and the processing activities undertaken in respect of your data, along with the identities of all Data Fiduciaries and Data Processors with whom your data has been shared.
Right to correction and erasure (Section 12)
You may request correction of inaccurate or misleading data, completion of incomplete data, updating of out-of-date data, and erasure of data no longer needed for the original processing purpose (subject to retention required by law).
Right to grievance redressal (Section 13)
You have the right to a readily available means of grievance redressal in respect of any act or omission of BIG LOANS regarding your personal data. See our Grievance Redressal Policy.
Right to nominate (Section 14)
You may nominate any other individual to exercise your DPDP rights in the event of your death or incapacity.
How to exercise these rights
Submit a written request to privacy@bigloans.in. Please include sufficient identification and details for us to act on your request. We will respond within prescribed DPDP Act timelines.
6. Data Principal duties
Under Section 15 of the DPDP Act, Data Principals also have certain duties, including:
- Compliance with applicable laws while exercising rights under the DPDP Act
- Not impersonating another person while providing personal data
- Not suppressing material information while providing personal data
- Not registering false or frivolous grievances
- Furnishing only authentic information when exercising the right to correction or erasure
7. Children & persons with disability
BIG LOANS does not knowingly process personal data of children (under 18) or persons with disability (where a lawful guardian has been appointed). Where such data is processed, we will:
- Obtain verifiable consent of the parent or lawful guardian
- Not undertake tracking, behavioural monitoring, or targeted advertising directed at children
- Not undertake any processing likely to cause detriment to children
8. Data breach notification
In the event of a personal data breach, BIG LOANS will:
- Notify the Data Protection Board of India in the manner and within the timelines prescribed
- Notify each affected Data Principal in the manner prescribed
- Take immediate steps to mitigate the breach and prevent recurrence
9. Cross-border data transfer
BIG LOANS primarily processes personal data within India. Where personal data is transferred outside India (for example, to a foreign lender involved in a specific mandate), we ensure such transfer is to a country/territory not otherwise restricted by the Central Government under Section 16 of the DPDP Act, and under appropriate contractual safeguards.
10. Privacy Officer
BIG LOANS has designated a Privacy Officer responsible for DPDP compliance:
Privacy Officer
BIG LOANS Capital Advisors LLP
Email: privacy@bigloans.in
The Privacy Officer is responsible for receiving grievances, responding to Data Principal requests, and coordinating with the Data Protection Board of India where required.
11. Significant Data Fiduciary obligations
If BIG LOANS is notified as a Significant Data Fiduciary under Section 10 of the DPDP Act (based on volume of personal data, sensitivity, risk to Data Principal rights, etc.), additional obligations will apply, including:
- Appointment of a Data Protection Officer based in India
- Appointment of an independent Data Auditor
- Periodic Data Protection Impact Assessments
- Other measures as prescribed
BIG LOANS will update this notice if and when such obligations become applicable to us.
12. Updates to this Notice
This DPDP Compliance Notice may be updated to reflect changes in law, regulatory guidance, or our practices. The current version is always available at this URL with the "Last updated" date indicated at the top.
13. Grievance & escalation
If you believe BIG LOANS has not complied with its DPDP obligations or has violated any of your rights, you may:
- Contact our Privacy Officer at privacy@bigloans.in
- Escalate the grievance through our Grievance Redressal Policy
- Lodge a complaint with the Data Protection Board of India established under the DPDP Act