Privacy Policy.

1. Who we are

BIG LOANS Capital Advisors LLP ("BIG LOANS", "we", "our", "us") is a corporate debt advisory firm based in India, operating through the website bigloans.in. We arrange ₹100 crore-and-above corporate debt mandates for businesses across India.

This Privacy Policy describes how we collect, use, share, and protect personal data when you visit our website, fill out our contact forms, or engage us for debt advisory services. It is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the rules notified thereunder.

For the purposes of the DPDP Act, BIG LOANS acts as the Data Fiduciary in respect of personal data collected through this website and our engagement processes.

2. Personal data we collect

We collect personal data only to the extent necessary to provide our advisory services or to respond to your enquiry. The categories of data we may collect include:

2.1 Identification & contact data

• Full name, designation, company name, business address
• Work email address, mobile number
• City and state where you are based

2.2 Business & transaction data

• Industry, ticket size of debt requirement, facility type, target timeline
• Brief description of your business and the funding need
• Where applicable: financial statements, board resolutions, KYC documents, and other transaction documentation required for arranging the mandate

2.3 Technical & usage data

• IP address, browser type and version, device and operating system information
• Pages visited on our website, time spent, referring page, and similar usage analytics

We do not knowingly collect any sensitive personal data (financial, health, sexual orientation, religious or biometric data) beyond what is strictly required for KYC and the debt mandate.

3. How we collect your data

We collect personal data through:

• Forms on this website — e.g. the contact form, newsletter subscription, or other enquiry forms
• Direct communication — email, telephone, video calls, or in-person meetings during the engagement
• Documentation provided — during due diligence, structuring and documentation phases of an active mandate
• Cookies and similar technologies — see Section 9 below

4. Purposes for which we use your data

We process your personal data for the following specific, lawful purposes:

1. To respond to your enquiry — sending feasibility notes, structuring proposals, indicative lender shortlists.
2. To deliver our advisory services — preparing Information Memoranda, financial models, coordinating with lender credit teams on your mandate.
3. To share with lenders with your explicit consent — under NDA-protected processes, only for the specific transaction you have engaged us on. We do not share your data with lenders for any other purpose.
4. To send relevant communications — newsletters, market updates, and insights (only if you have opted in).
5. To comply with legal obligations — KYC, anti-money-laundering checks, regulatory reporting, and statutory record-keeping.
6. To improve our website and services — usage analytics, A/B testing, performance monitoring.

5. Sharing your data with third parties

BIG LOANS does not sell, rent, or otherwise commercially exploit your personal data. We share your data only with the following categories of third parties, and only as necessary:

• Lenders and financial institutions — banks, NBFCs, AIF credit funds, and credit teams empanelled with BIG LOANS, only with your explicit consent and only in connection with the specific debt mandate you have engaged us on.
• Service providers — IT and hosting providers, professional advisers (legal, accounting), and analytics providers under appropriate contractual confidentiality safeguards.
• Regulatory and statutory authorities — RBI, SEBI, tax authorities, courts, or other government bodies when required by law.
• In a business transaction — if BIG LOANS undergoes a merger, acquisition, or restructuring, your data may be transferred to the successor entity subject to the same protections.

All third parties with whom we share data are bound by contractual confidentiality and data-protection obligations consistent with the DPDP Act.

6. Data retention

We retain personal data only for as long as necessary for the purposes set out in Section 4, or as required by applicable law. Specifically:

• Enquiry data (from contact forms): retained for up to 24 months after the last interaction, unless the enquiry converts into an engagement.
• Engagement / mandate data: retained for the duration of the engagement and for at least 8 years after closure, in compliance with RBI / SEBI / tax record-keeping requirements.
• Newsletter subscribers: retained until you unsubscribe.
• Website analytics data: retained in aggregated/anonymised form for up to 26 months.

After the applicable retention period, we erase or anonymise the data such that you can no longer be identified from it.

7. Security of your data

We implement reasonable security practices and procedures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• HTTPS / TLS encryption for all data transmitted to and from this website
• Access controls (role-based access to client data — only mandate-team members have access to a specific mandate's data)
• Confidentiality agreements with all employees, consultants, and third-party service providers
• Mutual non-disclosure agreements (NDAs) with all clients before sharing data with any lender
• Encrypted storage for sensitive documentation
• Periodic security audits and access reviews

While we take these precautions seriously, no electronic transmission or storage is 100% secure. In the unlikely event of a data breach affecting your personal data, we will notify you and the Data Protection Board of India in accordance with DPDP Act requirements.

8. Your rights under DPDP Act

As a Data Principal under the DPDP Act, you have the following rights in respect of your personal data:

• Right to information — to obtain a summary of the personal data being processed and the processing activities undertaken
• Right to correction and erasure — to request correction of inaccurate or incomplete data and erasure of data no longer needed for the original purpose
• Right to grievance redressal — to have any grievance redressed by BIG LOANS within prescribed timelines (see Section 12 and our Grievance Redressal Policy)
• Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity
• Right to withdraw consent — to withdraw consent at any time, although this does not affect the lawfulness of processing carried out before withdrawal

To exercise any of these rights, write to privacy@bigloans.in. We will respond within the timelines prescribed under the DPDP Act.

9. Cookies and tracking

We use cookies and similar technologies sparingly to provide essential website functionality and basic usage analytics:

• Essential cookies — required for the website to function (e.g. session management). These cannot be disabled.
• Analytics cookies — anonymised website usage data (e.g. pages visited, time spent) to help us improve the site.

We do not use cookies for advertising, retargeting, or third-party tracking beyond standard analytics. You may disable non-essential cookies through your browser settings, which will not significantly impair website functionality.

10. Children's data

Our services are not directed at children. We do not knowingly collect personal data of any person below the age of 18 years. If we become aware that a child has provided us with personal data, we will erase it promptly. Under the DPDP Act, processing of children's personal data is subject to enhanced restrictions, including verifiable parental consent.

11. Cross-border data transfer

BIG LOANS primarily stores and processes personal data within India. To the extent any personal data is transferred outside India (for example, where a foreign lender or service provider is involved in a specific mandate), such transfer is made only:

• With your explicit consent
• To a country/territory not otherwise restricted by the Government of India under Section 16 of the DPDP Act
• Under appropriate contractual safeguards ensuring equivalent protection

12. Contact & grievance redressal

For any questions, concerns, or grievances relating to this Privacy Policy or our handling of your personal data, please contact:

Privacy Officer
BIG LOANS Capital Advisors LLP
Email: privacy@bigloans.in

If you are not satisfied with our response, you may escalate your grievance per our Grievance Redressal Policy or approach the Data Protection Board of India established under the DPDP Act.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. The "Last updated" date at the top of this page indicates when this policy was most recently revised. Material changes will be communicated to existing clients and prominently posted on this page.