1. Introduction

This Data Processing Policy ("Policy") explains how Biz by Aroon Fintech ("Biz", "we", "our", or "us") collects, processes, stores, transfers, protects, and manages Personal Data in accordance with applicable data protection laws, including where applicable:

• Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR");

• the UK General Data Protection Regulation ("UK GDPR");

• the UK Data Protection Act 2018;

• applicable data protection and privacy laws in jurisdictions where we operate; and

• other Applicable Laws relating to privacy, confidentiality, cybersecurity, and information security.

​

Biz by Aroon Fintech is operated by Aroon Fintech Private Limited, together with the applicable Aroon Fintech entity providing the Services in the relevant jurisdiction.

​

This Policy should be read together with our Privacy Policy, Cookie Policy, Terms & Conditions, AML/KYC Policy, and other legal notices published on the Platform.

​

2. Scope

This Policy applies to Personal Data processed through:

• https://biz.aroonfintech.com;

• mobile applications;

• customer portals;

• partner portals;

• APIs;

• email communications;

• customer support;

• onboarding processes;

• financing applications;

• KYC/AML verification;

• advisory services; and

• any other Services provided by Biz by Aroon Fintech.

​

It applies to Personal Data relating to:

• customers;

• prospective customers;

• directors;

• shareholders;

• beneficial owners;

• authorised representatives;

• guarantors;

• employees of customer organisations;

• consultants;

• partners;

• suppliers; and

• website visitors.

​

3. Definitions

For the purposes of this Policy:

​

Personal Data means any information relating to an identified or identifiable natural person.

​

Processing means any operation performed on Personal Data, including collection, recording, storage, organisation, use, disclosure, transfer, restriction, deletion, or destruction.

​

Data Subject means the individual to whom the Personal Data relates.

​

Controller means the entity that determines the purposes and means of processing Personal Data.

​

Processor means an organisation that processes Personal Data on behalf of a Controller.

​

Where required by Applicable Law, the relevant Aroon Fintech entity providing the Services shall act as the Controller or Processor, as applicable.

​

4. Categories of Personal Data

Depending on the Services requested, we may process:

• identity information;

• contact details;

• business information;

• employment details;

• financial information;

• banking information;

• transaction history;

• tax information;

• credit information;

• identity verification information;

• KYC documentation;

• AML verification records;

• sanctions screening information;

• device identifiers;

• IP addresses;

• browser information;

• website usage information;

• communication records;

• customer support records;

• electronic signatures;

• authentication data; and

• any other information necessary to provide the Services.

We process only the information reasonably necessary for the stated purposes.

​

5. Purposes of Processing

Personal Data may be processed for purposes including:

• customer onboarding;

• identity verification;

• KYC and AML compliance;

• sanctions screening;

• fraud prevention;

• credit assessment facilitation;

• introduction to Funding Providers;

• transaction management;

• customer support;

• platform administration;

• billing and invoicing;

• service improvement;

• cybersecurity;

• analytics;

• legal compliance;

• regulatory reporting;

• dispute resolution;

• enforcement of contractual rights; and

• legitimate business operations.

​

6. Lawful Bases for Processing

Where GDPR or UK GDPR applies, we process Personal Data only where a lawful basis exists, including:

• performance of a contract;

• taking steps prior to entering into a contract;

• compliance with a legal obligation;

• legitimate business interests;

• consent, where required;

• protection of vital interests; or

• performance of a task carried out in the public interest, where applicable.

​

Where consent is relied upon, it may be withdrawn at any time, subject to legal and contractual obligations.

​

7. Special Categories of Data

Biz by Aroon Fintech does not intentionally collect or process Special Category Personal Data unless:

• required by Applicable Law;

• necessary for establishing, exercising, or defending legal claims;

• explicitly provided by the Data Subject where legally permitted; or

• another lawful basis applies under GDPR or UK GDPR.

Where such data is processed, appropriate safeguards will be implemented.

​

8. Data Sharing

Personal Data may be shared with:

• banks;

• financial institutions;

• Funding Providers;

• insurers;

• professional advisers;

• legal counsel;

• accountants;

• auditors;

• regulators;

• law enforcement authorities;

• identity verification providers;

• payment service providers;

• technology vendors;

• cloud hosting providers;

• cybersecurity providers;

• credit reference agencies;

• fraud prevention agencies;

• members of Aroon Fintech; and

• other authorised service providers.

Data is shared only where necessary, proportionate, and lawful.

​

9. International Data Transfers

As a global business finance marketplace, Biz by Aroon Fintech may transfer Personal Data across national borders.

Where Personal Data is transferred outside the European Economic Area (EEA), the United Kingdom, or another jurisdiction requiring transfer safeguards, appropriate protection measures may include:

• adequacy decisions;

• Standard Contractual Clauses (SCCs);

• UK International Data Transfer Addendum;

• Binding Corporate Rules (where adopted);

• contractual safeguards;

• legally recognised certification mechanisms; or

• other transfer mechanisms recognised under Applicable Law.

​

10. Data Security

We implement appropriate technical and organisational measures designed to protect Personal Data against:

• unauthorised access;

• accidental loss;

• destruction;

• alteration;

• disclosure;

• misuse;

• cyber threats; and

• unlawful processing.

​

Security measures may include:

• encryption;

• access controls;

• multi-factor authentication;

• network security;

• vulnerability assessments;

• security monitoring;

• audit logging;

• secure backups;

• employee training; and

• incident response procedures.

No internet-based system can guarantee absolute security.

​

11. Data Retention

Personal Data will be retained only for as long as reasonably necessary to:

• provide the Services;

• comply with legal obligations;

• satisfy regulatory requirements;

• resolve disputes;

• prevent fraud;

• maintain business records; or

• enforce legal rights.

​

Retention periods may differ depending upon:

• applicable law;

• regulatory obligations;

• contractual requirements;

• litigation holds; and

• legitimate business needs.

​

At the end of the applicable retention period, Personal Data will be securely deleted, anonymised, or otherwise disposed of in accordance with our internal policies and Applicable Law.

​

12. Rights of Data Subjects

Where applicable, Data Subjects may have the right to:

• access their Personal Data;

• request deletion of Personal Data;

• request restriction of processing;

• object to certain processing activities;

• withdraw consent where processing is based on consent;

• request data portability;

• object to direct marketing;

• request human review of certain automated decisions; and

• lodge a complaint with a competent supervisory authority.

These rights are subject to applicable legal limitations and exemptions.

​​

13. Automated Decision-Making

Biz by Aroon Fintech may use automated tools to support fraud detection, identity verification, document validation, eligibility assessments, and operational efficiency.

​

Final financing, underwriting, investment, or lending decisions are generally made by independent Funding Providers, not by Biz by Aroon Fintech.

​

Where solely automated decision-making with legal or similarly significant effects occurs and GDPR or UK GDPR applies, appropriate safeguards will be implemented.

​

14. Data Breach Management

Biz by Aroon Fintech maintains procedures for identifying, assessing, investigating, containing, and responding to actual or suspected Personal Data breaches.

Where required by Applicable Law, we will notify:

• competent supervisory authorities; and/or

• affected Data Subjects,

within the legally prescribed timeframes.

​

15. Data Processors

We engage third-party Processors to provide services including:

• cloud infrastructure;

• payment processing;

• identity verification;

• analytics;

• cybersecurity;

• communications;

• customer support;

• document management; and

• technology services.

All Processors are required to process Personal Data only on documented instructions, maintain appropriate security measures, and comply with applicable contractual and legal obligations.

​

16. Accountability

Biz by Aroon Fintech maintains internal policies, procedures, governance measures, and training programmes designed to ensure compliance with applicable data protection legislation.

​

We periodically review our privacy and information security practices and may update them to reflect changes in law, technology, or business operations.

​

17. Changes to this Policy

We may amend this Policy from time to time to reflect:

• changes in law;

• regulatory guidance;

• operational practices;

• technology;

• business expansion; or

• improvements to our privacy programme.

The latest version will be published on the Platform and will become effective on the stated Effective Date.

​

18. Contact Information

If you have any questions regarding this Data Processing Policy or wish to exercise your data protection rights, please contact:

Data Protection Officer / Privacy Team (where appointed or applicable)

​

Biz by Aroon Fintech

Operated by Aroon Fintech Private Limited, together with the applicable Aroon Fintech entity providing the Services.

​

Email: support@aroonfintech.com

​

Website: https://biz.aroonfintech.com

​

Where required by Applicable Law, details of the relevant local Controller, Data Protection Officer, or EU/UK representative will be made available through the applicable jurisdiction-specific website or legal notice.

​

By using the Platform, you acknowledge that you have read and understood this Data Processing Policy and that your Personal Data may be processed in accordance with this Policy, our Privacy Policy, and Applicable Law.