Bureau Privacy Policy

When you choose to check or refresh your credit score in Rivo, we request your credit report from Experian Credit Information Company of India Private Limited ("Experian"), a credit information company licensed under the Credit Information Companies (Regulation) Act, 2005 ("CICRA"). This Bureau Privacy Policy explains what we send to Experian, what we receive back, how we use it, and the choices you have.

It supplements Rivo's main Privacy Policy and Terms & Conditions, and applies only to credit information obtained from Experian through Rivo. Everything else we collect, such as SMS, Gmail, bank, contacts, and usage data, is covered by the main Privacy Policy. If the two documents differ on how bureau information is handled, this policy applies to that information.

We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and we handle bureau information in line with the Information Technology Act, 2000, and applicable Reserve Bank of India guidelines.

Checking your credit score is optional, and you decide when it happens.

• A new request to Experian follows your action to check or refresh your score, after we have shown you what the request involves and you have given your consent for it.
• Accepting our Privacy Policy or Terms does not, on its own, start a bureau request.
• Viewing a report that Rivo already holds does not request a new report from Experian.
• Each request is recorded together with the consent and device details associated with it.

Authorized representative. When you give consent for a request, you authorize Rivo, acting through our bureau service provider, to act as your authorized representative for one limited purpose: to share your personal data with Experian and obtain your credit information from Experian on your behalf. You also direct Experian to release that information to us. If you do not give consent, or do not proceed, we make no request and the credit-score feature is not available to you.

You can use the rest of Rivo without ever checking your credit score.

3.1 What we send

To identify you and make the request, we may send your name, mobile number, email address, PAN, and date of birth, together with the consent and device details needed to process the request. These details are conveyed through our bureau service provider.

3.2 What we receive

We receive the Experian score and the report information available for you. Depending on your credit history, this may include:

• credit accounts and their status;
• balances and credit limits;
• repayment history;
• credit enquiries; and
• identifying details held in the report, such as name, address, and contact details.

Experian prepares the report from information supplied to it by credit institutions. Rivo does not control the completeness, accuracy, or timing of those records.

We use your bureau information to:

• show you your credit score and report;
• explain the factors that affect your score and give you credit-management insights;
• show a stored report again when you revisit the feature;
• keep a record of your request and consent, and meet our legal and regulatory obligations.

We use bureau information only for these purposes. We do not sell, rent, copy, or republish it, and we do not use it for advertising, behavioral ad targeting, or marketing lead generation.

Things to keep in mind

• The score and report are shown for your information. They do not guarantee a particular score, credit product, or lending decision.
• Your Experian score can differ from a score issued by another credit bureau, and from the score or report a lender sees when it assesses you, because each bureau holds its own records and uses its own scoring model. Rivo does not guarantee that a lender will see the same information.
• The report reflects what credit institutions have reported to Experian up to the date it was prepared, so recent payments or changes may not appear yet.

Bureau information moves only between the parties needed to deliver the feature:

• Experian receives the identity and consent details needed to find and release your report, and returns the report to us.
• Our bureau service provider conveys that request and response between Rivo and Experian, under confidentiality and data-protection obligations.
• Cloud and infrastructure providers host the data we store, again under confidentiality and data-protection obligations.
• Authorities and courts where the law requires disclosure.

A credit-report request is separate from sharing information with Rivo's Lending Partners. How information is shared if you opt in to borrowing guidance is described in Section 7.3 of the Privacy Policy, and you can stop all partner sharing by opting out of borrowing guidance.

Each of these parties also handles information under its own policies. Experian's handling of your credit information is governed by its own notices and by the law that applies to credit information companies.

Bureau information is stored on servers located in India. It is protected by the same safeguards that apply to the rest of your data: encryption in transit, encryption at rest for sensitive data, role-based access with logging, and regular security reviews. Section 10 of the Privacy Policy describes these safeguards in full.

We keep Experian credit reports and the associated request and consent records only while they are needed for the credit-report service or an applicable legal obligation. Retention is summarised in the schedule in Section 9 of the Privacy Policy.

You can ask us to delete the bureau information we hold. We act on that request within 30 days, except for specific records that a legal hold or retention duty requires us to keep. Deleting your Rivo account also removes your stored bureau information, subject to the same exceptions.

Your consent for a bureau request is free, specific, informed, and unambiguous. It is given for the request you make, and it is separate from your consent to any other Rivo feature.

You can withdraw authorization for future Experian requests at any time by emailing cp@rivo.pe with the subject line "Withdraw Consent — [Your Email]". Once we have processed your request, we make no further Experian requests for you, and features that depend on a current report may stop updating. Withdrawal does not undo processing that was lawful before you withdrew.

Withdrawing consent and deleting data are separate requests. Withdrawing stops future requests only. To also have the report we already hold deleted, say so in the same email, and we will handle it as described in Section 6.

Under the DPDP Act and other applicable laws, you may ask us to:

• Access the bureau information we hold about you;
• Correct details we hold that are inaccurate or incomplete;
• Erase your stored bureau information, subject to applicable retention duties;
• Withdraw consent for future Experian requests; and
• Nominate someone to exercise your rights on your behalf in the event of death or incapacity.

Rivo only holds a copy of what Experian reported. If you believe an entry in your credit report is wrong, for example an account you do not recognise or a repayment recorded incorrectly, the correction has to be made at the source. Rivo cannot change, correct, or remove entries in an Experian report or alter your score. Raise the issue with the lender that reported the entry and with Experian directly, and Experian will investigate and update the report where appropriate. We will help with any request that involves information we hold.

Experian handles credit information under CICRA. By giving consent for a bureau request, you acknowledge that Experian's own terms, and the law that applies to credit information companies, govern what Experian holds and how it releases it.

This policy is an electronic record under the Information Technology Act, 2000, and the rules made under it. It is generated electronically and does not need a physical or digital signature.

We may update this policy as our service or the law changes. When a change is material, we will tell you by email or through a clear notice in the app and update the "Last Updated" date above.

Questions, concerns, or requests about your bureau information go to a real person, and we aim to respond promptly.

If a grievance remains unresolved after our internal process, you may escalate it to the Data Protection Board of India once that body is operational. Our main Privacy Policy sets out the full list of our commitments, and any dispute relating to this policy falls under the exclusive jurisdiction of the courts of Bengaluru, Karnataka.