Privacy Policy This Privacy Policy applies to "HamrahGhar-Safe easy loan", a digital lending product operated by Punjab Rural Support Programme ("PRSP", the "Company", "we", "us" or "our"). Punjab Rural Support Programme is a company limited by guarantee and not having share capital, incorporated under the Companies Ordinance, 1984, as re-enacted by the Companies Act, 2017. The Company operates under License No. SECP/LRD/14/PRSP/2022 and provides microfinance-related investment finance services in accordance with applicable laws and regulatory requirements. This Privacy Policy explains how we collect, use, store, protect, disclose and manage personal information when you access or use HamrahGhar-Safe easy loan, our official website www.punjabrural.com, and any related digital services. By registering, accessing or using our Application or services, you confirm that you have read, understood and agreed to this Privacy Policy. If you do not agree with this Privacy Policy, please stop using the Application and related services. 1. Scope of this Privacy Policy This Privacy Policy applies to all users, applicants, borrowers, visitors and other persons who access or use our Application, website, customer service channels or related services. This Policy explains: • what personal information we collect; • why we collect such information; • how we use and protect your information; • when we may share information; • how long we retain information; • your rights regarding your personal information. 2. Information We Collect We collect personal information only where it is lawful, necessary, reasonable and relevant to the provision of loan services, account management, identity verification, risk control, fraud prevention and compliance obligations. 2.1 Information Provided by You When you register, apply for a loan, update your account, contact customer service or use our services, we may collect: • full name; • CNIC or other identity document information; • date of birth; • gender; • residential address; • mobile phone number; • email address; • employment and income information; • bank account or wallet account information; • username, password and account registration information; • identity document images; • selfie, facial image or liveness verification data; • loan application information; • repayment and transaction information; • any other information you voluntarily provide to us. 2.2 Information Collected Automatically When you use the Application or website, we may automatically collect certain technical and usage information, including: • device model; • operating system and version; • device identifier; • IP address; • mobile network information; • browser type; • language settings; • time zone; • login time and usage logs; • pages or functions accessed; • error logs and service performance information. This information is used to maintain service security, improve system stability, prevent fraud, conduct internal analysis and enhance user experience. 3. Device Permissions and Information We May Access To provide secure, efficient and personalized loan services, the Application may request access to certain device permissions or collect device-related information. We will only collect and use such information within the scope necessary for providing our services, risk control, account security, fraud prevention, credit assessment and service improvement. 3.1 Approximate Location Information Depending on the services you use and your application or device permission settings, we may collect approximate location information from your device. Such information may be used for credit risk assessment, risk scoring, service area verification, fraud prevention and account security checks. We undertake that we will not collect your geographic location data when you are not using the Application. You have the right to disable location services on your device at any time according to your own preference. Unless otherwise permitted under this Privacy Policy or required by applicable laws, we will not disclose your location information to any unrelated third party. 3.2 Camera Permission When applying for a loan, you may need to use your device camera to scan or capture your CNIC document. After the photo is taken, certain relevant information may be automatically filled in to reduce manual input errors and save your time. To protect the security of your loan account and verify that the application is submitted by you personally, we may also require a live photo or facial verification image. We may collect and ask you to upload CNIC photos and real-time facial photos. Uploaded photos will be used only for identity verification, loan application review, fraud prevention and loan approval purposes. When camera permission is requested, we will ask for your consent again. 3.3 IDFA / Advertising Identifier To provide more personalized financial product recommendations and advertising content, and to measure the effectiveness of advertising campaigns, we may collect your advertising identifier, such as IDFA, where permitted by your device settings and applicable rules. You always retain full control over this permission. You may manage or disable tracking permission through your device settings, for example: Settings > Privacy & Security > Tracking > disable "Allow Apps to Request to Track". Your choice to disable IDFA or advertising tracking will not affect your access to core financial services, such as account inquiry, loan application, transfer, repayment or bill payment functions. 3.4 Device Information We may collect information related to the device you use to access the platform and/or services, including IP address, mobile device type, mobile network information, device operating system and version, and software and hardware attributes. We use such information for internal analysis, system compatibility, service optimization, security protection, fraud prevention, risk control and improvement of user experience. We will not use device information for unrelated purposes without a valid legal basis or your consent. 4. Information from Third Parties Where permitted by law and necessary for providing services, we may receive information about you from third parties, including: • credit bureaus or credit information companies; • banks, wallet providers or payment partners; • identity verification service providers; • fraud prevention and risk control service providers; • regulatory, government or law enforcement authorities; • business partners or service providers supporting our services. Such information may be used for identity verification, credit assessment, fraud prevention, AML/CFT checks, loan review and compliance purposes. 5. Purpose of Using Personal Information We may use your personal information for the following purposes: • to create and manage your account; • to verify your identity; • to process and review loan applications; • to assess creditworthiness and repayment capacity; • to approve, disburse and manage loans; • to generate repayment schedules and repayment reminders; • to process repayments and transaction records; • to provide customer support; • to detect, prevent and investigate fraud or unauthorized activities; • to comply with AML/CFT, sanctions screening and regulatory requirements; • to maintain service security and system stability; • to improve our products, services and user experience; • to communicate important service, legal or account-related notices; • to handle complaints, disputes, audits and legal claims; • to comply with applicable laws, court orders or regulatory requests. We will not use your personal information for purposes unrelated to our services unless we have your consent or a valid legal basis. 6. Cookies and Similar Technologies Our website or Application may use cookies, device identifiers or similar technologies to remember preferences, maintain sessions, improve service performance, analyze usage and enhance security. You may disable cookies through your browser or device settings, but some functions may not work properly if cookies are disabled. 7. Sharing and Disclosure of Information We do not sell your personal information to unrelated third parties. We may share necessary personal information only in the following circumstances: • with banks, wallet providers, payment processors or financial partners for loan disbursement and repayment; • with credit bureaus or credit information companies for credit assessment and reporting; • with identity verification, fraud prevention, data processing, hosting, IT or customer service providers; • with auditors, legal advisers, recovery agents or professional consultants where necessary; • with regulators, government authorities, courts or law enforcement agencies where required by law; • with third parties involved in business restructuring, merger or transfer, subject to confidentiality and legal requirements; • with your consent or according to your instruction. All third-party service providers are required to process information only for authorized purposes and to protect personal information with appropriate safeguards. 8. Data Security We take reasonable technical, administrative and organizational measures to protect your personal information, including: • encrypted data transmission; • secure data storage; • access permission control; • internal authorization management; • confidentiality requirements for personnel; • system monitoring and security review; • protection against unauthorized access, disclosure, alteration or loss. Although we take reasonable measures to protect your information, no electronic transmission or storage system can be guaranteed to be completely secure. We will continue to improve our security practices to protect your personal information. 9. Data Retention We retain personal information only for as long as necessary to fulfill the purposes stated in this Privacy Policy, provide services, manage accounts, comply with contracts, resolve disputes, prevent fraud, conduct audits and meet legal or regulatory requirements. Certain records may be retained for a longer period where required by applicable laws, regulatory rules, AML/CFT obligations, accounting requirements, audit obligations, dispute resolution or legal proceedings. When personal information is no longer necessary, we will delete, destroy or anonymize it in accordance with applicable laws and internal procedures. 10. Data Deletion and Account Closure You may request deletion of your personal information or closure of your account through the Application or by contacting customer service. Before processing your request, we may verify your identity and account status. We may be unable to delete all information immediately if: • you have an outstanding loan or unpaid amount; • there is a pending transaction or unresolved complaint; • the information is required for legal, regulatory, audit or AML/CFT purposes; • the information is needed for fraud prevention or dispute resolution; • deletion would affect our legal rights or obligations. After the relevant retention period expires or the retention purpose no longer exists, we will delete, destroy or anonymize the relevant information. 11. User Rights Subject to applicable laws, you may have the right to: • access your personal information; • request correction of inaccurate or incomplete information; • withdraw consent where processing is based on consent; • request deletion of personal information; • request restriction of processing in certain cases; • object to direct marketing communications; • request account closure; • submit questions or complaints regarding privacy protection. You are responsible for ensuring that the information you provide to us is accurate and up to date. 12. Marketing Communications Where permitted by law and with your consent where required, we may send you service updates, product information, educational content or promotional messages. You may opt out of marketing communications through the available unsubscribe method or by contacting us. However, service-related, repayment-related, account security-related and legal notices may still be sent where necessary. 13. Children and Minors Our services are not intended for minors or persons who do not have legal capacity to enter into a binding contract. We do not knowingly provide loan services to minors. If we discover that information has been provided by a minor without proper legal authority, we may delete such information and restrict the related account. 14. Changes to this Privacy Policy We may update this Privacy Policy from time to time due to changes in law, regulation, technology, business operations or service functions. Updated versions will be published through the Application or official website. Where material changes affect your rights or the way we process your personal information, we may notify you through the Application, website notice, email or other appropriate methods. Your continued use of the Services after the updated Privacy Policy becomes effective means that you accept the revised Policy, unless otherwise required by applicable law. 15. Contact Us If you have any questions, requests, complaints or concerns regarding this Privacy Policy or the handling of your personal information, please contact us through: Product Name: HamrahGhar-Safe easy loan Company Name: Punjab Rural Support Programme Official Website: www.punjabrural.com Email: admin@punjabrural.com License No.: SECP/LRD/14/PRSP/2022 Certificate No.: 0038557 National Tax Number: 2290295-3 We will review and respond to your request within a reasonable time and in accordance with applicable laws and internal procedures.