Privacy policy

1. Who we are, and what we are not

BZi Growth is a technology and origination platform for invoice finance. We act as a Lending Service Provider to banks and NBFCs.

We are not a lender and we are not a regulated financial institution. We hold no RBI licence or registration and need none in this role - the lender holds the licence and makes every credit decision. We are not a participant in any TReDS exchange.

For the personal data you give us through this platform we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023. For the lending decision itself the bank or NBFC is the fiduciary, and their policy applies alongside this one.

2. The lawful basis we rely on

Mostly your consent, which we ask for on the first form you fill in, before we save what you enter there (see section 9a). For a narrower set of processing we rely on the Act’s legitimate uses - meeting a legal obligation, and data you have voluntarily provided for a specific purpose.

Consent is asked for in plain language, separately from the terms of use, and is specific to the purposes listed below. We do not treat continued use of the site as consent.

3. What we collect, and why

Each purpose below is the reason we hold that data. We do not collect anything for a purpose that is not on this list.

If you are a supplier

• Contact details - your name, designation, mobile number and work email, and the business’s registered address. To let you sign in, and to tell you what is happening to your application and your invoices.
• Legal details - PAN, GSTIN, CIN, date of incorporation, TAN, Udyam number and turnover band. To verify the business exists, is who it says it is, and is eligible.
• Documents you upload - registration certificates, the company’s constitutional documents, financial statements, bank statements, a cancelled cheque for the account your financier pays into, and PAN and Aadhaar for each person who will use the account. To verify the business, and for the lender’s credit assessment.
• Documents kept current after approval - the list of directors and shareholders, a declaration of who ultimately owns or controls the business (its beneficial owners), and each year’s financial statements. We ask you to update them when they change. So that what a lender relies on stays true.
• Invoices, purchase orders and delivery evidence. This is the asset being financed.
• Data fetched from government sources - GST registration and filing status, e-invoice references, e-way bills, and the company’s public registry record. To confirm the business and the invoice are genuine.
• The contents of your GST returns - in future, and only with your explicit consent, which you give yourself by entering a one-time code from the GST system. We will not fetch them otherwise. So a lender can see your turnover from the source rather than from a copy.

If you are a buyer

• Company name, sector and turnover band, and the legal details listed above, so far as they apply to your company
• The contact details of the people who use the account
• Your registration certificates, and the list of people who may confirm invoices on your company’s behalf
• The contact who confirms invoices, and their confirmation decisions
• How promptly you have paid the suppliers financed through us

We do not ask a buyer for bank statements, balances or financial records - you are not borrowing. There is one exception, and it is entirely in your hands: a financier considering a specific invoice may ask you for a specific document, and must say why. You can refuse. Refusing does not affect your account, your suppliers, or anything else on this platform - the lender is simply told you declined and decides on the invoice without it. We never pass on a document you have not chosen to give. What a financier can and cannot see about you is set out in full here.

Everyone

• Onboarding-fee payment records, where your business pays one - the amount, our payment ID, the payment gateway’s payment ID and the payment mode. Your card and UPI details are handled by the gateway, not stored by us. To show the fee was paid, and to answer any question about it.
• A record of sign-ins and of the actions taken on the platform - who did what, and when, and for each sign-in and each signing of a Key Fact Statement, the IP address and the browser used. This is the audit trail. To keep accounts secure, and to be able to show afterwards what happened.
• Technical logs needed to run and secure the service

The public pages, including the calculator, need no account. Using the calculator does not create a record of you, and we do not ask for a phone number in exchange for a number.

4. Who we share it with

We share personal data only with the kinds of recipient below, only for the purpose given against each, and only as much as that purpose needs. Service providers act as Data Processors - under contract, only on our instructions, and not for any purpose of their own. We pay them for the service; they are not paid in data, and we receive nothing for sending it.

• Banks and NBFCs - the regulated lenders that consider and fund invoices. Only those holding an approved limit on you, and only for an invoice you have submitted.
• Your buyer - the invoice details we ask them to confirm, which they already hold.
• Identity and business verification providers - to check the identifiers you give us against government and company-registry records: that the PAN is valid and belongs to the business, that the GST registration is active and returns are being filed, and what the company’s public record shows about its status, its directors and any registered charges. They receive only what each check needs, such as a PAN with the name it should match, a GSTIN, a CIN or a director’s identification number - not your documents, your bank statements, your invoices or anything about your customers.
• A payment gateway - to process the onboarding fee. It receives the amount and the payer’s name, email address and mobile number. You enter your card or UPI details on the gateway’s own page, so they are handled by the gateway and never stored by us.
• Email delivery providers - to send the emails the service depends on, such as sign-in codes and updates on your application and invoices. They receive the email address and the message.
• Cloud hosting in India - the servers the platform and its data run on.
• Meeting scheduling - if you book a meeting from our contact page, the scheduling service receives your name, email address and anything you write in the booking, to arrange it.
• Professional advisers - our lawyers, auditors and accountants, where they need it to advise us, under a duty of confidentiality.
• Regulators, courts and law enforcement - where the law requires us to.

If you later authorise us to fetch your GST returns, that request will go through an intermediary licensed for the purpose. And if we ever need to share data with a kind of recipient that is not on this list, we will say so here before we do, not afterwards.

We do not sell your data. We do not share it for anyone else’s marketing, and we do not build a separate credit product out of it.

5. Where it is stored

The data we hold is stored on servers located in India. Some service providers - email delivery, for example - may handle part of it outside India for as long as it takes to do their job. Where that happens it is under contract, and never to a country the Central Government has restricted. We will not move the data we store out of India without saying so here first.

6. How long we keep it

• The audit trail - kept readily available for at least one year, then moved to a secure archive and kept for up to eight years.
• KYC, transaction and payment records - for as long as the law requires, which can be several years after your account closes.
• Documents for an invoice that was never financed - twelve months.
• Technical logs - twelve months.
• Marketing contact details - until you ask us to stop, then deleted.

All of it is kept in India, as section 5 explains. When a purpose has been served and no legal obligation requires us to keep the data, we erase it. Closing your account does not shorten the periods the law sets, because they are not ours to waive.

7. Your rights

Under the DPDP Act you may:

• Ask what we hold about you, and who we have shared it with
• Have it corrected if it is wrong, incomplete or out of date
• Have it erased where no legal obligation requires us to keep it
• Withdraw consent at any time, as easily as you gave it. Withdrawal does not undo processing already carried out, and may mean we can no longer offer you the service
• Nominate someone to exercise these rights if you die or become incapacitated
• Complain to us, and then to the Data Protection Board of India

Ask through the grievance officer. We reply within the statutory timeline, and if we refuse a request we will tell you which obligation we are relying on rather than simply declining.

8. Security

Access is scoped on the server, per organisation and per role - a financier without a limit on a supplier cannot load that supplier’s deal at all, rather than merely being shown no link to it. Passwords and one-time sign-in codes are stored hashed, never in readable form. Every state change is written to an append-only audit log recording who did it and when.

If a breach occurs that affects your data, we will notify you and the Data Protection Board of India as the Act requires.

9. Cookies

Two cookies, both strictly necessary, both set by us and readable only by our server (httpOnly), so no script on the page - ours or anyone else’s - can read them:

• bzigrowth_session - keeps you signed in. It holds a signed token identifying your account and nothing else. It expires after 30 minutes of inactivity on staff and lender screens, 12 hours on supplier and buyer screens, and in every case no more than 12 hours after you signed in, however active you are.
• bzigrowth_signup_email - set only during sign-up, after you enter the code we email you, so the form knows the address is yours. It lasts 60 minutes, is limited to the sign-up pages, and is deleted the moment your account is created.

That is the complete list. There is no advertising network, no third-party analytics, no pixel, no fingerprinting and no cross-site tracking anywhere on this site. Nothing here is used to profile you or to follow you elsewhere.

That is why there is no cookie banner. Consent is required for cookies that are not necessary to provide a service you asked for; a banner offering you a choice we do not in fact make would be theatre. If we ever add a cookie that is not strictly necessary, we will ask you first, it will be off until you say yes, and saying no will cost you nothing.

9a. Consent, and taking it back

The processing described above runs on your consent, and we ask for it before we save anything you enter about your business: the consent box is on the first form you fill in. The only thing we hold before then is the email address we send your sign-up code to. The purposes are set out beside the box, the box is never ticked for you, and we store which version of that wording you agreed to and when, so there is a record of what you actually consented to rather than what the page says today.

Marketing email is separate and always was. It has its own box and it is optional: it is never bundled into the required declarations, refusing it has no effect on your application, and you can withdraw it at any time from your profile or with the one-click unsubscribe in every such email.

You can withdraw consent at any time by writing to support@bzigrowth.com. Withdrawing it stops further processing; it cannot undo what has already lawfully happened, and where we are required by law to keep a record - an audit trail, a completed transaction - we keep that and nothing else. If withdrawing means we can no longer run the service for you, we will tell you plainly rather than letting the account quietly stop working.

10. Children

This is a service for registered businesses. We do not knowingly process the personal data of anyone under 18, and no part of this platform is directed at children.

11. Changes

If we change this policy in a way that affects what we do with data we already hold, we will tell you directly rather than quietly reposting the page.