PRIVACY POLICY

Mysti Capital Financial Services

Effective Date: 28 April 2026

Last Updated: 04 June 2026

1. Introduction

Mysti Capital Financial Services (“Mysti Capital”, “we”, “our”, or “us”) is a Delhi NCR-based financial services company providing unsecured bridge funding solutions to businesses. We operate through our website www.mysticapital.com and related digital channels.

This Privacy Policy explains how we collect, use, store, share, and protect your personal and business information when you visit our website, interact with our advertisements, or apply for funding through any of our channels.

By accessing our website or submitting any information to us, you agree to the terms of this Privacy Policy. Please read it carefully.

2. Information We Collect

2.1 Information You Provide Directly

When you enquire about or apply for funding through our website, lead forms, WhatsApp, or telephone, we may collect:

• Full name and contact details (mobile number, email address)
• Business name, type, and registration details
• GST number and annual turnover information
• Bank account details and financial statements
• Identity documents (Aadhaar, PAN card)
• Funding requirement and repayment preferences
• Any other information you voluntarily provide to us

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information, including:

• IP address and device information
• Browser type and operating system
• Pages visited, time spent on the website, and clickstream data
• Referring URL and search keywords used
• Cookie identifiers and similar tracking technologies

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Meta (Facebook and Instagram) advertising platforms, when you interact with our lead generation forms or advertisements
• Google Ads, when you click on our search advertisements
• Chartered Accountants, financial advisors, or DSA partners who refer you to us
• Publicly available business databases and GST portals

3. How We Use Your Information

We use the information we collect for the following purposes:

• To assess your eligibility for bridge funding based on your business turnover and profile
• To process your funding application and conduct due diligence
• To contact you regarding your enquiry, application status, or funding offer
• To verify your identity and business details as required by applicable law
• To comply with Reserve Bank of India (RBI) guidelines and other regulatory requirements
• To send you relevant communications about our products and services
• To improve our website, advertising campaigns, and customer experience
• To prevent fraud, money laundering, and other illegal activities
• To resolve disputes and enforce our agreements
• To analyse marketing campaign performance and optimise our lead generation activities

4. Legal Basis for Processing

We process your personal information on the following legal grounds:

• Consent: Where you have provided explicit consent, such as by submitting a lead form or opting into WhatsApp communications
• Contractual necessity: Where processing is necessary to enter into or perform a funding agreement with you
• Legal obligation: Where processing is required to comply with applicable laws and regulatory requirements
• Legitimate interests: Where processing is necessary for our legitimate business interests, including fraud prevention and business development

5. How We Share Your Information

We do not sell your personal information to third parties. We may share your information in the following circumstances:

5.1 Service Providers

We may share your information with trusted third-party service providers who assist us in operating our business, including technology providers, payment processors, credit bureaus, and document verification services. These parties are contractually obligated to keep your information confidential.

5.2 Regulatory and Legal Requirements

We may disclose your information to regulators, law enforcement agencies, courts, or government authorities where required by law, including compliance with RBI directions, Prevention of Money Laundering Act (PMLA), and other applicable regulations.

5.3 Business Partners

Where you have been referred to us by a CA, financial advisor, or DSA partner, we may share relevant application status updates with that partner. We will not share your detailed financial information with partners without your consent.

5.4 Advertising Platforms

We use Meta Pixel, Google Analytics, and similar tools on our website. These platforms may receive anonymised or aggregated information about your interaction with our website and advertisements. This is used to improve the relevance of our advertising and is governed by the respective platform’s privacy policies.

6. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your experience and support our marketing activities. We use:

• Essential cookies: Required for the website to function correctly
• Analytics cookies: To understand how visitors interact with our website (Google Analytics)
• Marketing cookies: To measure the effectiveness of our advertising campaigns (Meta Pixel, Google Ads)
• Retargeting cookies: To show relevant advertisements to visitors who have previously visited our website

You may manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

7. Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Secure Socket Layer (SSL) encryption for data transmission
• Access controls limiting data access to authorised personnel only
• Regular security assessments and monitoring
• Secure storage of physical and digital records

While we take all reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

8. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including:

• Enquiry and lead data: Up to 12 months from the date of last contact, or longer if a funding application is initiated
• Funded application data: As required by applicable laws and RBI guidelines, typically a minimum of 8 years from the closure of the account
• Website analytics data: Up to 26 months in anonymised form

After the applicable retention period, we securely delete or anonymise your personal information.

9. Your Rights

Subject to applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (when notified), you have the following rights:

• Right to access: To request a copy of the personal information we hold about you
• Right to correction: To request correction of inaccurate or incomplete information
• Right to erasure: To request deletion of your personal information, subject to legal retention requirements
• Right to withdraw consent: To withdraw consent for marketing communications at any time
• Right to grievance redressal: To raise a complaint with our Grievance Officer

To exercise any of these rights, please contact us using the details provided in Section 12 below.

10. Third-Party Links

Our website may contain links to third-party websites, including advertising platforms and partner websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal information.

11. Children’s Privacy

Our services are intended solely for businesses and their authorised representatives who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18 years of age. If you believe we have inadvertently collected such information, please contact us immediately.

12. Contact Us and Grievance Redressal

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact our Grievance Officer:

Grievance Officer

Mysti Capital Financial Services

Delhi NCR, India

Email: privacy@mysticapital.com

Website: www.mysticapital.com

We will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days of receipt.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this policy and, where appropriate, notify you via email or a prominent notice on our website.

Your continued use of our website or services after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in New Delhi, India.