Privacy Policy

1. About This Policy

This Privacy Policy applies to all services provided by NetZero Finance Pvt Ltd (CIN: U65999MH2019PTC000000), trading as Aerem, through our websites (aerem.co, home.aerem.co, partner.aerem.co), mobile applications, and any related services. It describes the information we collect, how we use it, who we share it with, and your rights as a data subject under applicable Indian law.

This policy is governed by the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable RBI guidelines for Non-Banking Financial Companies. As India's Digital Personal Data Protection Act 2023 (DPDPA) provisions come into force, we will update this policy accordingly.

2. Information We Collect

Information you provide directly:

• Name, phone number, and email address (required for account creation and service delivery)
• PAN (Permanent Account Number), required for NBFC loan processing and KYC compliance
• Aadhaar number (last 4 digits only stored; full number used for UIDAI-based eKYC verification and then discarded)
• Home address and pin code (for installer matching and system design)
• Electricity bill amount, DISCOM name, and consumer number (for savings calculation and DISCOM coordination)
• Monthly electricity consumption in units
• Roof ownership status and roof type (for eligibility assessment)
• Bank account details (for loan disbursement through NetZero Finance NBFC)
• Income and employment details (for NBFC credit assessment, where applicable)

Information collected automatically:

• System usage data: pages visited, features used, time spent, session identifiers
• Device and browser information: device type, operating system, browser version, IP address
• Solar system monitoring data: real-time and historical generation data from AeROC-connected systems (only after installation and with customer consent)
• WhatsApp message content, where the customer initiates contact through our WhatsApp channels

Information from third parties:

• Credit bureau data from CIBIL (credit score and credit history, obtained with your consent as part of loan processing)
• DISCOM data, where Aerem or its partners coordinate on behalf of the customer

3. How We Use Your Information

For service delivery:

• Processing solar loan applications through NetZero Finance Pvt Ltd (credit assessment, underwriting, disbursement, collection)
• Matching homeowners with certified Aerem installer partners based on location, system requirement, and installer availability
• Coordinating DISCOM feasibility assessments and net metering applications
• PM Surya Ghar subsidy application processing and tracking

For platform operations:

• Savings calculator (uses electricity bill data to estimate savings; does not require login)
• AeROC monitoring dashboard (requires account; displays generation, savings, and system health data)
• PartnerApp operations (for installer partners: lead management, commission tracking, customer records)

For communications:

• Transactional communications: loan sanction letters, EMI reminders, installation updates, DISCOM status updates. These communications are required for service delivery and cannot be opted out of while you are a customer.
• Service communications: system alerts (AeROC), maintenance reminders. Opt-out available.
• Marketing communications: savings tips, new product announcements, blog articles. Opt-out available at any time.

For regulatory compliance:

• KYC and AML compliance under RBI's Master Direction on KYC (2016, as updated)
• Credit bureau reporting (CIBIL reporting of loan accounts as required for all NBFCs)
• RBI regulatory reporting (aggregate and anonymised data)

For product improvement:

• Aggregate, anonymised usage data used for product development and UX improvement. No individual-level data used for this purpose without explicit consent.

4. Who We Share Your Information With

Installer partners:

We share your name, phone number, property address, and system requirement with your selected Aerem installer partner. We do not share your financial information (loan amount, EMI, income) with installer partners.

RBI and regulatory bodies:

We report to the Reserve Bank of India as required under our NBFC license. This includes aggregate loan portfolio data, KYC compliance certifications, and specific loan data where required by regulatory investigation.

Credit bureaus:

We report loan account status to CIBIL as required for all RBI-licensed NBFCs. Positive loan performance (timely repayment) is reported and improves your credit score. Defaults are reported as required by law.

Technology vendors:

Our technology infrastructure involves third-party vendors including cloud hosting providers, SMS and WhatsApp gateway providers, and payment processing services. All vendors operate under non-disclosure agreements and data processing agreements that restrict use of your data to service delivery only.

Legal requirements:

We disclose information to law enforcement or regulatory authorities when required by a valid legal order, warrant, or regulatory direction.

We do not sell personal data to advertisers, data brokers, or any other commercial third party.

5. Data Security

NetZero Finance Pvt Ltd implements technical and organisational security measures appropriate to the sensitivity of the data we process:

• Loan and financial data: encrypted at rest (AES-256) and in transit (TLS 1.3)
• PAN and Aadhaar data: stored in tokenised form after KYC verification; full numbers are not stored
• Access controls: role-based access control, with loan data accessible only to NBFC operations staff with legitimate need
• Security testing: penetration testing conducted annually; vulnerability scanning conducted quarterly
• Incident response: documented incident response plan; regulatory notification within 72 hours of a data breach as required under DPDPA

6. Your Rights

As a data subject, you have the following rights under applicable Indian law:

Right to access: You may request a copy of the personal data we hold about you. We respond within 30 days.

Right to correction: You may request correction of inaccurate personal data. For loan-related data, corrections may be subject to documentary verification.

Right to deletion: You may request deletion of your personal data. We will delete data that is not required for regulatory compliance (see Section 7 on retention). Loan account data cannot be deleted while the loan account is active or during the mandatory retention period.

Right to data portability: You may request your data in a machine-readable format (JSON or CSV).

Right to withdraw consent: Where processing is based on consent (marketing communications, optional product features), you may withdraw consent at any time. Withdrawal does not affect processing that occurred before the withdrawal.

To exercise any of these rights, contact our Data Protection Officer at privacy@aerem.co or by post to the registered office address.

7. Data Retention

Loan-related data: Retained for 7 years from the date of loan closure, as required by RBI guidelines and applicable tax law.

KYC documents: Retained for 5 years from the date of account closure or last transaction, as required by PMLA 2002 and RBI KYC Master Direction.

AeROC monitoring data: Retained for the lifetime of the customer relationship plus 2 years. Customers may request earlier deletion of monitoring data.

Marketing data: Deleted within 30 days of an opt-out request or account closure, whichever is earlier.

Inquiry data (calculator users without accounts): Retained for 12 months. Deleted on request.

8. Grievance Officer and Contact

If you are unsatisfied with our response, you may escalate to the relevant Data Protection Board as established under the Digital Personal Data Protection Act 2023.