Privacy Policy

1. Who we are

SustCred is a renewable energy advisory and investment platform operating in India, with offices in New Delhi and Ahmedabad. For the purposes of the Digital Personal Data Protection Act, 2023, SustCred is the Data Fiduciary responsible for the personal data described in this policy.

Registered office: Level 4, Southern Park Mall, District Centre, Sector 6, Saket, New Delhi 110017, India

Contact: contact@sustcred.com

2. Scope

This policy covers personal data we collect through sustcred.com, through email and correspondence with us, and through job applications submitted to us. It does not cover the practices of third-party websites we link to.

3. Personal data we collect

We collect the following categories:

Information you give us directly

• Name, email address, telephone number, organisation, and any other details you include when you email us or otherwise correspond with us.
• Correspondence, including the content of enquiries and any documents you choose to share.
• Job applications, including your CV, work history, and any information contained in it.
• Where you request access to transaction materials, information required to qualify you as a counterparty and to execute a non-disclosure agreement.

Information collected automatically

• Aggregate website analytics collected via our hosting provider, including pages viewed, approximate country derived from IP address, device type, browser, referring source, and session duration.
• Standard server logs, including IP address and timestamps, retained for security and diagnostic purposes.

We do not use advertising cookies, and we do not sell personal data.

Our hosting provider sets a small number of strictly necessary cookies for security and to route requests to the correct deployment. These do not track you across sites and are not used for advertising or personalisation.

4. Why we process your data

• To respond to your enquiry - so that we can answer questions and discuss a possible engagement.
• To provide advisory and transaction services - to perform our engagement with you or your organisation.
• To assess job applications - to evaluate candidates and communicate about roles.
• To qualify counterparties - to verify eligibility before releasing confidential transaction information.
• To operate and secure the website - to keep the site available, diagnose faults, and prevent misuse.
• To meet legal and regulatory obligations - including record-keeping and responding to lawful requests from regulators.

5. Our basis for processing

Where you submit information to us voluntarily, we process it on the basis of your consent, which you give when you submit the relevant form or send the relevant correspondence. Where processing is necessary for employment purposes, to comply with a legal obligation, or where processing falls within a specific legitimate use recognised under section 7 of the Digital Personal Data Protection Act, 2023 - in our case, processing for employment purposes and processing necessary to comply with a legal obligation or a judgment or order, we rely on that basis instead. You may withdraw consent at any time - see section 9.

6. Who we share data with

We share personal data only where necessary, and only with:

• Service providers who host our website, provide email and file storage, and support our IT systems, acting on our instructions.
• Professional advisers, including legal counsel, auditors, and accountants, where they need it to advise us.
• Counterparties and their advisers in a transaction, where you have agreed to that disclosure or it is necessary to progress an engagement.
• Regulators, courts, and law enforcement, where we are required to disclose by law.

We require our service providers to protect personal data and to process it only for the purposes we specify.

7. Transfers outside India

Some of our service providers process data on servers located outside India. Where that happens, we take reasonable steps to ensure the data remains protected to a standard consistent with this policy, and we transfer data only to countries not restricted by the Central Government under applicable law.

8. How long we keep data

We retain personal data only for as long as it is needed for the purpose we collected it, or for as long as we are required to keep it by law. Enquiries that do not lead to an engagement are ordinarily deleted within three years. Job applications are ordinarily retained for one year unless you ask us to keep them longer. Records relating to a completed engagement are retained for the period required by applicable law and professional obligations.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct or complete data that is inaccurate or out of date, and to have data erased where it is no longer needed.
• Withdraw consent at any time, with the same ease as you gave it. Withdrawal does not affect processing carried out before you withdrew.
• Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Raise a grievance with us, and to escalate it if you are not satisfied.

To exercise any of these rights, email contact@sustcred.com with the subject line "DPDP Rights Request". We may ask you to verify your identity before we act.

10. Grievance redressal

If you have a concern about how we handle your personal data, contact our Grievance Officer at contact@sustcred.com. We will acknowledge your complaint promptly and respond as quickly as we reasonably can, and in any event within the ninety-day period permitted under the Digital Personal Data Protection Rules, 2025.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Security

We apply reasonable technical and organisational safeguards to protect personal data against unauthorised access, disclosure, alteration, and loss. These include access controls, encrypted transmission, and restricting access to personal data to those who need it. No system is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs, we will notify affected individuals and the Data Protection Board of India as required. Where a breach occurs, we will intimate affected individuals without delay and report the breach to the Data Protection Board of India within seventy-two hours, as required under the Digital Personal Data Protection Rules, 2025.

12. Children

Our website and services are directed at businesses and professional investors and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The current version is always available at sustcred.com/privacy-policy, and the date at the top of the page tells you when it last changed. Where a change is material, we will take reasonable steps to bring it to your attention.

14. Contact

Questions about this policy: contact@sustcred.com

SustCred, Level 4, Southern Park Mall, District Centre, Sector 6, Saket, New Delhi 110017, India