Privacy Policy

White Eduventures Sun Private Limited is a company incorporated in India. Crece is an independent referral and lead-sourcing technology platform that connects registered financial consultants with regulated banks, NBFCs, mutual fund distributors and insurance providers ("Partner Institutions"). For the purposes of the DPDP Act, the Company acts as the Data Fiduciary for personal data collected on the Platform.

a) Data you provide directly:

• Identity & contact data — name, mobile number, email address, postal address, date of birth.
• KYC data (consultants) — PAN, Aadhaar (masked/as permitted), bank account details for commission payouts, photographs and KYC documents.
• Lead / referral data — information about prospective customers that a consultant submits with the customer's consent (name, contact details, product interest, and where required for the product, financial or insurance-related details such as income range, policy details or claim documents).
• Communications — messages, support requests, feedback and call/chat records with our team.

b) Data collected automatically: device information, IP address, browser type, log data, usage analytics and cookies (see Section 9).

c) Data from third parties: confirmation of lead status, product approvals or payout information received from Partner Institutions.

• Registering and verifying consultants, providing training, certification and career-plan progression.
• Forwarding customer leads to relevant Partner Institutions for processing of the requested financial or insurance product.
• Calculating and disbursing consultant commissions and maintaining payout records.
• Facilitating claims-assistance requests and tracking their status.
• Servicing, security, fraud prevention, audit and legal compliance.
• Sending service communications (OTPs, status updates, digests) and, with your consent, promotional communications.
• Improving the Platform through aggregated, anonymised analytics.

We process personal data only for lawful purposes with your consent, or for legitimate uses permitted under the DPDP Act.

• Partner Institutions: lead and product-related data is shared with the specific bank, NBFC or insurer whose product has been requested, for processing under their own privacy policies and regulatory obligations.
• Service providers: hosting, cloud storage, communication (SMS/email/WhatsApp), analytics and payment processors — bound by contractual confidentiality and data-protection obligations.
• Claims-assistance professionals: where you raise a claims-assistance request, relevant claim details are shared with the empanelled professional you select.
• Legal: where required by law, regulation, court order or governmental authority, or to enforce our terms and protect rights, property or safety.

We do not sell your personal data.

We implement reasonable security practices and procedures as required under the SPDI Rules and the DPDP Act, including encryption in transit (HTTPS/TLS), hashed credentials, role-based access controls, audit logging and periodic review of our security posture. While we strive to protect your data, no method of transmission or storage is completely secure; you use the Platform at your own risk to that limited extent.

We retain personal data only for as long as necessary for the purposes stated above, or as required by applicable law (including tax, accounting, KYC and regulatory record-keeping requirements). When data is no longer required, it is deleted or anonymised.

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you.
• Request correction or updating of inaccurate or incomplete data.
• Request erasure of your personal data where it is no longer necessary and no legal retention obligation applies.
• Withdraw consent at any time (this may limit our ability to provide certain services).
• Nominate an individual to exercise your rights in case of death or incapacity.
• Raise a grievance with us and, if unresolved, approach the Data Protection Board of India.

To exercise any right, contact our Grievance Officer (Section 10).

The Platform is intended for individuals aged 18 years and above. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, please contact us for deletion.

We use cookies and similar technologies for session management, security and analytics. You can control cookies through your browser settings; disabling them may affect Platform functionality. Third-party analytics providers may set their own cookies subject to their privacy policies.

In accordance with the Information Technology Act, 2000, the SPDI Rules and the DPDP Act, you may contact our Grievance Officer for any questions, requests or complaints regarding this Policy or your personal data:

We may update this Privacy Policy from time to time. Material changes will be notified on the Platform. The "Last updated" date at the top reflects the latest revision. Continued use of the Platform after changes constitutes acceptance of the revised Policy.