Privacy Policy

Before using the Service, we recommend that you read this Privacy Policy in full and decide independently and without any outside influence whether to give your consent.

This Privacy Policy governs the relations related to the collection, processing, use, storage, transfer, and destruction — based on electronically granted consent — of the personal data of Users registered with "Mandal Digital Credit" NBFI LLC (hereinafter the "NBFI" or the "Data Controller") and its Car Zeel mobile application (hereinafter the "App"). Matters not specifically regulated by this Privacy Policy shall be governed by the Law on Personal Data Protection, the Law on Non-Bank Financial Institutions, the Law on Combating Money Laundering and Terrorism Financing, the Law on Cybersecurity, the Law on Transparency of Public Information, the Law on the National Payment System, the Law on Organizational Secrets, the Law on Credit Information, the Law on Electronic Signatures, and other applicable legislation.

The User is obligated to carefully read and become familiar with this Privacy Policy, and the Data Controller shall not be liable for any issues arising from a failure to do so.

By activating the "Accept" option, having fully accepted the terms set out in this Privacy Policy, you are deemed to have granted the Data Controller consent to collect, process, use, transfer, and destroy your information. If you do not consent, you will not be able to use the App.

One. Definitions

1.1. "Personal data" means information that directly or indirectly identifies or can be used to identify a natural person. This includes a person's family name and given name, date of birth, place of birth, residential address, location, civil registration number, assets, education, photographs, electronic identifiers or contact information, copies of documents, and other information related to finances and loans.

1.2. "Sensitive data" means information requiring special protection, such as a person's ethnic origin, religion, beliefs, health, genetic and biometric data, the private key of a digital signature, criminal record (current or past), and sexual orientation or gender identity. The NBFI collects and processes sensitive data only for the purpose of identifying and verifying the User (e.g., biometric data), on legal grounds, and only to the extent necessary.

1.3. "Collecting data" means the activity of obtaining, compiling, and recording information.

1.4. "Processing data" means the activity of classifying, storing, and analyzing information, and modifying, deleting, or restoring it at the User's request.

1.5. "Using data" means the Data Controller's use of information in its operations, its transfer, and access to it, other than collecting and processing.

1.6. "Data Controller" means "Mandal Digital Credit" NBFI LLC.

1.7. "Device identification information" means technical information used to ensure the normal operation of the App, such as a unique code identifying the User's mobile phone or device (device ID, advertising ID) and the push notification token.

1.8. The following terms shall have the same meaning as defined in the Car Zeel Application Terms of Service: "NBFI," "App," "User," "KYC / Know Your Customer," "Biometric data," "Scoring," "Digital loan agreement," "Verification code."

Two. Grounds and Purposes for Collecting, Processing, and Using Data

2.1. The NBFI collects, processes, transfers, and uses the User's personal data for the following purposes:

• To confirm and process online loan applications, perform calculations, and establish the conditions for and provide services through the App;
• To identify and verify the User (KYC);
• To ensure performance of the Loan Agreement concluded with the User, and to deliver payment reminders and related information;
• To carry out continuous development of the App's systems, improve the quality and accessibility of services, and develop new products;
• To conduct analysis using information technology and artificial intelligence, verify the accuracy of information, and determine the User's financial capacity through Scoring;
• To prevent fraud, money laundering, terrorism financing, and other unlawful activity;
• To fulfill other obligations set out in law and to meet the requirements of authorized bodies.

2.2. If the NBFI uses third-party software or services to perform Scoring calculations, it shall transfer to that party only the information necessary for the Scoring calculation, and only on condition that it be used solely for that purpose.

2.3. By using the App and accepting this Policy, the User is deemed to have consented to the processing of data for the purposes stated above.

2.4. The Data Controller may collect additional User information for the purpose of improving the Service.

Three. List of Data Collected and Processed

3.1. For the purpose of identifying and verifying the User and registering loan applications, the NBFI collects and processes the following information:

• Family name, given name, civil registration number, date of birth, and sex;
• Mobile phone number, email address, Facebook address, place of residence, and home address;
• Photograph and copy of the national ID card, and the selfie photo taken during the KYC verification process;
• Workplace, field of activity, position, profession, education, and marital status;
• Social insurance contribution payment information and other income-verification information, information about household members, and other information verified through the "HUR" national database exchange system;
• Bank account number;
• Credit information database inquiries and credit-scoring inquiries;
• The User's registered login name, password, and PIN code;
• In case the User cannot be reached or in case of an emergency, the family name, given name, phone number, and relationship of three contact persons, and whether such persons are politically exposed persons or related to politically exposed persons. Entering the information of two emergency contact persons shall be deemed to constitute the consent of those three persons.

3.2. Information generated in the course of the User's use of the Service:

• The loan agreement, outstanding loan balance, repayment schedule, and repayment history;
• Suggestions, requests, and complaints submitted by the User.

3.3. For the purpose of improving the Service and ensuring security, the following information may be collected automatically:

• The model and operating system of the device on which the App is installed, the App version, device identification information, and push notification token;
• Technical logs and usage statistics collected to ensure the normal operation of the App and to detect crashes;
• App login name and password (in masked form);
• Your IP address used when connecting via any smart device to the Data Controller's website and social communication channels related to the Service.

Four. App Permissions

4.1. To ensure the normal operation of the Car Zeel App, the NBFI may request the following permissions on the User's device. The User has the right to revoke any such permission at any time through the device settings:

• Camera — for photographing the national ID card, taking a selfie, and uploading documents;
• Approximate Location — to suggest the nearest branch;
• Push notifications — to deliver loan status and payment reminders;
• Biometric login (fingerprint / facial recognition) — login on the device itself; the NBFI does not store biometric data on its servers.

4.2. The NBFI shall not sell or distribute the User's personal data to third parties for profit, nor use it for any profit-making purpose beyond the needs of the Service.

4.3. The NBFI shall transfer the User's personal data to other parties, in accordance with the grounds and procedures established by law, only in the following cases:

• Where a ruling has been issued by a judge of a Mongolian court;
• Where a resolution has been issued by the prosecutor's office;
• At the request of a law enforcement body, on the basis of an official request from an investigator that has been approved by the prosecutor;
• Where an authorized official of the Financial Regulatory Commission has made a request in connection with resolving a dispute;
• Within the scope of reporting obligations set out in legislation on combating money laundering and terrorism financing;
• To the credit information database, for the purpose of determining the User's creditworthiness;
• In other cases provided by law.

4.4. The following third parties may collect certain User information for the purpose of processing App usage statistics:

• Firebase (Google) and similar mobile analytics and crash-reporting service providers;
• Apple App Store / Google Play — download information collected by the platform service provider in the course of downloading and installing the App.

4.5. Where the NBFI transfers User data to a third party, it shall require that party to comply with this Privacy Policy, information security requirements, and applicable Mongolian legislation.

Five. Conditions for Public Disclosure of Data

5.1. In order to safeguard the inviolability of the User's personal data, the NBFI shall not take measures to make such data publicly available. Data shall be disclosed publicly only where required by law, and only at the request of an authorized state body.

Six. Confidentiality, Storage, and Security of Data

6.1. The NBFI stores the information the User enters into the App in a protected system. Only the User knows the App login password; the NBFI stores this password in encrypted form.

6.2. To reduce the risk of loss of integrity of User data or unauthorized access, the NBFI implements measures such as encryption, network security, log monitoring, role-based access control, regular audits, and monitoring.

6.3. Implementation of and oversight over information security and confidentiality are the responsibility of the NBFI's Risk Management Department and the unit/employee responsible for information security.

6.4. The NBFI shall store User data for no less than the period prescribed by law and, once such data is no longer needed, shall store and destroy it in accordance with the NBFI's internal archiving and information security procedures.

6.5. If a User loses their login credentials due to their own negligence, or transfers or allows their information to be used by others, the User shall bear full responsibility for any resulting damages.

6.6. If the User discovers unauthorized access to their account by a third party, or has reasonable grounds to believe that their personal data has been lost or used without authorization, the User is obligated to immediately notify the NBFI by email at info@mandalcredit.mn.

6.6. Because full protection of the confidentiality of information transmitted through electronic channels such as the internet, email, and messaging applications is, by its technical nature, beyond the NBFI's sole control, the User must exercise their own caution and take care of their own security when transmitting information through such channels.

6.7. If it is established that User data has been lost due to a cyberattack, system failure, employee misconduct, or damage to software or a database, the NBFI shall immediately send notice to the User's registered email address and mobile phone number. The User is obligated to follow the instructions set out in such notice and to take the necessary measures without delay.

Seven. Protection of the Personal Data of Minors

7.1. The NBFI does not intentionally collect, process, use, or store the data of persons under the age of 18. If such a case is discovered, the NBFI shall immediately suspend the Service and take measures to delete the relevant data.

Eight. User Rights

8.1. In accordance with the Law on Personal Data Protection and other applicable legislation, the User has the following rights:

• To require that their information be processed, transferred, and used only in accordance with this Privacy Policy;
• To access their own personal data within the App;
• To request, on legal grounds, that their data be corrected, updated, or deactivated;
• To notify the Data Controller in the event of any change to their personal data;
• To revoke, at any time through the device settings, permissions such as camera, location, and notifications granted to the App.

8.2. The User may submit a request to withdraw their consent to the collection, processing, and use of their personal data by email to info@mandalcredit.mn. The NBFI shall review and resolve such request in accordance with applicable law within 30 (thirty) calendar days of receipt, and shall notify the User of the outcome.

8.3. Once the User has withdrawn their consent to the collection, processing, and use of their personal data, the NBFI shall no longer process, use, or re-collect such data. However, information that the NBFI is legally required to retain shall continue to be stored for the period prescribed by applicable legislation.

Nine. Recommendations for the Security of User Data

9.1. To ensure the security of their own data, Users are advised to follow the recommendations below:

• Download and use the Car Zeel App only from the official Google Play Store or App Store, and verify the developer's name;
• Never disclose the Verification code sent to your registered phone number to anyone — including anyone claiming to be an NBFI employee;
• Create a unique login password that is not reused from other services, use a combination of numbers and letters, and do not write it down;
• Enable your phone's screen lock, fingerprint, or facial recognition security settings;
• Regularly update your phone's operating system and the Car Zeel App;
• Avoid entering personal or financial information while connected to open, unsecured Wi-Fi networks;
• If you receive a call or message requesting a one-time verification code (OTP), password, or other confidential information under the Car Zeel name, do not respond and immediately notify the NBFI;
• Avoid unfamiliar apps or websites that make unrealistic promises such as extremely low interest rates or guaranteed loans, and verify loan terms and information only through the NBFI's official channels;
• Do not allow others to use your phone; if you must, log out of the Car Zeel App or use additional security settings.

Ten. Third-Party Websites and Links

10.1. The App may contain links to the websites or services of third parties that partner with the NBFI. As these are beyond the NBFI's control, the NBFI shall not be liable for content related to such third parties.

Eleven. Updates to the Privacy Policy

11.1. The NBFI reserves the right to add to or amend this Privacy Policy during the course of providing the Service, in connection with the addition of new functions, User feedback, or changes in legislation, and where amended, the most recently updated version shall apply.

11.2. Where the NBFI adds to or amends the Privacy Policy, it shall notify the User through the Car Zeel App, following the same procedure as set out in the Car Zeel App Terms of Service. If the User does not object within 10 (ten) business days of receiving the notice, the amendment shall be deemed effective.

11.3. In the event of a dispute between the User and the Data Controller, Mongolian legislation, the Car Zeel App Terms of Service, and this Privacy Policy shall govern.

I have fully read and understood this Privacy Policy and accept its terms.