Privacy Policy

[INSERT LEGAL NAME OF NBFC], CIN [INSERT CIN], RBI CoR [INSERT NUMBER], with registered office at [INSERT ADDRESS], is responsible for personal data processed in connection with its website, applications, lending products and customer services. Privacy contact: [INSERT DPO / CONTACT NAME, EMAIL, ADDRESS AND PHONE].

• identity and contact data, including name, date of birth, PAN, permitted KYC identifiers, photograph and address;
• application, employment, business, income, bank-account, transaction, GST / Udyam and financial information;
• credit-bureau, fraud-risk and Account Aggregator information obtained with applicable authorisation;
• loan, repayment, mandate, complaint, call, correspondence and recovery records;
• device, browser, IP address, approximate / precise location where necessary and consented, and application security logs;
• merchant / product information, invoice, serial number / IMEI and proof of delivery or installation;
• information from co-applicants, guarantors, references or authorised representatives.

• identify and onboard applicants, perform KYC / AML / sanctions checks and prevent fraud;
• assess creditworthiness, price, sanction, document, disburse, service and collect loans;
• operate mandates, reconcile payments, report to credit information companies and meet regulatory reporting;
• provide customer support, resolve disputes, conduct audits and improve security / service quality;
• send transactional communications and, only under an appropriate basis / choice, marketing communications;
• establish, exercise or defend legal claims and comply with courts, regulators and law-enforcement authorities.

Where consent is relied upon, the Company will seek a clear, specific and informed affirmative action. The borrower may deny or revoke consent for collection / use of particular data, restrict disclosure to third parties, and request deletion where applicable. Withdrawal will not affect processing already lawfully completed and may prevent a requested service where the data is necessary for that service or retention is legally required.

Data may be shared, on a need-to-know and lawful basis, with [INSERT LIST / CATEGORIES: LSPs, DLAs, KYC PROVIDERS, CICs, ACCOUNT AGGREGATORS, BANKS, PAYMENT / MANDATE PROVIDERS, CLOUD / IT VENDORS, AUDITORS, INSURERS, RECOVERY AGENCIES, CO-LENDERS, MERCHANTS / OEMs], government / regulatory authorities and professional advisers. Third parties permitted to collect information through a DLA are identified at [INSERT LINK / LIST]. The Company remains responsible for its regulatory obligations when functions are outsourced.

Customer data will be retained for the periods stated in the Data Storage and Retention Policy or as required for KYC, credit, accounting, limitation, fraud, audit and regulatory purposes. Digital-lending data will be stored on servers located in India, subject to applicable directions. Appropriate organisational and technical safeguards will be maintained; no system is completely secure.

• obtain information about processing and access an appropriate summary;
• request correction, completion or updating of personal data;
• request erasure where retention is not legally or operationally required;
• withdraw consent through [INSERT LINK / CHANNEL];
• nominate another individual where provided by applicable law;
• lodge a privacy grievance at [INSERT CONTACT], and pursue statutory remedies where available.

The Company's credit products are not intended for persons below 18 years. The website may link to third-party sites governed by their own notices. Material changes will be published with an updated effective date and additional notice / consent will be sought where required.