Privacy Policy

Credit Sathi Technology Solution Pvt Ltd ("CreditSaathi", "we", "us") operates the website creditsaathi.co.in and related digital services (together, the "Platform"). This Privacy Policy explains what personal data we collect, why, on what legal basis, who we share it with, how long we keep it, how we protect it, and the rights you have.

We process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP Act"), the Information Technology Act, 2000 and the rules under it, the Credit Information Companies (Regulation) Act, 2005, and the Reserve Bank of India's directions applicable to digital lending and to the regulated entities we work with.

1. Who is responsible for your data

Credit Sathi Technology Solution Pvt Ltd is the Data Fiduciary for personal data collected on the Platform. When you choose to apply with a bank or NBFC (a "Partner"), that Partner becomes an independent Data Fiduciary for the data it receives and processes under its own privacy policy, which is linked on our Partners page.

Contact for privacy matters: [Data Protection Officer name], grievance.creditsaathi@creditsaathi.co.in, Office No 654, Triaa Vasantnam City Center, Vishrantwadi, Pune City, Pune 411015.

2. Personal data we collect

We do not collect biometric data, Aadhaar numbers (any Aadhaar-based KYC is done by the Partner on its own platform), bank account passwords, card PINs or CVVs. We do not access your phone's contacts, photos, media, files or call logs. If a camera, microphone or location permission is ever needed for KYC, it is requested one time by the Partner, with your explicit consent, as permitted by RBI.

3. Why we use your data and the legal basis

We use your data only for the purpose you consented to, and for any purpose reasonably connected to it that you would expect. We do not use it for anything else without asking you again.

4. Notice and consent

• Before we collect your data, we show you a notice describing what we collect and why, in clear language, with a link to this policy.
• Consent is requested separately for (a) the Terms of Use and contact for your request, (b) fetching your credit information and sharing with Partners, and (c) marketing. Each checkbox is unticked by default.
• We keep a record of every consent: what you agreed to, when, and from which device.
• You can give, manage or withdraw consent through us or, once available, through a registered Consent Manager under the DPDP Act.
• Withdrawing consent is as easy as giving it: write to grievance.creditsaathi@creditsaathi.co.in, reply STOP to our SMS, or use the unsubscribe link in our emails. Withdrawal does not affect processing already done. After you withdraw, we stop processing and ask our processors to stop, unless the law requires us to keep certain data.

5. Who we share your data with

• Partners (banks and NBFCs): only the Partner you choose, and only the data needed to assess and process your application. Partners are listed on our Partners page.
• Credit information companies (currently Experian; in future possibly TransUnion CIBIL, Equifax or CRIF High Mark), through our authorised partner Surepass, to fetch your credit report with your consent.
• Service providers (Data Processors): cloud hosting, OTP/SMS, email, WhatsApp, calling, CRM, analytics and security vendors. They act only on our written instructions, under contracts requiring confidentiality, security and data storage in India, and may not use your data for their own purposes.
• Advertising platforms: we share only pseudonymous identifiers (such as click IDs) or hashed contact details, and only for measuring our own campaigns where you have consented. We never share your credit information with advertisers.
• Authorities: government bodies, regulators, courts or law-enforcement agencies, where required by law or a lawful order, or to prevent, detect or investigate fraud or a cyber incident.
• Business transfer: a successor entity in a merger or acquisition, bound by this policy.

We do not sell, rent or trade your personal data.

6. Storage location and data localisation

All personal data collected through the Platform, including any data collected for digital lending, is stored on servers located in India, as required by RBI. If any processing outside India ever becomes necessary, we will do so only as permitted under the DPDP Act and RBI directions, and the data will be brought back to and kept in India.

7. How long we keep your data

When the purpose is served and no law requires us to keep the data, we erase it and instruct our processors to do the same.

8. Your rights

Under the DPDP Act, you have the right to:

• Access: a summary of your personal data we process, the processing activities, and the identities of the Data Fiduciaries and Processors we have shared it with.
• Correction and completion: fix inaccurate or incomplete data, and update it.
• Erasure: ask us to delete data that is no longer needed for the purpose, unless the law requires us to keep it.
• Withdraw consent at any time, with the same ease as giving it.
• Nominate another person to exercise your rights if you die or become incapable.
• Grievance redressal: have your complaint addressed by our Data Protection / Grievance Officer, and if you are not satisfied, approach the Data Protection Board of India.

To exercise any right, email grievance.creditsaathi@creditsaathi.co.in from your registered email, or call +91-7391072790, with your registered mobile number. We verify your identity before acting and respond within 30 days. There is no charge.

9. Your duties

Under the DPDP Act you must provide authentic information, not impersonate anyone, not suppress material information, and not file false or frivolous complaints. Please do not submit another person's data without their authority.

10. Children

The Platform is meant only for adults aged 18 and above. Credit products offered through us are available only to individuals aged 21 and above. We do not knowingly collect data from anyone under 18. If you believe a child has shared data with us, contact us and we will delete it.

11. Cookies and similar technologies

You can change your choice anytime through the cookie settings link in the footer or your browser settings. Blocking necessary cookies may stop parts of the Platform from working.

12. How we protect your data

We use reasonable security safeguards, including encryption in transit (TLS) and at rest, role-based access on a need-to-know basis, logging and monitoring, vendor security reviews and staff training. No method of transmission or storage is completely secure. If a personal data breach occurs, we will inform affected individuals and the Data Protection Board of India, and report to CERT-In within the time required by law. Report a suspected security issue to grievance.creditsaathi@creditsaathi.co.in.

13. Links to other websites

When you continue to a Partner's website or app, that Partner's privacy policy applies to data you give there. We are not responsible for third-party websites. Please read their policies.

14. Marketing communications

We send promotional messages only if you agree. Transactional messages about an active request continue until it is closed. To stop promotional messages, reply STOP, use the unsubscribe link, or write to support@creditsaathi.co.in. We process opt-outs within 10 working days. We follow TRAI's commercial communication regulations and use DLT-registered headers and templates.

15. Data Protection / Grievance Officer

[Data Protection Officer name]
Credit Sathi Technology Solution Pvt Ltd
Office No 654, Triaa Vasantnam City Center, Vishrantwadi, Pune City, Pune 411015
Email: grievance.creditsaathi@creditsaathi.co.in
Phone: +91-7391072790 · Monday to Saturday, 9:30 am to 6:30 pm (except national holidays)

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India. For lending-related complaints, see our Grievance Redressal page.

16. Changes to this policy

We may update this policy to reflect changes in law or our practices. We will post the updated version here with a new effective date and, for material changes, notify you and seek fresh consent where the law requires.