Privacy Policy

2.1 Information You Provide Directly

• Full legal name, date of birth, gender, and photograph
• PAN (Permanent Account Number) and Aadhaar number for KYC verification
• Mobile number and email address
• Residential and/or workplace address with PIN code
• Employment details: employer name, designation, monthly income, employment type
• Bank account details: account number, IFSC code, bank name, and account holder name
• UPI ID or linked payment instrument details
• Loan application data: requested amount, tenure, purpose of loan
• Nominee details (if applicable)
• Communication preferences and consent records

2.2 Information Collected Automatically

• Device information: model, operating system, unique device identifiers, browser type
• Network information: IP address, mobile carrier, Wi-Fi access point details
• Usage data: pages visited, features used, time spent, click patterns, session duration
• Location data: approximate location based on IP address (precise GPS location is collected only with explicit consent)
• App performance data: crash reports, diagnostics, and error logs
• Cookies, pixels, and similar tracking technologies for analytics and personalization

2.3 Information from Third-Party Sources

• Credit information from credit bureaus (TransUnion CIBIL, Experian, Equifax, CRIF High Mark) with your consent
• Bank statement data via Account Aggregator framework or secure third-party providers
• KYC verification data from UIDAI (Aadhaar eKYC) and NSDL/UTI (PAN verification)
• Fraud detection data from government databases, CERSAI, and other statutory sources
• Employment verification data from employer databases and HR platforms

3.1 Core Service Delivery

• Processing and evaluating your loan application
• Performing identity verification and KYC/AML compliance checks
• Assessing creditworthiness through proprietary risk scoring algorithms
• Facilitating loan disbursement to your verified bank account
• Managing repayment schedules, EMI processing, and collections
• Providing customer support and resolving service-related queries

3.2 Platform Improvement & Analytics

• Analyzing usage patterns to improve user experience and interface design
• Conducting internal research and development for product innovation
• Performing A/B testing and feature optimization
• Generating anonymized, aggregated analytics and business intelligence reports

3.3 Communication

• Sending transactional notifications: loan approval, disbursement, EMI reminders, payment confirmations
• Providing regulatory disclosures and policy update notifications
• Marketing communications about new products and offers (only with your explicit opt-in consent)
• Responding to your inquiries, feedback, and support requests

3.4 Legal & Regulatory Compliance

• Complying with applicable laws, regulations, and RBI directives
• Responding to court orders, subpoenas, and government requests
• Preventing, detecting, and investigating fraud, security breaches, and prohibited activities
• Enforcing our Terms of Use and other contractual agreements

4.1 NBFC & Lending Partners

• All credit facilities on KASHJET are sanctioned by RBI-registered NBFCs/Banks. Your application data, KYC information, and credit profile are shared with the respective lending partner processing your loan. Each lending partner has their own privacy policy governing further use of your data.

4.2 Service Providers

• Payment gateway providers (Razorpay, PayU, etc.) for processing transactions
• Cloud infrastructure providers (AWS/GCP) for secure data storage and processing
• Communication service providers for SMS, email, and push notifications
• Analytics and monitoring tools for platform performance optimization
• KYC and identity verification service providers

4.3 Regulatory & Legal Obligations

• Reserve Bank of India (RBI) and its authorized representatives
• Credit information companies (CICs) for credit reporting purposes
• Law enforcement agencies pursuant to valid legal process
• Courts and tribunals in response to legal proceedings
• Government authorities as required by applicable law

5.1 Technical Safeguards

• AES-256 encryption for all data at rest and TLS 1.3 encryption for data in transit
• Multi-factor authentication (MFA) for account access
• Regular penetration testing and vulnerability assessments by certified third-party auditors
• Real-time intrusion detection and prevention systems (IDS/IPS)
• Secure, isolated VPC architecture with network-level access controls
• Automated threat monitoring and incident response protocols

5.2 Organizational Safeguards

• Role-based access control (RBAC) limiting data access on a need-to-know basis
• Mandatory security awareness training for all employees and contractors
• Background verification for all personnel with access to sensitive data
• Regular internal and external security audits
• Documented incident response plan with defined escalation procedures

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data, subject to legal and regulatory retention requirements
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format
• Right to Withdraw Consent: Withdraw previously given consent for data processing (this may affect service availability)
• Right to Nominate: Nominate a person to exercise your rights in case of your death or incapacity
• Right to Grievance Redressal: Lodge complaints regarding data processing with our Grievance Officer or the Data Protection Board of India