Entity Name: Fintech Cloud Private Limited
Corporate Identification Number (CIN): U72900DL2021PTC375556
Registered Office: S-370, Panchsheel Park, New Delhi 110017.
1. Introduction & Scope
Fintech Cloud Private Limited ("Company", "Fintech Cloud", "We", "Us", or "Our") operates as a Lending
Service Provider (LSP) offering Digital Lending Applications (DLAs) and technical facilitation
infrastructure to connect prospective borrowers ("User", "Borrower", "You") with Regulated Entities ("REs"
or "Lending Partners"), including Banks and Non-Banking Financial Companies (NBFCs) registered with the
Reserve Bank of India (RBI).
This Privacy Policy ("Policy") outlines our practices concerning the collection, storage, use, processing,
transfer, protection, and deletion of your Personal Data and Financial Information in connection with
digital lending services provided via our mobile application, web application, API integrations, and related
digital channels (collectively, the "Platform").
We act strictly as a Data Processor / Data Fiduciary carrying out processing activities for and on behalf
of our partner REs. This Policy is fully aligned with the RBI Guidelines on Digital Lending, the Digital
Personal Data Protection (DPDP) Act, and the IT Act, 2000.
2. Governing Principles & Regulatory Framework
Our data handling practices are governed by the following core regulatory principles:
- Principle of Data Minimization: We collect only the minimal data strictly necessary for
underwriting, customer onboarding, identity verification, and loan lifecycle management.
- Explicit, Purpose-Specific Consent: We do not rely on omnibus/bundled consent. Every
data point collected requires explicit, granular, and opt-in consent.
- No Hardware/Mobile Data Harvesting: We do not access, read, or store your mobile phone
contacts, media, gallery files, call logs, SMS logs, social media data, or hardware identifiers (e.g.,
IMEI).
- One-Time Camera/Microphone Access: Access to camera, microphone, or location facilities
is requested strictly on a one-time basis solely for Video KYC (V-KYC) and serviceability/address checks.
- Strict Storage Governance: As an LSP, we do not store sensitive borrower data (e.g.,
bank account passwords, biometrics, detailed credit bureau reports) on our servers. Only Minimal Data
(e.g., name, contact details, address, basic application status) necessary to support the loan lifecycle
is retained by us.
- Data Localisation: All personal and financial data is stored exclusively on secure
servers located physically within the territory of India.
3. Details of Regulated Entities (Lending Partners)
Fintech Cloud Private Limited operates as an outsourced LSP for the RBI-regulated lending institutions.
4. Information We Collect & Processing Purpose
We collect and process personal data across distinct stages of the application journey with your explicit
consent.
A. Information You Explicitly Provide
- Identity & Contact Information: Full Legal Name, Date of Birth, Gender, Mobile
Number, Email Address, Residential Address, and Permanent Address.
- Government Identifiers (Directly to RE/KUA): PAN number and Aadhaar number (collected
via mask/e-KYC/DigiLocker purely for onward submission to the RE or UIDAI-approved entities). We do not
store raw Aadhaar numbers or biometrics on LSP servers.
- Financial & Employment Data: Income details, employer name, occupation, bank
account number, and IFSC code for direct disbursement and auto-debit setup (e.g., e-NACH/NPCI).
B. Hardware & Technical Permissions (One-Time Access Only)
- Camera & Microphone Access: Granted one-time solely for performing Video KYC
(V-KYC) and capturing liveness/selfie checks required by the RE.
- Location Permission: Granted one-time at the time of application to verify geographic
serviceability and prevent identity fraud.
- Device Metadata: IP address, operating system, app version, and network state captured
for session security and anti-fraud monitoring.
5. Prohibited Data Collections (Explicit Negative List)
In compliance with RBI Guidelines, Fintech Cloud Private Limited explicitly confirms that we NEVER ask for,
access, scan, or store the following:
- Mobile Phone Contact Lists / Address Books
- Call Logs & Telephony Records
- SMS Content / Text Messages
- Media, Photo Gallery, Storage Files, or Documents on Device
- Biometric Data (Fingerprints, Iris scans)
- Net Banking Passwords, UPI PINs, or Credit/Debit Card CVVs
6. Data Sharing, Disclosure & Third-Party Transfers
We do not sell, rent, or trade your personal data. Data sharing occurs strictly on a need-to-know basis
under binding agreements and RBI standards:
- With Regulated Entities (REs): Your application details, KYC documents, and financial
data are securely transmitted to the chosen Lending Partner for credit assessment and loan execution.
- Credit Information Companies (CICs): Credit data reporting is executed directly by the
RE or via LSP on behalf of the RE to CIBIL, Experian, Equifax, or CRIF High Mark.
- Authorized Service Providers: Identity verification APIs (e.g., DigiLocker, CKYC
registry), e-Sign infrastructure (e.g., C-DAC/NeSL), e-NACH processing partners, and cloud service
facilities located within India.
- Regulatory & Statutory Authorities: Disclosures mandated by law, court orders,
Reserve Bank of India directives, law enforcement agencies, or fraud prevention frameworks.
7. Financial Transaction Flow & Cost Transparency
- Direct Fund Flow: All loan disbursals and loan repayments flow directly between the
bank account of the RE and the verified bank account of the Borrower. No loan funds pass through any
pool, transit, or nodal account maintained by Fintech Cloud Private Limited.
- Zero LSP Fee Collection from Borrower: Fintech Cloud Private Limited does not charge
any fee, processing charge, or service charge directly to the borrower. All fees payable to Fintech Cloud
are borne entirely by the partner RE.
- Key Fact Statement (KFS): Before loan execution, you will be provided a standardized,
digitally signed Key Fact Statement (KFS) detailing the Annual Percentage Rate (APR), total cost,
repayment schedule, and cooling-off period.
8. User Data Rights & Revocation of Consent
Under the RBI Guidelines and the DPDP Act, you enjoy full control over your personal data:
- Right to Revoke Consent: You may revoke consent for data processing at any time by
raising request with us.
- Right to Erasure / "Right to be Forgotten": Post full repayment of your loan and upon
receipt of a No Dues Certificate (NDC) from the RE, you may request the deletion of your personal data
stored on our servers.
- Right to Rectification: You may request updates or corrections to incomplete or
inaccurate personal data.
- Right to Deny Permissions: Denying optional permission requests (e.g., location or
camera) will not impact your right to apply, provided alternative offline/non-digital KYC mechanisms
supported by the RE are completed.
Data retention necessary for statutory compliance, tax laws, anti-money laundering (AML)
guidelines, and audit trails mandated for REs shall be retained as required by law despite consent
revocation.
9. Data Storage, Localisation & Retention
- 100% Indian Data Sovereignty: All personal data, financial records, device information,
and transaction logs are stored exclusively on secure cloud infrastructure (e.g., AWS/Azure India region)
physically located in India.
- Retention Period: We retain your minimal transactional data only for as long as
required to service your active loan lifecycle or as mandated under RBI record management policies and
PMLA rules (typically 5 years post loan closure), after which it is securely destroyed/anonymized.
10. Information & Cybersecurity Safeguards
Fintech Cloud Private Limited maintains robust technical and organizational security measures meeting ISO
27001 standards and RBI Cyber Security Framework directives:
- Encryption: Data in transit is encrypted using TLS 1.3/HTTPS protocols; data at rest is
encrypted using AES-256 bit encryption.
- Access Controls: Strict Role-Based Access Controls (RBAC), multi-factor authentication
(MFA), and zero-trust perimeter security.
- Vulnerability Assessments: Quarterly vulnerability scans (VA/PT) conducted by CERT-In
empaneled cybersecurity auditors.
- Incident Management: Active monitoring tools to detect and neutralize unauthorized
access, cyber threats, or data breach attempts.
11. Recovery & Code of Conduct Facilitation
Fintech Cloud Private Limited and its lending partners strictly prohibit any form of harassment,
intimidation, non-standard hours communication, or unauthorized contact during recovery processes.
Details of authorized collection agents/agencies assigned by the RE are formally communicated to the
borrower via SMS/Email prior to any collection outreach.
Collection agents are strictly forbidden from contacting your family, friends, or employers.
12. Grievance Redressal Mechanism
In compliance with the RBI Digital Lending Guidelines, Fintech Cloud Private Limited has established a
dedicated nodal grievance redressal channel:
Nodal Grievance Redressal Officer (LSP)
- Name: Anurag Verma
- Designation: Nodal Grievance Officer
- Company: Fintech Cloud Private Limited
- Address: S-370, Panchsheel Park, New Delhi 110017.
- Email: grievance@fintechcloud.com
- Contact/Helpline Number: +91-7303438435
- Turnaround Time (TAT): Acknowledgment within 24 hours; resolution within 15 days.
Escalation to Regulated Entity & RBI Ombudsman
If your complaint is not resolved within 15 days by us, you may escalate the issue to the Grievance
Redressal Officer of the respective Lending Partner (RE) listed in your loan agreement/KFS.
If the complaint remains unresolved after 30 days from initial lodging, you may file a complaint on the RBI
Reserve Bank - Integrated Ombudsman Scheme (RB-IOS) portal via https://cms.rbi.org.in or the RBI Sachet Portal (https://sachet.rbi.org.in).
13. Changes to This Privacy Policy
We reserve the right to modify or update this Privacy Policy periodically to reflect technological
advancements, statutory amendments, or evolving RBI guidelines. Any material changes will be notified to you
via app notifications, SMS, or registered email before taking effect.
14. Acknowledgment & Consent
By clicking "I Agree", "Continue", or using our Platform, you acknowledge that you have read, understood,
and agreed to the terms of this Privacy Policy and explicitly authorize Fintech Cloud Private Limited to
process your personal data in accordance herewith.
