Privacy Policy

Introduction

Profin Solutions ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

Digital Personal Data Protection (DPDP) Act, 2023 — Compliance

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's primary legislation governing the processing of digital personal data. Profin Solutions is committed to full compliance with its provisions. This section outlines our obligations under the Act.

Role: Data Fiduciary

Under the DPDP Act, 2023, Profin Solutions is the Data Fiduciary — the entity that determines the purpose and means of processing your personal data. Our registered office address is the principal place of business for all data-related queries.

Lawful Basis for Processing (Consent & Legitimate Uses)

We process your personal data only on the following lawful bases as defined under Section 4 and Section 7 of the DPDP Act, 2023:

• Consent (Section 6): For marketing communications, optional profiling, and sharing with non-mandatory third parties — we obtain your free, informed, specific, unconditional, and unambiguous consent via a clear affirmative action (e.g., checkbox or OTP verification).
• Legitimate Uses (Section 7): Processing is permitted without consent when required:
  • For the performance of a contract to which you are a party (e.g., loan application processing)
  • For compliance with legal obligations under any applicable Indian law (Regulatory KYC norms, Income Tax Act, PMLA)
  • For the purposes of employment or safeguarding the employer from loss (for agent/staff data)
  • For response to medical emergencies or public health events
  • For State-mandated purposes (subsidies, benefits, licenses)

Consent Notice (as required by Section 5 & Section 6)

At the time of collecting your personal data, we provide (or have provided) a Consent Notice that clearly states:

• The categories of personal data being collected
• The purpose(s) for which the data will be processed
• The specific goods, services, or uses for which your data is needed
• The manner in which you may exercise your rights as a Data Principal
• How to contact our Grievance Officer / Consent Manager

Consent Notices are available in English. We will make them available in additional Scheduled languages as mandated by the rules under the DPDP Act.

Rights of the Data Principal (You) — Sections 11–14

As a Data Principal under the DPDP Act, 2023, you are entitled to the following rights:

1. Right to Information (Section 11): Right to know what personal data is being processed about you and the manner of processing.
2. Right of Access / Summary (Section 11): Right to obtain a summary of your personal data processed by us and information about the entities to whom your data has been shared.
3. Right of Correction, Completion and Erasure (Section 12): Right to correct inaccurate personal data, complete incomplete data, and request erasure of personal data that is no longer necessary for the purpose it was collected — subject to applicable legal retention obligations.
4. Right of Grievance Redressal (Section 13): Right to register a complaint with our Grievance Officer and receive a response within 48 hours of acknowledgement. If unresolved, you may escalate to the Data Protection Board of India.
5. Right to Nominate (Section 14): Right to nominate any individual to exercise your data rights in the event of death or incapacity.
6. Right to Withdraw Consent: If processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. However, withdrawal may affect our ability to deliver specific services.

To exercise any of the above rights, please submit a written request to our Grievance Officer (see below) or email us at support@profin.in. We will respond within 30 days.

Duties of the Data Fiduciary (Our Obligations)

Under the DPDP Act, 2023, Profin Solutions undertakes the following obligations:

• Purpose Limitation: Personal data is collected only for specific, clear, and lawful purposes and is not processed in a manner incompatible with those purposes.
• Data Minimisation: We collect only the personal data that is strictly necessary for the stated purpose.
• Accuracy: Reasonable steps are taken to ensure that personal data is accurate and updated.
• Storage Limitation: Personal data is not retained beyond the period necessary for the purpose of processing, subject to legal retention requirements.
• Security Safeguards (Section 8(5)): Reasonable security safeguards — including encryption, access controls, and audit logs — are maintained to prevent personal data breaches.
• Breach Notification (Section 8(6)): In the event of a personal data breach, we shall notify the Data Protection Board of India and the affected Data Principals in the manner and within the timeframe prescribed under the DPDP Act and its Rules.
• Significant Data Fiduciary (SDF) Obligations: Should Profin Solutions be designated as a Significant Data Fiduciary by the Government of India, we will appoint a Data Protection Officer, conduct annual Data Protection Impact Assessments, and undergo independent data audits as required.

Cross-Border Data Transfers

We do not routinely transfer your personal data outside India. Where any cross-border transfer is necessary (e.g., use of internationally-hosted cloud services), we ensure that such transfers are made only to countries notified as permissible by the Government of India under the DPDP Act, 2023. All data processors operating outside India are contractually bound to the same standards of data protection as applicable in India.

Data Processors

We engage third-party Data Processors who process personal data on our behalf and on our instructions. These include credit bureaus, KYC verification platforms, cloud hosting providers, and analytics services. All Data Processors are bound by contractual agreements that require them to maintain data security standards at least equivalent to those required of us under the DPDP Act, 2023.

Information We Collect

1. Personal Information

We may collect the following types of personal information:

• Identity Information: Name, date of birth, gender, photograph, PAN card, Aadhaar card
• Contact Information: Email address, phone number, residential address, office address
• Financial Information: Bank account details, income information, credit history, CIBIL score (via CIBIL API), Financial Analysis (via Perfois API), existing loans and EMIs
• Employment Information: Employer name, designation, years of experience, business details (for self-employed)
• Document Information: Copies of identity proofs, address proofs, income documents, bank statements, ITR, GST returns

2. Technical Information

• IP address and device information
• Browser type and version
• Operating system
• Cookies and similar tracking technologies
• Website usage data and analytics

3. Communication Information

• Chat transcripts with our AI assistant and support team
• Email correspondence
• Phone call recordings (with your consent)
• Feedback and survey responses

How We Use Your Information

We use your personal information for the following purposes:

1. Loan Processing: To evaluate your eligibility, process loan applications, and facilitate funding from our lending partners
2. Investment & Insurance Services: To recommend suitable investment and insurance products based on your financial profile
3. Communication: To send you updates, notifications, and important information about your applications and services
4. Compliance: To comply with legal obligations, Partner Bank/NBFC regulations, KYC norms, and anti-money laundering regulations
5. Service Improvement: To analyze usage patterns, improve our website, and enhance user experience
6. Marketing: To send promotional offers and updates (you can opt-out anytime)
7. Risk Assessment: To conduct credit checks, fraud prevention, and risk analysis
8. Customer Support: To respond to your queries and provide assistance

Information Sharing and Disclosure

We may share your information with:

1. Financial Institutions (Partner Banks)

Authorized banks (including ICICI Bank and HDFC Bank) and NBFCs with whom we have active Direct Selling Agent (DSA) agreements. All partner institutions are strictly governed by the DPDP Act, 2023 and RBI guidelines. We only share information necessary for the specific loan or financial service you've requested.

2. Service Providers

Third-party service providers who assist us with:

• Credit bureau checks (CIBIL, Experian, Equifax, CRIF)
• Document verification services
• Payment processing
• Cloud storage and hosting
• Analytics and marketing tools

3. Legal Authorities

Government agencies, regulatory bodies, or law enforcement when required by law or to protect our legal rights.

4. Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

Data Security

We implement industry-standard security measures to protect your information:

• Encryption: 256-bit SSL/TLS encryption for data transmission
• Access Controls: Restricted access to personal data on a need-to-know basis
• Secure Storage: Encrypted databases and secure cloud infrastructure
• Regular Audits: Periodic security assessments and vulnerability testing
• Employee Training: Regular training on data protection and confidentiality
• Incident Response: Protocols for detecting and responding to data breaches

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Remember your preferences and settings
• Analyze website traffic and user behavior
• Provide personalized content and recommendations
• Improve website performance and functionality

You can control cookies through your browser settings. However, disabling cookies may limit your ability to use certain features of our website.

Consent Management & Withdrawal

Under the DPDP Act, 2023, consent must be free, specific, informed, unconditional, and unambiguous. We detail how you can manage your consent below:

How We Obtain Consent

• Via an explicit opt-in checkbox or OTP-based confirmation on our web forms and mobile interface
• Via a written/digital Consent Notice before collecting your data, clearly listing purposes, data categories, and your rights
• Via agent-assisted consent collection during offline/DSA-assisted application processes, which is documented in our records

How to Withdraw Consent

You may withdraw consent at any time. Withdrawal will not affect the lawfulness of prior processing. To withdraw:

• Email us at support@profin.in with subject line: "Consent Withdrawal – [Your Name]"
• Call our customer support line and request withdrawal in writing
• Write to our Grievance Officer at the registered office address

We will process your withdrawal request within 7 business days. Post-withdrawal, we will stop processing your data for consent-based purposes and retain only what is legally required for compliance with our DSA agreements and banking laws.

Marketing Opt-Out

You may unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link in any email we send, or by emailing support@profin.in with subject line: "Opt-Out – Marketing". Core transactional and compliance-related communications cannot be opted out of.

Your Rights

You have the following rights regarding your personal information:

1. Access: Request a copy of the personal information we hold about you
2. Correction: Request correction of inaccurate or incomplete information
3. Deletion: Request deletion of your personal information (subject to legal obligations)
4. Opt-Out: Unsubscribe from marketing communications at any time
5. Data Portability: Request transfer of your data to another service provider
6. Withdraw Consent: Withdraw consent for data processing (where applicable)
7. Lodge a Complaint: File a complaint with relevant data protection authorities

To exercise these rights, please contact us using the details provided below.

Data Retention

We retain your personal information for as long as necessary to:

• Provide our services and fulfill the purposes outlined in this policy
• Comply with legal, regulatory, and contractual obligations
• Resolve disputes and enforce our agreements

Typically, we retain data for 7 years after the closure of your account or completion of services, in accordance with lending partner guidelines and tax regulations.

Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

Grievance Redressal Mechanism (DPDP Act, 2023 — Section 13)

Under Section 13 of the DPDP Act, 2023, every Data Fiduciary must establish an effective grievance redressal mechanism. Profin Solutions has designated a Grievance Officer for this purpose.

Grievance Officer Details

Name: Ram Kumar R
Designation: Principal Grievance Redressal Officer
Email: support@profin.in
Phone: +91 98410 49913
Address: Profin Solutions, No. 7, 1st Floor, South Mada Street, Near Parthasarathy Temple, Triplicane, Chennai - 600005, Tamil Nadu, India
Working Hours: Monday to Friday, 10:00 AM – 5:30 PM IST (excluding public holidays)

Grievance Resolution Timeline

• Acknowledgement: Within 48 hours of receiving your complaint
• Resolution: Within 30 days from the date of acknowledgement (extendable by 15 days with prior intimation for complex matters)

Escalation: Data Protection Board of India

If your grievance is not resolved to your satisfaction by our Grievance Officer, you have the right to approach the Data Protection Board of India (DPBI) — the statutory body established under the DPDP Act, 2023 — by filing a complaint through the designated digital platform (to be made available by MeitY). The Board has the authority to:

• Inquire into complaints made by Data Principals
• Direct the Data Fiduciary to take remedial action
• Impose financial penalties for non-compliance (up to ₹250 Crore per instance as specified under Schedule 1 of the Act)

Additional Regulatory Bodies

Depending on the nature of your service with us, you may also escalate data-related complaints to:

• Lending Partner Grievance / Banking Ombudsman: For complaints related to loan/credit data handling by our partner banks/NBFCs (cms.rbi.org.in)
• IRDAI Grievance Cell: For complaints related to insurance product data (bimabharosa.irdai.gov.in)
• SEBI SCORES: For complaints related to investment/securities data (scores.gov.in)

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification (for material changes)
• Displaying a prominent notice on our website

Your continued use of our services after changes constitutes acceptance of the updated policy.