Privacy Policy

This Privacy Policy outlines how Flexpaisa Services Private Limited ("Flexpaisa", "we", "our", or "us", CIN: U66190HR2026PTC150421) collects, stores, processes, and protects your personal and financial data when you visit or use our digital lending marketplace website (https://flexpaisa.com) and associated services. Flexpaisa operates as a digital loan aggregator and marketplace that bridges prospective borrowers with Reserve Bank of India (RBI) registered Banks and Non-Banking Financial Companies (NBFCs). We are committed to safeguarding your privacy in strict compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act (DPDPA), 2023, and the RBI Guidelines on Digital Lending (September 2022).

To evaluate your loan eligibility and connect you with suitable RBI-regulated lending partners, we collect the following categories of information strictly on a need-to-know basis: • Identity & Personal Data: Full Name (as per PAN), Date of Birth, Gender, and Residential Pincode with City/State. • Contact Details: Mobile Number and Email Address (for OTP authentication, application status updates, and customer communications). • Financial & Professional Profile: Permanent Account Number (PAN), Monthly In-Hand Income, Employment Type (Salaried, Self-Employed, or Business Owner), and Desired Loan Amount. • Technical & Device Metadata: IP Address, browser type, operating system version, referring URLs, UTM campaign attribution parameters, and timestamp logs recorded during OTP verification for verifiable audit trail compliance. We DO NOT access, read, or store your private SMS messages, contact lists, media files, biometric information, or bank account login passwords.

We process your data strictly for legitimate, lawful purposes based on your explicit consent: • Eligibility Matching: To assess your credit profile against eligibility parameters of partner Banks/NBFCs and display personalized loan options. • Verification & Authentication: To authenticate your identity and mobile number via secure One-Time Password (OTP) validation. • Application Referral: To transmit your preliminary loan enquiry to partner RBI-regulated lending institutions that you choose to apply with. • Communication & Service Updates: To send application status notifications, policy updates, and customer service assistance via SMS, Email, Call, or WhatsApp. • Fraud Prevention & Legal Compliance: To adhere to statutory audit requirements, prevent financial fraud, and satisfy reporting obligations under Indian law.

In adherence to Section 6 of the Digital Personal Data Protection Act, 2023, and RBI Digital Lending Guidelines, user consent on Flexpaisa is: • Free, specific, informed, unconditional, and unambiguous. • Executed via verified OTP sent to your registered mobile number. When you submit an eligibility or loan application form and verify your OTP, our system automatically creates an immutable digital consent log containing: (i) Verified mobile number and user identifier; (ii) Exact timestamp (Date & Time); (iii) Client IP address and device user-agent; (iv) Version of Terms and Privacy Policy consented to. You reserve the unconditional right to withdraw your consent at any time by writing to flexpaisaservices@gmail.com.

We maintain a zero-tolerance policy against selling or renting your personal data: • Partner Lending Institutions: When you initiate a loan application or click to view lender details, your profile data is shared solely with RBI-registered Banks and NBFCs for credit underwriting, bureau checks, and loan sanctioning. • Regulated Service Providers: We may share limited operational data with trusted infrastructure providers (e.g., SMS gateways, cloud hosting, email service providers) under strict non-disclosure and data protection contracts. • Legal & Regulatory Mandate: We may disclose information if required by law, court subpoena, judicial directive, or government enforcement agency in compliance with statutory provisions.

Your security and trust are fundamental to Flexpaisa: • 256-Bit SSL/TLS Encryption: All data in transit between your browser and our servers is protected using enterprise-grade TLS 1.3 cryptographic protocols. • Domestic Data Residency: In compliance with RBI directives on data localization, all user records and databases are stored securely in ISO 27001 and SOC2 compliant cloud data centers located exclusively within the territorial boundaries of India. • Restricted Access: Administrative access to sensitive user data is strictly controlled through multi-factor authentication and role-based access privileges. • Vulnerability Scanning: We perform regular automated security audits and code reviews to preemptively mitigate cybersecurity vulnerabilities.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or as mandated by statutory guidelines: • Active Profile Data: Retained while your account remains active or to service ongoing loan matchmaking. • Consent & Verification Logs: Preserved for a statutory period of 5 years to satisfy regulatory compliance under RBI and Indian lending directives. • Right to be Forgotten: You may request complete erasure of your profile and personal data from our active systems by visiting our online Delete Account portal (/delete-account) or by sending an email to flexpaisaservices@gmail.com with the subject "Data Erasure Request". We will process eligible requests within 30 business days.

As a data principal under the Digital Personal Data Protection Act, 2023, you enjoy the following enforceable rights: • Right to Access: Request a summary of personal data being processed by us. • Right to Correction & Updating: Request correction of inaccurate, outdated, or incomplete details. • Right to Erasure: Request deletion of data that is no longer required for the purpose it was collected. • Right to Grievance Redressal: Access a designated Grievance Redressal Officer to address complaints within statutory timelines. • Right to Nominate: Nominate an authorized individual to exercise rights on your behalf in the event of death or incapacity.

We use strictly essential and analytical cookies to ensure platform functionality, remember session authentication tokens, and evaluate conversion performance from advertising campaigns (e.g., Google Ads, Meta Ads UTM parameters). We do not deploy intrusive third-party cross-site trackers or spyware. You can adjust your browser settings to decline cookies, though certain platform features may become restricted.

In compliance with the Information Technology Rules, 2021, the Digital Personal Data Protection Act, 2023, and the RBI Guidelines on Digital Lending, Flexpaisa provides a transparent grievance redressal mechanism. Level 1 — Internal Grievance Redressal Officer: If you have any questions, concerns, or complaints regarding your personal data or this policy, please reach out to: • Grievance Officer: Umesh • Entity: Flexpaisa Services Private Limited (CIN: U66190HR2026PTC150421) • Attention: Grievance Redressal Officer • Email: flexpaisaservices@gmail.com • Registered Location: Haryana, India • Turnaround Time: Acknowledgement within 48 hours; resolution within 30 business days. Level 2 — Escalation to Reserve Bank of India (RBI): In the unlikely event that your grievance remains unaddressed or unresolved within 30 days by us or the respective partner Regulated Entity (RE), you reserve the right to escalate your complaint directly to the Reserve Bank of India: • RBI Complaint Management System (CMS): https://cms.rbi.org.in • RBI Sachet Portal (for reporting unauthorized financial entities): https://sachet.rbi.org.in