DPDP Act Compliance

Indiloan is a Data Fiduciary — we decide the purpose and means of processing your personal data. You are the Data Principal. The service providers who process data on our behalf act as Data Processors under contract. We process your data only for clear, lawful purposes, with your consent or as otherwise permitted by the Act.

We ask for your consent before processing your personal data, and we give you a clear notice of what we are collecting and why. Consent is free, specific, informed, unconditional, and unambiguous — and you can withdraw it at any time. Sensitive steps — KYC, Aadhaar verification via DigiLocker, and a CIBIL credit pull — happen only after your explicit, separate consent.

• Right to access information about the data we process about you.
• Right to correction, completion, updating, and erasure of your personal data.
• Right to grievance redressal (see our Grievance Redressal page).
• Right to nominate someone to exercise your rights in case of death or incapacity.
• Right to withdraw consent as easily as you gave it.

You give consent through clear, purpose-specific requests in the app. You can withdraw any consent from your account settings or by contacting our Grievance Officer. Withdrawing consent will stop the related processing going forward; it does not affect processing already carried out, and some features (such as sharing your profile with a lender) may no longer be available once consent is withdrawn.

• Collect only the data we need, for stated purposes (data minimisation).
• Keep data accurate, complete, and protected with reasonable security safeguards.
• Not retain data longer than necessary for the purpose or as required by law.
• Use anonymization and document watermarking to limit exposure of your identity.
• Bind our Data Processors by contract to protect your data.
• Notify you and the Data Protection Board in the event of a personal data breach, as required.
• Appoint a Grievance Officer and respond to your requests within legal timelines.

For users below 18, processing requires verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, in line with the Act. The same protection applies to persons with disabilities who have a lawful guardian.

Our whole model is built to minimise data exposure: you browse anonymously, lenders see only non-identifying signals, and your identity plus documents reach exactly one lender — only after you choose them, and only with a traceable watermark. This is privacy by design, not as an afterthought.

For any DPDP-related request, contact our Data Protection contact at dpo@indiloan.in or our Grievance Officer at grievance@indiloan.in. We will verify your identity before acting on a request, to protect your data.