Privacy Policy

1. Introduction & Statutory Regulatory Framework

This Privacy Policy explains how Zolo Funds collects, processes, stores, protects, and discloses personal data and financial information when you access our websites, subscribe to our cloud services, or utilize our mobile applications. This policy has been drafted in strict accordance with the following Indian and international statutory standards:

• The Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) and statutory rules framed thereunder;
• The Information Technology Act, 2000, including Section 43A (compensation for failure to protect data) and Section 72A (punishment for disclosure of information in breach of lawful contract);
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules);
• The Reserve Bank of India (RBI) Guidelines on Digital Lending (2022) as applicable to Lending Service Providers (LSPs) and Technology Service Providers (TSPs);
• The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and UIDAI Circulars on masking and offline KYC;
• Google Play Developer Program Policies, including the User Data policy and Data safety disclosures.

2. Definitions Under This Policy

• "Data Principal": The individual to whom the personal data relates (including subscribing business administrators, loan officers, field collection agents, and end borrowers).
• "Data Fiduciary": The entity that determines the purpose and means of the processing of personal data. The subscribing Lender acts as the Data Fiduciary for borrower records; Zolo Funds acts as the Data Fiduciary for administrative account holders.
• "Data Processor": Any entity that processes personal data on behalf of a Data Fiduciary. Zolo Funds acts as a Data Processor regarding borrower data uploaded by subscribing Lenders.
• "Lender" / "Tenant": The business entity (NBFC, MFI, financier, chit fund manager) holding a valid subscription license on Zolo Funds.
• "Borrower": An individual or commercial entity that has applied for, received, or is servicing a loan issued by a subscribing Lender.
• "Personal Data": Any data about an individual who is identifiable by or in relation to such data.
• "Sensitive Personal Data": Passwords, financial information (bank accounts, payment instrument details), and biometric identifiers.

3. Categories of Data Collected

A. Subscribing Business & Staff Data (Direct Collection)

When an organization registers a tenant account or configures staff logins, we collect:

• Subscriber Identity Data: Full legal name, official email address, mobile phone number, date of birth, and encrypted authentication credentials.
• Business & Tax Identifiers: Legal entity name, trade name, registered corporate address, GSTIN, PAN, and certificate of incorporation / money lending license references.
• Billing & Subscription Records: Subscription tier, add-on modules, billing address, and transaction identifiers generated via authorized gateways (Razorpay). We do not record or retain raw credit card CVVs or net banking passwords.

B. Borrower & Loan Data (Processed on Behalf of Lenders)

Lenders utilize our multi-tenant database to manage their loan portfolios. Such data is uploaded by the Lender or collected via field agent applications:

• Borrower Profile: Full legal name, father's/spouse's name, residential address, mobile phone number, alternate emergency contact, and profile photograph.
• KYC Documents: PAN number, Aadhaar number (stored encrypted with AES-256-GCM and shown masked in the app), Aadhaar e-KYC details returned through our KYC partner when the lender uses Aadhaar OTP (name, date of birth, address, photo), and voter ID or driving licence images. Biometric templates (fingerprint/iris) are never collected.
• Loan Particulars: Loan account number, principal sanctioned, interest rate, disbursement date, repayment schedule (daily, weekly, monthly), EMI installment breakdown, penalty charges, and outstanding balances.
• Module-Specific Collateral Records:
  • Auto Finance: Vehicle registration number, chassis number, engine number, make, model, insurance policy expiry date, hypothecation status, and co-applicant details.
  • Gold Loans: Ornament itemization (bangles, chains, rings), gross weight, net weight, stone deduction, karat purity (22K, 18K), appraised valuation, and secure vault packet identifier.
  • Chit Funds: Chit group identifier, ticket number, monthly installment, auction bidding logs, prize distribution amount, dividend allocations, and guarantor details.

C. Device Telemetry & Technical Audit Data

When accessing our web portals or Android mobile application, our systems record:

• Technical Identifiers: IP address, device hardware model, Android OS version, unique app installation UUID, browser user-agent, and mobile network operator.
• Audit Timestamps: Exact login timestamps, failed authentication attempts, collection synchronization intervals, and API request latency.

4. Android Mobile Application Permissions (Google Play Store Disclosure)

The ZoloFund Android app is used by the staff of lending businesses (owners, branch managers and field collection agents). It does not offer loans to consumers. Every permission the app requests is listed below with its purpose:

5. Lawful Bases for Processing Under DPDP Act 2023

Zolo Funds processes personal data strictly under valid lawful bases established in Indian law:

• Consent (Section 6, DPDP Act): Subscribing organizations and administrative users provide explicit, informed consent upon registration. Lenders represent and warrant that they have secured valid consent from their borrowers prior to entering data into the platform.
• Legitimate Uses & Contract Performance (Section 7, DPDP Act): Processing necessary to fulfill our software subscription agreement, issue invoices, maintain database integrity, and calculate mathematical loan schedules.
• Statutory Compliance: Compliance with directives issued by the Reserve Bank of India, Prevention of Money Laundering Act (PMLA 2002), and Indian tax authorities.

6. Absolute Zero-Sale & Anti-Brokering Commitment

7. Third-Party Sub-Processors & Infrastructure Partners

We use the following service providers. Some are used only when a lender turns the feature on:

• Firebase Cloud Messaging (Google LLC): Real-time push notification delivery to Android smartphones.
• Razorpay Software Private Limited: PCI-DSS Level 1 certified payment gateway facilitating subscription billing for software plans.
• Hostinger International Ltd: virtual private server hosting our application and database in Mumbai, India.
• Digio Internet Pvt Ltd: Aadhaar OTP e-KYC and video KYC, when the lender enables KYC.
• CRIF High Mark and TransUnion CIBIL: credit reports, when the lender runs a bureau check.
• Google LLC: Google Sign-In (optional login), Firebase Cloud Messaging (push notifications) and on-device ML Kit (photo framing, QR scanning).
• Map tile provider: map images in the app and portal; the provider sees the device IP address and the map area being viewed.
• Meta WhatsApp Business Cloud API: Optional transactional messaging service used to send digital repayment receipts and overdue alerts directly to borrowers upon Lender configuration.
• MSG91 / Telemark Telecom Services: Optional DLT-registered SMS gateway for dispatching OTPs and payment acknowledgments.

8. Data Security & Cryptographic Standards

Zolo Funds maintains enterprise-grade technical and organizational security controls:

• Multi-Tenant Database Scoping: Logical separation enforced at the ORM and SQL boundary ensuring that Tenant A cannot access, query, or alter data belonging to Tenant B.
• Encryption in transit: all web and API traffic uses HTTPS (TLS 1.2 or 1.3) with HTTP Strict Transport Security (HSTS).
• Encryption of sensitive fields: Aadhaar numbers and integration credentials (API keys, payment-gateway secrets) are encrypted in the database with AES-256-GCM.
• Password Security: User passwords are one-way hashed using salted bcrypt and cannot be read or retrieved in plaintext by administrators or software engineers.
• Immutable Audit Trails: Financial entries (disbursements, repayments, waivers, write-offs) are append-only. Silent deletion or editing of financial records is blocked at the software engine level.

9. Data Retention & Archival Schedules

Data retention follows strict operational and statutory schedules:

• Active Subscription Period: Data remains accessible throughout the active term of the subscription agreement.
• Statutory Financial Records: Financial ledgers, repayment logs, customer sanction notes, and collection receipts must be preserved for up to eight (8) years following loan settlement pursuant to the Prevention of Money Laundering Act, 2002 and Income Tax rules.
• Ephemeral Technical Logs: Web server access logs, IP traces, and routing records are retained for 180 days in compliance with Indian Computer Emergency Response Team (CERT-In) directives, after which they are automatically purged.

10. Rights of the Data Principal & Account Deletion Protocol

Under the DPDP Act 2023 and Google Play Store policies, Data Principals possess the following enforceable rights:

• Right to Access: The right to obtain a summary of personal data being processed.
• Right to Correction & Updating: The right to correct inaccurate or misleading personal information.
• Right to Erasure (Account Deletion): The right to request the permanent deletion of user accounts and personal identifiers.
• Right to Grievance Redressal: The right to readily available grievance redressal mechanisms with defined resolution timelines.
• Right to Nominate: The right to designate a nominee in the event of death or incapacity.

Google Play Store Account Deletion Procedure:

Users may initiate account deletion at any time without fee or penalty:

1. Dedicated Deletion Portal: Visit our public Data & Account Deletion Request Portal (/delete-account).
2. In-App Settings: Navigate to Settings → Request Account Deletion in the ZoloFund Android application.
3. Email Verification: Send an email from your registered email address to support@zolofunds.com with the subject line "Account Deletion Request".

Processing Window: User authentication credentials, login sessions, mobile device tokens, and personal contact identifiers are permanently wiped within seven (7) business days of identity confirmation. Non-personal historical financial ledgers are archived in anonymized form to comply with statutory audit mandates.

11. Cross-Border Data Transfer & Indian Data Residency

In compliance with Indian data sovereignty principles and RBI digital lending directives, all primary customer databases, loan ledgers, and KYC archives are stored and processed on servers located in India (Mumbai). Some providers in section 7 (for example Google, for push notifications) may process limited data, such as device push tokens, outside India.

12. Protection of Children's Privacy

The Zolo Funds platform and Android application are designed exclusively for commercial financial operations and adult borrowers. We do not knowingly solicit or collect data from minors under eighteen (18) years of age. If we discover that personal data of a minor has been inadvertently collected without verified parental consent, we will take immediate steps to delete such data.

13. Grievance Redressal Mechanism & Officer Details

In accordance with Section 12 of the DPDP Act 2023 and the Information Technology Act, 2000, any questions, grievances, or disputes regarding data privacy should be addressed to our designated Grievance Officer:

14. Amendments to This Policy

We reserve the right to revise this Privacy Policy to accommodate legislative amendments, technological evolutions, or app store policy updates. Notice of material modifications will be delivered via email to registered tenant administrators and highlighted on the portal dashboard at least thirty (30) days prior to implementation. Continued use of our software constitutes acceptance of the amended policy.