Data Storage & Sharing Policy
Data Storage and Sharing Policy
1. Purpose and Scope
This Data Storage and Sharing Policy ("Policy") governs where and how Girdhar Finlease Private Limited ("GFPL") stores personal and business data, and the conditions under which data is shared with third parties – including regulators, Credit Information Companies (CICs), Lending Service Providers (LSPs) and Data Processors. It applies to all data collected across GFPL's products (short-term/30-day loans, EMI unsecured loans, Gold Loans, HL/LAP) and channels (branches, www.girdharfinlease.com, and the 30DaysLoan and FundsMama platforms), and binds all employees, LSPs and vendors.
It implements: the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025; the RBI (Digital Lending) Directions, 2025 (data collection, storage and localisation norms); the RBI Master Direction on Outsourcing of Information Technology Services, 2023 and the Master Direction on Managing Risks and Code of Conduct in Outsourcing of Financial Services; the RBI KYC Master Direction and PMLA record-keeping rules; and CICRA, 2005.
2. Data Classification
| Class | Examples | Baseline Controls |
|---|---|---|
| Restricted | KYC documents, Aadhaar (masked/offline XML), PAN, V-CIP recordings, bank statements, credit reports, collateral/property documents, biometric-adjacent artefacts (never stored) | Encryption at rest + in transit; strict need-to-know access with MFA; full audit logging; India-only storage |
| Confidential | Loan account data, repayment history, contact details, and complaint records | Encryption; role-based access; logging |
| Internal | Policies, internal MIS without personal identifiers | Access control |
| Public | Published rates, product brochures, and this Policy | Integrity controls |
3. Storage Architecture and Data Localisation
- System of record: production workloads and storage are hosted on Amazon Web Services – Asia Pacific (Mumbai, ap-south-1) Region, with the primary database layer on PlanetScale (managed MySQL). All production databases and object storage containing customer data must be pinned to India regions; region configuration is verified at provisioning and re-verified in half-yearly reviews.
- Digital lending localisation: all data collected by our DLAs and LSPs is stored on servers located in India, per the Digital Lending Directions. Where a vendor performs any processing outside India, contractual/technical controls require that the data is not retained offshore beyond the RBI-permitted window and the authoritative copy resides in India.
- Email/communications: corporate mail runs on Google Workspace and Microsoft 365 with data-region/residency features enabled for India where available; customer files must be shared through the core lending systems, not as loose email attachments, except where a documented process requires it.
- Backups and DR: encrypted backups replicate only to India-located availability zones/regions; DR drills at least annually.
- Endpoints: customer data must not be stored on personal devices or removable media; laptops are disk-encrypted with DLP controls [as per IT Policy].
Vendor residency directive
Mailgun (email verification), PlanetScale (database), Google Gemini (AI statement analysis), Google Workspace and Microsoft 365 are global services. For each, the accountable owner must (a) contractually fix the processing/storage region, choosing India wherever the provider offers it; (b) where India residency is not available for a component, restrict the data shared to the minimum (e.g., email address only to Mailgun), prohibit provider-side retention/training use, and configure zero-data-retention modes where offered (e.g., Gemini API with data-use-off settings); and (c) document the residual offshore processing in the Record of Processing and confirm conformity with the Digital Lending Directions' storage norms. No raw KYC document, Aadhaar data or V-CIP recording may be sent to any offshore-processing service.
4. Register of Third Parties – Data Shared and Safeguards
Sharing is permitted only for the purposes below, under a written agreement meeting Section 6 standards, and after due diligence under Section 7. The register is maintained by Compliance and reviewed half-yearly; the customer-facing summary appears in the Privacy Policy.
| Third Party | Role & Purpose | Data Shared | Key Safeguards / Residency |
|---|---|---|---|
| Signzy Technologies Pvt. Ltd. | Processor – Aadhaar offline/Digilocker & PAN verification; Aadhaar e-Sign of loan documents | Name, DOB, masked Aadhaar/offline XML, PAN, photo, address, document hashes for e-sign | DPA; India processing; no Aadhaar number storage by GFPL; e-sign per UIDAI/CCA norms |
| Novel Patterns Pvt. Ltd. | Processor – V-CIP (video KYC); penny-drop & penny-less bank account verification | Live video/photo, KYC images, geo-tag, bank a/c no., IFSC, name-match result | DPA; V-CIP per KYC Master Direction (recording retention with GFPL); India residency |
| CRIF High Mark / CRIF group | CIC (statutory) + Processor – credit reports; Account Aggregator TSP; bank-statement PDF analyser | Identity + loan performance data (CICRA); AA-consented financial data; bank statements | CICRA framework; AA data strictly per consent artefact; DPA for TSP/analyser services; India residency |
| Mailgun Technologies, Inc. | Processor – email verification & transactional delivery | Email address, name, message metadata/content of service emails | DPA/SCC-equivalent; minimum data; no marketing use; offshore processing documented – no KYC content |
| PlanetScale, Inc. | Processor – managed MySQL database | Application & account records (encrypted) | DPA; India (AWS ap-south-1) region pinning mandatory; encryption; access via GFPL IAM only |
| Amazon Web Services | Processor – cloud infrastructure & storage | All platform data incl. KYC objects | DPA/AWS GDPR-grade addendum; Mumbai region; KMS-managed encryption; CloudTrail logging |
| Google LLC (Gemini API) | Processor – AI segregation/classification of bank-statement entries | Statement transaction rows (narration, amount, date) – identifiers minimised/pseudonymised before submission | DPA; data-use-for-training disabled; zero/limited retention configuration; India/it-region processing where offered; output reviewed by credit ops |
| Google Workspace / Microsoft 365 | Processor – corporate email & productivity | Business communications that may contain customer data | Enterprise DPAs; MFA/DLP; India data-region settings where available; retention per Section 8 |
| Credit Information Companies (TransUnion CIBIL, CRIF High Mark, Experian, Equifax) | Statutory recipients – credit reporting & enquiries | Identity, account, repayment/default data | Mandated by CICRA; accuracy & correction timelines; enquiry only with consent/lawful purpose |
| CERSAI | Statutory – CKYC upload; security-interest registration (HL/LAP) | KYC records; charge/mortgage details | Statutory formats and access controls |
| Regulators / LEAs (RBI, FIU-IND, IT Dept., courts, police) | Statutory – supervision, STR/CTR, tax, investigations | As mandated/ordered | Verified legal basis; logged; DPO/Compliance sign-off |
| Banks / NPCI / payment aggregators [CCA/PayTm/RazorPay/PhonePe] | Processor/participant – disbursement, e-NACH/UPI mandates, collections | A/c no., IFSC, mandate & transaction data | PA/PG licences verified; payment-data localisation; reconciliation controls |
| DLAs – 30DaysLoan, FundsMama | Apps – sourcing, servicing support, collections support | Journey data collected on GFPL's behalf | DLAs are proprietary products of GFPL. |
| Legal counsel [DV & Associates] | Agents – enforcement | Contact & default details necessary for the case | Contact-hour limits; complaint-linked termination |
| Insurers [N/A] | Independent fiduciary – opted insurance | Proposal data with customer consent | Only on explicit opt-in; no bundling compulsion |
5. Sharing Rules
- No sale of personal data. Sharing occurs only: (a) with consent; (b) under legitimate uses/legal obligation; or (c) with processors/agents under contract for GFPL's specified purposes.
- Minimum necessary: each interface shares only the fields required (field-level mapping is documented per vendor); test environments use masked/synthetic data.
- Method: transfers occur over encrypted channels (TLS/SFTP/API with auth); bulk extracts require Compliance approval and expiry-bound links; ad-hoc sharing of Restricted data by email is prohibited.
- AA data: financial information obtained via Account Aggregators is used strictly per the consent artefact (purpose, date range, frequency, expiry) and never re-shared except as the consent permits.
- Aadhaar: GFPL does not store Aadhaar numbers; only masked Aadhaar/offline XML with share-code handling per UIDAI norms. Biometric data is never collected or stored.
- Intra-group/marketing: no sharing with any group entity or partner for their marketing without separate, explicit opt-in consent.
- Requests from authorities are honoured only against verified legal instruments, logged in the disclosure register, with DPO/Compliance approval; customers are informed where law permits.
6. Mandatory Contract Terms with Processors
- Processing only on GFPL's documented instructions for defined purposes; prohibition on use of GFPL data for the vendor's own purposes, including AI model training, unless expressly authorised in writing;
- Rule 6 security safeguards (encryption, access control, logging with 1-year minimum log retention, backups) and prompt breach notification to GFPL [within 24 hours of awareness];
- Storage/processing region commitments consistent with Section 3; sub-processing only with prior written consent and flow-down of all terms;
- Assistance with data-principal rights (access/correction/erasure) and with regulator requests; audit/inspection rights for GFPL, its auditors and RBI (including access to vendor premises/systems relating to GFPL data);
- Confidentiality surviving termination; return and verified deletion of data on exit, with certificates; business-continuity commitments and exit-management plan (no vendor lock-in of data);
- Compliance with the Digital Lending Directions where the vendor is an LSP/DLA (consent capture, no prohibited device permissions, GRO display, no repayment flows through the LSP's account).
7. Vendor Due Diligence and Ongoing Oversight
- Pre-onboarding: security & privacy assessment, financial soundness, regulatory standing, residency capability, and – for LSPs – the enhanced due diligence required by the Digital Lending Directions (technology standards, data practices, conduct history).
- Risk-tiered monitoring: annual reassessment for critical vendors (AWS, PlanetScale, Signzy, Novel Patterns, CRIF); periodic control attestations; right-to-audit exercised on a sample basis; incident and SLA reviews.
- The outsourcing register, including this Policy's vendor register, is reported to the Board/IT Strategy Committee as required by the RBI outsourcing directions; material outsourcing arrangements follow board-approved outsourcing policy approvals.
- Concentration and exit risk are assessed for critical processors; exit plans are documented.
8. Retention and Disposal Schedule
| Data Set | Retention | Basis |
|---|---|---|
| KYC records & identification data | 5 years after the end of the relationship | PMLA / KYC MD |
| Transaction & repayment records | 5 years from the transaction | PMLA |
| Loan files, KFS, agreements, and books of account | 8 years from the end of FY (longer if litigation) | Companies Act, 2013 |
| V-CIP & call recordings | ≥ 1 year | KYC MD / internal |
| Consent artefacts & notices | ≥ 7 years | DPDP Rules |
| Security/access logs & traffic data | ≥ 1 year | DPDP Rules / CERT-In |
| CCTV (branches/vaults) | 90 days (longer on incident) | Internal / gold-loan security |
| Rejected/withdrawn applications | ≥ 1 year | Internal |
| Complaint records | ≥ 3 years | FPC / internal |
| Auction records (gold) | 8 years | Gold Loan Directions/audit |
On expiry: electronic data is crypto-shredded/securely wiped (NIST 800-88 aligned); paper records are shredded with destruction certificates; processor deletion is instructed and evidenced. Legal-hold freezes destruction where litigation/investigation is pending.
9. Access Control and Internal Handling
- Role-based access mapped to job function; Restricted-class access requires manager + data-owner approval; quarterly access recertification; immediate revocation on exit/role change.
- Production access is via named accounts with MFA; shared credentials prohibited; privileged sessions logged.
- Downloads/exports of customer data are logged and DLP-monitored; screenshots/personal-device storage prohibited.
- Gold-loan collateral records and vault CCTV have dual-control access; property title documents are stored in fire-resistant safe custody with movement registers.
10. Breach and Incident Linkage
Any suspected unauthorised access, loss or disclosure is handled under the IT incident-response runbook – including notification to affected individuals without delay, to the Data Protection Board within the prescribed 72-hour detailed-report window, to CERT-In within 6 hours for notified incidents, and to RBI as applicable. Vendors must notify GFPL within the contractual SLA and cooperate fully.