Introduction

HDB Financial Services Limited (“HDBFS”, “we,” “us,” “our”) respects your privacy and is committed to safeguarding your Personal Information across all the available online and offline platforms including websites, mobile applications, offline interactions, physical branches, customer services, other points of sales, third party platforms, or all communications, by electronic means or otherwise, or any other mode or platform used by HDBFS (together, the “Services”). This Privacy Policy (“Policy”) explains how we collect, process, share, secure, retain, and allow access to your Personal Information as part of delivering our products and Services. Personal Information means any information relating to an identified or identifiable natural person (“Data Principal”) that includes without limitation to, name, identification number, financial information, location data, any online identifier or one or more factors specific to physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

By accessing or using our website https://www.hdbfs.com or HDB mobile applications or otherwise by providing your information, you will be deemed to have read, understood and agreed to the practices and procedures outlined in this Privacy Policy and consequently enable us to process your Personal Information which is collected during your interaction with HDBFS in accordance with the terms & conditions of this Policy.

Applicability

This Policy sets forth the expected behaviours of HDBFS in relation to Processing of Personal Information and applies to:

1. all Personal Information collected through any channel: digital, offline, service-oriented, or mobile.

2. all users of our products and services, prospective, current, or former customers.

3. Partners, third-party service providers, agents, or vendors who process Personal Information on our behalf.

Since our website may contain hyperlinks to third-party websites or services, this Privacy Policy applies solely to HDBFS and does not extend to the privacy practices of such third-party websites or features linked from our platform. We do not control these external sites and are not responsible for their content, privacy policies, or practices. We strongly encourage you to review the privacy policies of the third-party websites or services that you visit before sharing any Personal Information.

Privacy Principles

At HDBFS we uphold the following privacy principles to ensure that your Personal Information is processed lawfully, fairly, and in a transparent manner:

i. Collection of Relevant Data: We collect your Personal Information solely for lawful purposes that are clear, specific, and necessary for delivering financial products and services tailored to your needs. We do not collect any Personal Information that is excessive or irrelevant.

ii. Use Limited to Specified Purposes: Your Personal Information is used strictly for the purposes that are informed to you at the time of its collection or as consented by you which may include without limitation to, providing the services or products requested by you, enhancing customer experience, personalizing content, fulfilling contractual or legal obligations, conducting analytics, ensuring system security, performing internal audits, and improving our services or operations. We do not process your Personal Information for any purpose that is incompatible with the originally specified purpose, unless you provide fresh consent or such processing is permitted by applicable law.

iii. Data Sharing with Safeguards: Your Personal Information is shared only with our authorised agents and verified third-parties subject to applicable laws and with adequate contractual safeguards.

iv. Legally Mandated Disclosures: Your Personal Information may be disclosed to government authorities, regulatory bodies, law enforcement, or judicial entities only when required under applicable law or pursuant to valid legal processes. While disclosing your Personal Information for the fulfilment of a legal requirement, we ensure that such disclosures are lawful, necessary, and proportionate.

v. Accuracy and Up-to-Date Records: We strive to ensure the accuracy and completeness of the Personal Information we maintain. You, as a Data Principal, have the right and responsibility to inform us of any updates or changes so that we may fulfil our obligation to ensure data accuracy.

vi. Data Security and Confidentiality: We implement robust technical and organizational measures to ensure the security, confidentiality, and integrity of your Personal Information against unauthorized or unlawful processing, accidental loss, destruction, alteration, or damage. In addition to technological safeguards, we maintain strict internal policies and procedures governing how your Personal Information is accessed, handled, and shared by our employees and authorized vendors, third-parties, and service providers.

viii. Controlled Access and Responsible Processing: All employees, group entities, and third parties processing your data are contractually bound to maintain confidentiality and may only access your data for legitimate uses allowed under applicable law.

What Information About You Do We Collect

We collect, process, and store different types of Personal Information based on your interactions with our Services, platforms, and offerings. These categories of Personal Information may include, but are not limited to, the following:

i. Identity & Verification Data: This includes without limitation to, your name, date of birth, contact details, government-issued identification documents, photographs, signatures, and biometric data used for identification or authentication.

ii. Financial & Transactional Data: It covers bank account and payment details, credit/debit card info, transaction records, credit history, loan data, income, and repayment patterns.

iii. Technical, Usage & Device Data: We collect data generated from the use of our website, mobile apps, or digital services, which may include IP/MAC addresses, device identifiers, browser and OS info, cookies, app logs, and telemetry data gathered during digital interactions.

iv. Behavioural & Analytics Data: We may capture how you use our services clicks, page views, session duration, geolocation, search activity, and engagement patterns for analytics.

v. Communications & Support Data: We may retain CCTV footages, call recordings, chat logs, emails, feedback forms, complaint records, social media interactions, and survey responses which is collected through customer interactions.

vi. Marketing & Preference Data: This includes data from credit bureaus, past employers, financial partners, publicly available social media, government databases, or vendors enriching your profile.

vii. Third-Party & Affiliated Data Sources: We may collect Personal Information from third-party and affiliated sources such as credit bureaus to verify creditworthiness and financial history, employers for employment data, affiliated group entities for integrated financial services, government agencies and public databases for identity verification, taxation and compliance verifications, and publicly available information from social media platforms. Additionally, we may receive marketing or validation data from licensed data vendors, analytics platforms, information on fraud detection services, and transaction information from payment gateways.

viii. Health-related Data: We may collect data related to medical or health-related information necessary for insurance or wellness-related services.

ix. Children’s Data: Our Services are not directed to children under the age of 18, and we do not knowingly collect Personal Information from minors. If it is discovered that data has been collected from a minor without verifiable parental or guardian consent, we shall take immediate steps to delete such information. Parents or guardians may contact our Data Protection Officer at dpo@hdbfs.com to request the erasure of such data.

How We Collect and Use Your Personal Information

We may use your Personal Information to:

i) Direct Collection: We collect your information directly from you when you interact with us through various channels, including but not limited to:

• Loan application, availing our lending products and services, account registration on our website, mobile application, or in-person onboarding, where you may provide information such as your name, mobile number, email address, and identification documents.

• Filling out forms, surveys, feedback requests, or other data collection points, either online or offline, for availing Services, providing feedback, or participating in promotional activities.

• Customer support interactions, such as telephonic conversations, chat transcripts, emails, or grievance redressal queries, where you may share your Personal Information.

• Document uploads including KYC submissions, income proof, address verification documents, and other supporting documents required for loan eligibility.

• Use of device-specific features, such as device location, biometric login, camera access, and push notifications, subject to your explicit consent at the time of activation.

These data are collected with your knowledge and, where applicable, with your express consent, and are processed only for lawful purposes clearly communicated to you.

ii) Automated Collection: We use automated tools to capture data when you interact with our website, mobile application, or other digital platforms. This includes:

• Cookies, tracking pixels, and beacons: Used to authenticate sessions, prevent fraud, measure usage patterns, and enhance site/app functionality. We provide cookie consent mechanisms in compliance with DPDP Act and IT Rules. For more details on such digital tracking technologies, please visit our Cookie Policy.

• Server and transaction logs: Collect IP address, device/browser identifiers, session timestamps, login attempts, OTP usage, and failure/error logs for fraud monitoring and audit trails.

• Mobile telemetry and analytics: Captures app usage patterns, screen flow, crash logs, operating system version, mobile carrier data, and screen resolutions to optimize performance and security.

• Third-party integrations: Data passed through payment gateways, e-signature providers, or OTP validation services may result in limited automated data capture under secure and encrypted channels.

These tools are configured to minimize Personal Information wherever possible and are used only for the purpose of legitimate use and maintaining compliance with applicable laws.

iii) Third-Party Collection: In accordance with financial regulations and contractual arrangements, we may receive or collect your data from third parties including:

• Regulated entities: Including credit information companies, Aadhaar-based eKYC, NSDL/CDSL, CKYC Registry, and DigiLocker for document verification, subject to your prior consent or regulatory mandate.

• Employer or Corporate Partner: Where you are part of an employer-sponsored financial product (e.g., payroll-linked loans, group insurance, NPS), your employment and identification details may be shared by your employer.

• Affiliates and Group Companies: If you use products or services offered jointly with our group companies and affiliates, your information may be lawfully shared internally, for risk assessment, servicing, or cross-selling (with consent, where applicable).

• Channel Partners and Business Correspondents: Includes DSAs, partners, or aggregators who assist in onboarding, servicing, or distributing our financial products.

• Account Aggregators and Consent Managers: If you authorize sharing of your financial information via an Account Aggregator ecosystem or consent managers, data may be shared with us securely for the purposes you approve.

• Publicly Available or Commercial Sources: This includes government portals, electoral rolls, publicly available information on social media, or commercially procured databases, for verification, onboarding, or risk profiling.

Every such third-party collection is done in accordance with applicable laws, based on notice, consent, or other legal grounds as prescribed under applicable laws and relevant RBI/SEBI/IRDAI guidelines.

Cookies

Our website uses cookies to help us personalize our Services for you, remember your preferences, understand how users are using our website, and help customize our marketing communication.

Please read our Cookie Policy to know more about the cookies, the way we use them, and about how to opt-out.

Why We Collect Your Information

We collect and process your Personal Information only for lawful purposes and in a fair, transparent, and necessary manner in accordance with applicable laws and regulations. These purposes include, but are not limited to:

• Account Creation, Identity Verification & Transaction Authorisation: To provide lending services, open and manage accounts, verify identity through KYC/eKYC (including Aadhaar/PAN/CKYC), validate digital signatures, and authenticate financial or non-financial transactions.

• Service Delivery, System Security & Technical Operations: To provide and improve our digital lending and mobile applications which includes maintenance, error detection, data backups, risk mitigation, IT troubleshooting, and network security operations, in accordance with regulatory guidelines.

• Legal & Regulatory Compliance: To comply with obligations under laws and maintain audit trails mandated by regulators. This includes disclosures to courts, enforcement agencies, or financial regulators under due process.

• Personalization of User Experience & Marketing Communication: To customise product offerings, send targeted SMS/email/push notifications, deliver pre-approved loan offers, and serve interest-based advertising based on your preferences, transaction history, consent status, or eligibility. Our marketing communications are always subject to opt-out rights.

• Data Analytics, Performance Monitoring & Internal Training: To analyse service usage patterns, monitor customer satisfaction, improve customer journeys, and develop internal staff skills including use of anonymised or aggregated data for risk scoring, lead generation, or query resolution.

• Enabling Third-Party Product Offerings: To support access to partner-driven offerings such as digital product loans, health/life insurance, and credit bureau-linked services, which are always subject to your consent or contractual agreement with us or the third-party provider.

• Customer Engagement Programs: To conduct customer surveys, feedback experiences, contests, and community initiatives. This may involve contacting you for invitations, updates, or acknowledgments regarding your participation.

• h. Prevention of Financial Crime & Risk Monitoring: To detect, investigate, and prevent unauthorised access, fraudulent transactions, data breaches, identity theft, and money laundering. This includes use of AML software, fraud management systems, watch lists, and coordination with law enforcement authorities.

Legal Bases for Processing Your Personal Information

We process your Personal Information based on lawful grounds as outlined below:

• Consent: We seek your express consent for specific data processing activities that are not essential to the core functioning of our services. These include sending marketing communications, conducting behavioural profiling for product recommendations, enabling optional features such as contests, loyalty programs, or surveys, and utilising digital tracking technologies for personalised content or advertisements. Such consent is obtained in a clear, specific, and informed manner, and may be withdrawn by you at any time without affecting the lawfulness of prior processing.

• Performance of Contract: We process Personal Information when it is necessary for entering into or performing a contractual obligation with you or your authorised representatives. This includes activities such as opening and maintaining accounts, processing financial transactions, authenticating users, providing loan disbursals, insurance products, and communicating service-related information such as transaction alerts, payment reminders, or account statements.

• Compliance with Legal Obligations: We are mandated to collect, store, and process certain Personal Information in order to comply with statutory and regulatory obligations imposed by financial regulators and law enforcement agencies. This includes customer due diligence under the Prevention of Money Laundering Act (PMLA), Know Your Customer (KYC) norms, reporting obligations under applicable laws, compliance with taxation, and any lawful instructions issued by courts, law enforcement agencies, government authorities, or regulatory bodies in India.

• Legitimate Uses: We may process Personal Information for legitimate uses where such processing is reasonably expected by you as part of our Services. These purposes include fraud detection and prevention, cyber incident response, network and information security, internal audits, research and analytics using aggregated or de-identified data, grievance resolution, quality control, and employee training. All such processing is subject to appropriate safeguards to ensure your privacy is not harmed or overridden.

Disclosure of Personal Information and Third-Party Use

HDBFS is committed to maintaining the confidentiality and integrity of your Personal Information by limiting the collection, use and sharing of your Personal Information on a need-to-know basis to deliver better service to you. We do not disclose or share your Personal Information with any third party unless such disclosure is necessary to fulfil lawful, contractual, regulatory, or operational obligations, as outlined below. HDBFS may disclose or share your Personal Information when necessary to:

1. provide, operate, or improve our services and financial products offered to you, including through our group companies and affiliates;

2. comply with applicable laws, regulatory directions, court orders, or enforcement agency requirements;

3. protect and defend the legal rights, interests, or property of HDBFS, its affiliates, group companies, employees, or customers;

4. enforce our terms and conditions or resolve disputes; and

5. protect the interests, safety, or rights of HDBFS, its clients, stakeholders, or other persons, including the detection and prevention of fraud or financial crime.

To facilitate the above purposes, your Personal Information may be shared with such third parties, who are contractually obligated to process the data in accordance with applicable laws. These third parties include:

• Group Companies and Affiliates: Data is shared for operational continuity, shared infrastructure, joint service offerings, or business support functions;

• Authorized Service Providers: This includes financial partners, IT vendors, cloud service providers, customer support operators, marketing and communication partners, data analytics firms, logistics providers, and document management services;

• Financial Partners: Data may be shared with fintech companies, credit bureaus, payment gateways, and insurance companies, for the purpose of credit assessment, payment processing, loan servicing, or insurance underwriting;

• Successors, Assignees, and Reorganised Entities: We may share your Personal Information with any person or entity to whom we may transfer or assign our rights and/or obligations under any agreement, or in connection with any business restructuring, merger, sale, acquisition, transfer of business, or similar transaction. In such cases, your Personal Information will continue to be processed for the same purposes originally consented to or communicated to you, and the recipient will be contractually bound to maintain equivalent standards of data protection as mandated under applicable laws.

• Governmental, Regulatory, and Judicial Authorities: This includes the Reserve Bank of India (RBI), Securities and Exchange Board of India (SEBI), Insurance Regulatory and Development Authority of India (IRDAI) judiciary, or other law enforcement and tax authorities, when disclosure is mandated under applicable law or pursuant to official direction;

• Corporate Transaction Counterparties: Your data may be shared under strict confidentiality as part of a merger, acquisition, restructuring, or investment transaction;

• Insurance or Health Services Providers: Where applicable, Personal Information may be shared only with your express consent, for life, accident, health insurance, or allied medical underwriting;

• Marketing and Advertising Partners: Subject to your explicit opt-in consent, for conducting interest-based advertising, analytics, and customer segmentation initiatives.

HDBFS ensures that all third parties receiving your data are subject to appropriate contractual safeguards, technical controls, and audit mechanisms to prevent unauthorised access, use, or disclosure of your Personal Information. Your data is never sold to any unaffiliated third party.

A current list of these third parties with whom your data may be shared, would be updated shortly. This list is subject to periodic updates as we engage or remove vendors based on business needs and compliance requirements. We encourage you to regularly visit this Privacy Policy and the linked vendor list to stay informed about the current list of third parties we work with. Your continued use of our services constitutes your acknowledgment of any changes made to this list.

Data Retention

HDBFS may retain your Personal Information for as long as required to provide you with the Services in accordance with applicable laws and internal policies, such as management of your relationship, dealing with any concerns that may arise, or if required for compliance with any legal or regulatory requirements, or for the institution, enforcement, or defence of legal claims. HDBFS may also retain your Personal Information where we need to use it for our business and related purposes, including but not limited to, responding to queries or complaints, fighting fraud and financial crime or pursuant to contractual obligations.

Security and Incident Management

At HDBFS, we follow strict security practices and follow the standards prescribed by applicable law to safeguard your Personal Information. We use advanced tools like encryption, firewalls, and secure login systems to keep your data safe when you interact with us through our website, mobile apps, or any digital channel. Our systems are designed to stop unauthorized access and keep your data confidential and secure.

While we prioritize securing your Personal Information by adopting appropriate physical, technical, administrative, and organizational security measures, you also play a part in protecting your own information by:

• using strong, hard-to-guess passwords.

• never sharing your passwords or OTPs.

• Not using public or shared devices.

• Reporting to us right away if you have noticed any suspicious activity.

To ensure that your information is protected at every stage, we regularly update our systems to stay ahead of evolving threats and our employees and partners are trained and legally required to protect such information.

Your Rights as a Data Principal

You have several rights regarding your Personal Information, which you may exercise by contacting us at dpo@hdbfs.com:

• Right to Access: You can request details and a copy of the Personal Information we process about you.

• Right to Correction: If any information that we hold about you is inaccurate or incomplete, you may request prompt rectification.

• Right to Erasure: You may ask us to delete your Personal Information, subject to applicable legal or regulatory requirements.

• Right to Withdraw Consent: You may withdraw previously given consent for data processing, which however, may affect service availability.

• Right to Nominate: You may nominate an individual to act on your behalf in case of your death or incapacity, in accordance with applicable rules.

Please Note: These rights are not absolute. They are subject to compliance with applicable laws, regulations, contractual obligations, legitimate uses, and the need to establish or defend legal claims. Exercising certain rights such as erasure or withdrawal of consent may limit or impact our ability to offer you our Services or access to specific features.

Your Duties as a Data Principal

While exercising your data protection and privacy rights every Data Principal shall adhere to the following duties:

• Compliance with Applicable Laws: The Data Principal shall exercise their rights in accordance with the provisions of applicable laws in force. Any action taken in violation of such laws shall not be protected under the rights granted by such law.

• Prohibition on Impersonation: The Data Principal shall not impersonate another individual while submitting or supplying Personal Information for any lawful purpose, including the availing of any service or benefit.

• Disclosure of Material Information: The Data Principal must not deliberately suppress or misrepresent material information while providing Personal Information that is intended for official identification or documentation, including but not limited to identity cards, proof of address, or unique identifiers issued by the Government or its instrumentalities.

• Responsibility in Grievance Filing: The Data Principal shall not file false, frivolous, or misleading complaints or grievances with HDBFS or misuse grievance mechanisms.

• Furnishing Authentic Information: When requesting the correction, updating, or erasure of Personal Information, the Data Principal is required to submit only verifiably authentic and truthful information.

Consent Withdrawal, Opt-Out and Preference Setting

You have the right to withdraw your consent to the processing of your Personal Information at any time, subject to applicable laws. If you wish to do so, please submit a duly filled Consent Withdrawal Form using your registered email ID to: customer.support@hdbfs.com. Upon receipt and verification of your request, HDBFS will process the withdrawal promptly and in any case no later than 30 calendar days.

Please note that:

• Certain Personal Information may continue to be retained by HDBFS to comply with applicable legal, regulatory, contractual, or audit obligations.

• Withdrawal of consent may impact Service delivery or restrict access to features or offerings that require such processing.

• You will be notified of any such limitations at the time of processing your request.

In addition to consent withdrawal, you may also customize your data-sharing preferences or opt out of non-essential communications such as marketing messages, newsletters, analytics tracking) by:

• Adjusting settings through your user account or mobile app;

• Using the “Unsubscribe” or “Manage Preferences” link included in email communications;

• Contacting our Data Protection Officer or customer support team at dpo@hdbfs.com or customer.support@hdbfs.com

How Your Personal Information Is Processed When You Use Our Digital Lending Platform 

By applying for or accessing any lending product or service through our digital platform, you agree that your personal information will be collected, processed, and utilized for the following purposes, in accordance with applicable laws and your loan agreement:

• Credit Assessment & Financial Obligations: Your financial information is used to assess loan eligibility and determine suitable lending terms. Personal Information shared by you may be disclosed to third-parties such as recovery agencies and legal authorities in the event of delay if paying back the loan amount or default.

• Credit Information Reporting: Your loan activity including timely payments or defaults may be shared with registered credit information companies.

• Automated Underwriting & Profiling: Loan approvals, interest rates, and eligibility assessments may be made using automated systems that evaluates certain information about you such as your credit score, financial history, and transaction patterns.

• Notifications & Communication: In cases of late payments or account delinquency, we may send alerts or recovery communications via SMS, email, app notifications, or phone calls as per established norms and guidelines.

• Marketing & Relationship Management: Your Personal Information, including your usage patterns, transaction history, and relationship profile with us, may be processed to identify relevant products, services, or promotional offers suited to your financial needs or preferences which may include pre-approved loans, insurance products, and credit upgrades. Such offers may be communicated via SMS, email, app notifications, or phone calls.

• Permissions & Usage: To securely provide services, our mobile application may request access to certain device features. These permissions are activated only with your prior consent and can be managed via your device settings:

You may revoke these permissions at any time. However, certain functionalities may be dependent on mandatory regulatory requirements or specific product needs.

Changes to This Policy

This Policy is effective as of July 22, 2025 and may be amended, modified, and/or updated periodically and without prior notice to you. When changes are made to this Policy it will be posted to the website. We recommend that you check this page from time to time to inform yourself of any changes in this Policy. Continued use of our website after updates are posted will be considered as your acceptance of the revised Policy. This Privacy Policy shall be reviewed annually to ensure its continued relevance and effectiveness and shall also be updated at any time in response to changes in applicable laws, regulations, or business practices that necessitate such revisions.

Contact Information

If you have any queries on this Privacy Policy, or on the ways in which we process your data, or on your choices and your privacy rights, you may contact Data Protection Officer at dpo@hdbfs.com. We will make reasonable efforts to respond to your queries in accordance with applicable laws.

You may also write about your grievances with relating to this Policy, or the way your Personal Information is processed, or if you are not satisfied with the resolution provided for the queries raised by you by writing to customer.support@hdbfs.com.

Consent Withdrawal

If you wish to withdraw your consent for the processing of your personal data, you may send the duly filled Consent Withdrawal Form in the prescribed format to customer.support@hdbfs.com using your registered email ID. Once the consent withdrawal request has been verified, HDBFS will process it promptly, but no later than 30 business days. Please note that HDBFS may continue to retain certain data, including personal data, to comply with its legal and regulatory obligations. Withdrawing consent may affect certain services or functionalities provided by HDBFS.

"HDB Mobile Applications Privacy Policy"

Click here to view the app policy.