Nofino Rural Finance Private Limited (“Nofino”, “Company”, “We”, “Us”, or “Our”) is committed to maintaining the confidentiality, integrity, and security of any personal and financial information collected from our users, borrowers, applicants, agents, and website/app visitors (“User”, “You”, or “Your”).

This Privacy Policy explains how we collect, process, store, disclose, transfer, and protect your personal data when you access or use our digital portals, mobile applications, offline services, loan application platforms, and financial products (collectively, the “Services”).

By accessing, browsing, registering, or applying for any product or service through our platform, you explicitly consent to the practices described in this Privacy Policy. If you do not agree with any part of this Policy, please do not use our platforms or submit your information to us.

To evaluate loan eligibility, provide microfinance or rural financial solutions, verify identities, complete statutory KYC compliance, and service account transactions, we may collect and process the following categories of data:

A. Personal Identifiable Information (PII)

• Demographic Details: Full name, gender, date of birth, age, marital status, nationality, and residential/permanent address.
• Government Identifiers: Permanent Account Number (PAN), Aadhaar details (voluntarily provided, masked/redacted per statutory norms), Voter ID, Passport, Driving License, or MGNREGA job card details.
• Contact Information: Mobile phone number, secondary contact number, landline, email address, and postal address.

B. Financial & Credit Information

• Banking & Income Data: Bank account numbers, IFSC codes, bank statement records, passbook copies, income details, source of earnings, and occupation/agricultural profile.
• Credit History: Credit score reports, borrowing history, existing repayment obligations, and default history retrieved from authorized Credit Information Companies (CICs) such as CIBIL, Equifax, Experian, or CRIF High Mark upon your explicit consent.
• Transaction Records: EMI payment schedules, transaction logs, loan disbursement histories, fine/penalty accruals, and repayment modes.

C. Technical & App-Based Data (Digital Channels)

• Device Information: IP address, operating system, unique device identifiers (IMEI, MAC address), browser type, and network connection parameters.
• Usage & Analytical Logs: Date and time stamps of app/web visits, screen navigation path, time spent on specific modules, crash reports, and system performance logs.
• Location Data: Coarse or precise geographical location data collected (with prior app-level consent) to confirm rural/field location for loan verification and underwriting purposes.

We gather data through three primary mechanisms:

1. Direct Collection: Information provided directly by you during registration, online/offline loan application forms, field-agent surveys, customer service calls, or document uploads.
2. Automated Collection: Technical information automatically recorded via cookies, web beacons, system access logs, and application SDKs when interacting with our digital interfaces.
3. Third-Party & Official Sources: Information lawfully received from credit bureaus, UIDAI verification systems, identity verification agencies, payment gateways, and banking partners.

Nofino processes your personal and financial data exclusively for lawful, contractual, and regulatory purposes, including:

• Identity Verification & KYC: Validating applicant identities, verifying documentation, and ensuring compliance with Anti-Money Laundering (AML) and Countering Financing of Terrorism (CFT) mandates.
• Credit Underwriting & Risk Assessment: Assessing creditworthiness, establishing appropriate loan limits, evaluating risk metrics, and structuring Equated Monthly Installment (EMI) plans.
• Servicing & Account Administration: Processing loan disbursements, collecting repayments, managing EMI collection schedules, calculating interest or late payment charges, and providing customer support.
• Communication & Notifications: Sending transactional SMS, WhatsApp updates, email alerts, payment reminders, statement disclosures, and regulatory notifications.
• Product Improvement & Fraud Prevention: Detecting, preventing, and mitigating fraudulent transactions, security breaches, unauthorized system access, or illegal activities.
• Regulatory & Legal Compliance: Submitting statutory reports to credit bureaus, law enforcement agencies, judicial authorities, and statutory regulators when required by law.

Nofino does not sell, rent, or trade your personal data to third parties for commercial cross-selling. We only share information under strictly controlled conditions with the following entities:

1. Credit Information Companies (CICs): Your loan status, borrowing performance, payment history, and default records are regularly submitted to licensed credit bureaus as mandated by financial regulations.
2. Service Providers & Technical Partners: Third-party vendors who assist in payment processing, SMS/communication gateways, cloud hosting, IT support, e-KYC verification, and digital signature integration. These providers operate under confidentiality agreements and are bound to process data only on our instructions.
3. Co-Lending & Banking Partners: Financial institutions or NBFC partners involved in co-lending, funding, or servicing your specific loan arrangement.
4. Legal & Regulatory Authorities: Government bodies, statutory courts, regulatory authorities (such as the Reserve Bank of India, Income Tax Department, or Registrar of Companies), or law enforcement agencies when compelled by a valid legal subpoena, court order, or statutory requirement.
5. Business Restructuring: In the event of a merger, acquisition, corporate restructuring, or asset sale involving Nofino Rural Finance Private Limited, customer data may be transferred to the successor entity subject to this Privacy Policy.

We implement administrative, technical, and physical security measures designed to safeguard your personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction.

• Encryption Standard: Financial data and sensitive credentials transmitted online are encrypted using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) protocols.
• Access Control: Internal access to your personal data is limited strictly to authorized personnel on a strict "need-to-know" basis.
• Storage Protection: Data is hosted on secure cloud infrastructure located within India, adhering to recognized industry cybersecurity frameworks and data sovereignty laws.

Nofino retains personal and financial data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, auditing, regulatory, or reporting requirements:

• Active Loan Accounts: Data is retained throughout the active term of the loan or financial service agreement.
• Post-Closure Records: Following complete repayment and loan closure, personal and transaction records are retained for a minimum period of 7 to 10 years (or as mandated under applicable tax, anti-money laundering, and corporate laws).
• Incomplete / Rejected Applications: Data from abandoned or rejected loan applications is retained for a limited duration necessary for auditing, fraud control, and dispute resolution purposes before being safely purged or anonymized.

Subject to local laws and regulatory constraints, you hold specific rights regarding your personal data:

• Right to Access & Review: You may request access to or a summary of the personal information we hold about you.
• Right to Rectification: You may request corrections or updates to inaccurate, outdated, or incomplete data.
• Right to Withdraw Consent: You may withdraw consent previously granted for data processing (e.g., marketing communications or optional permissions). Note: Withdrawing consent for core loan processing may require account closure or result in inability to process pending loan requests.
• Right to Grievance Redressal: You have the right to seek resolution for any privacy concerns through our designated Grievance Officer.

We reserve the right to amend, update, or modify this Privacy Policy at any time to reflect legal, regulatory, or operational changes. Any changes will become effective immediately upon posting the revised policy on our official website (https://nofinofinance.com). We encourage users to periodically review this page to stay informed about how we protect their information.