1. Introduction & Applicability

This Privacy Policy ("Policy") applies to MicroFinance Cooperative Society Limited ("we", "our", "us"), an RBI registered multi-state cooperative society. This policy describes how we collect, process, store, share, retain and protect your personal data when you use our website, mobile app, branch services, call center or any of our financial products.

By using any of our services, you explicitly consent to the collection and processing of your data as described in this Policy. If you do not agree, please do not use our services. This Policy is compliant with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and RBI Master Directions on Information Technology Governance, Cyber Security and DPR 2024.

2. Who is the Data Fiduciary?

Legal Name: MicroFinance Cooperative Society Limited
GSTN: 27AABCD1234E1Z2 | CIN: U65991MH2009PTC123456
Registered Office: 123 Financial District, Baner, Pune, MH 411045, India
Data Protection Officer (DPO): Mr. Data Keeper | Email: dpo@microfinance.co.in | Phone: +91-20-1234-5678 ext DPO

3. What Personal Data Do We Collect?

We collect only data that is necessary and lawful for the provision of banking/financial services. Specific categories include:

3.1 Identity & KYC Data (Mandatory as per RBI / PMLA Rules)

• Full name, photograph, signature, date of birth, gender
• Permanent Account Number (PAN)
• Aadhaar Number / VID (for e-KYC verification with UIDAI)
• Voter ID, Driving License, Passport (as alternate address proof)
• Nominee details (name, relation, DOB, photo where applicable)
• For entities/companies: PAN, GSTIN, CIN, DIN, KYC of all directors/partners, beneficial ownership details u/s 89 of Companies Act

3.2 Contact Data

• Mobile number, email address, communication address (permanent, current, office)
• Emergency contact numbers (for loan recovery / security)

3.3 Financial & Transaction Data

• Account balances, transaction history, deposit/loan schedules, interest calculations
• Salary slips, ITR, balance sheets (for loan credit appraisal)
• Collateral / security documents, title deeds, mortgage records
• CIBIL / Credit Bureau reports and score

3.4 Technical Data (when you use digital channels)

• IP address, device ID, browser fingerprint, OS version, UDID
• Location data (only when app is in use, for branch/ATM locator feature — NEVER sold/shared with advertisers)
• Biometric fingerprint / face data (only for app login biometrics — stored on your device in encrypted Android Keystore / iOS Secure Enclave; NEVER sent to our server)
• Service usage logs, clickstream, pages visited (for security audit, fraud detection and UX improvements)

4. How & Why We Use Your Data (Lawful Purposes)

Every processing activity has a lawful basis under DPDP Act. We process data for:

1. Contract Performance: Opening your account, executing deposit/loan agreements, processing transactions, sending statements, providing passbook and all agreed services.
2. Legal / Regulatory Compliance: KYC/AML/CFT as per PMLA 2002, RBI directions, Income Tax, GST, EPF, stamp duty, court orders, summons, law enforcement requests.
3. Legitimate Interest (non-intrusive): Credit risk assessment, fraud prevention, cyber-security monitoring, service quality improvements, member satisfaction surveys.
4. Explicit Consent (opt-in only, revocable anytime): Marketing/promotional SMS/email/WhatsApp, new product offers, referral programs, third-party insurance/cross-sell.

5. Who Do We Share Your Data With?

We NEVER sell, auction, rent or monetize your personal data to advertisers, data brokers, or marketing companies — EVER. Data may be shared only in following strictly controlled scenarios:

5.1 With your explicit consent (opt-in)

• Our insurance partners (LIC, Star Health, etc.) for the insurance products you opted to purchase through us
• Mutual fund / investment partners if you explicitly requested such services

5.2 Statutory / Regulatory bodies (without consent but with legal mandate)

• Reserve Bank of India, Registrar of Cooperative Societies, State CID, Enforcement Directorate, CBDT, GSTN, EPFO, SEBI, IRDAI
• Any court/tribunal order, summons, warrant or legal directive
• CICs (Credit Information Companies like CIBIL, Experian, Equifax, CRIF) as per Credit Information Companies (Regulation) Act — mandatory sharing for all loan/credit accounts

5.3 Auditors & Professional Services (under strict NDA)

Statutory auditors (Chartered Accountants), concurrent auditors, internal auditors, legal firms, valuation agencies, cybersecurity auditors — all bound by strict professional secrecy obligations and non-disclosure agreements with us.

5.4 Our Cloud & Technology Vendors (Data Processors)

We use the following processors who process data strictly on our instructions (as "Data Processor" under DPDP):

• Cloud Infrastructure: AWS India (Mumbai region) — ISO 27001, SOC 2 Type II, RBI empaneled
• Core Banking Solution: Finacle (Infosys)
• SMS / WhatsApp Gateway: Gupshup (RBI approved)
• Email Service: Zoho Mail India

All processors have signed Data Processing Agreements (DPAs) with us mandating EU-SCHREMS-II level safeguards including no cross-border transfer outside India. All customer data is stored in India only, within Mumbai region servers.

6. Data Retention Policy (How Long We Keep Your Data)

• Active member data: lifetime of relationship + 10 years after account closure (as per RBI master direction on record retention)
• Anti-Money Laundering / KYC records: 10 years after relationship ceases (PMLA Rule)
• Tax & financial records: 8 years after end of relevant assessment year (Income Tax Act)
• Legal case / recovery records: Until final disposal of case + 3 years
• Web/server logs: 180 days (MeitY guideline); audit logs: 7 years
• Marketing consent data: Until consent is withdrawn or 2 years of inactivity

7. Data Security — How We Protect Your Data

Security is not a feature, but a mindset. Following safeguards are implemented:

1. Encryption: AES-256 bit encryption for data at rest; TLS 1.3 for all data in transit. Sensitive fields (Aadhaar, PAN, account numbers, card) tokenized and masked.
2. Access Control: Role-based access (RBAC), least privilege principle, mandatory 2FA for all employees, biometric access to data centers.
3. Physical Security: ISO 27001 certified data centers, 24x7 CCTV, biometric + 3-factor access, 4 eye principle for core banking changes.
4. Cybersecurity: Next-gen WAF, DDoS protection, Intrusion Detection, SIEM with real-time SOC monitoring, quarterly VAPT (by CERT-In empanelled auditor), annual red-team exercise.
5. Employee Training: Mandatory data protection & cyber-hygiene training for all 500+ employees on joining + annually. Strict employee NDAs; disciplinary action up to termination for privacy breaches.
6. Incident Response: Documented IR-SOP. Any personal data breach will be notified to affected individual within 72 hours and to DPB within statutory timeline.

8. Your Rights as a Data Principal (Exercisable under DPDP Act)

You have the following rights, absolutely free of cost:

• Right to Access: Obtain copy of all personal data we hold about you, along with categories of processing and sharing details.
• Right to Correction / Update: Rectify inaccurate or incomplete data (mobile, address, nominee etc.) via app, net-banking, branch or written letter.
• Right to Data Portability: Receive your KYC + account + deposit + loan data in a standard structured, machine-readable JSON / CSV format, within 30 days.
• Right to Erasure ("Right to be Forgotten"): Request deletion of personal data, subject to statutory retention obligations under RBI/PMLA/IT laws. Where legal retention applies, data will be anonymized / archived (not actively processed).
• Right to Withdraw Consent: For all consent-based processing (e.g. marketing messages) you can revoke consent anytime via app settings, SMS "STOP" to 99999, toll free 1800-123-4567, or by emailing dpo@microfinance.co.in.
• Right to Grievance Redressal: Our DPO will acknowledge within 72 hours and dispose your grievance within 30 days. If not satisfied, you may appeal to the Data Protection Board of India.

To exercise ANY of these rights: (a) Login to mobile app → Profile → Privacy Center, or (b) Email dpo@microfinance.co.in from registered email, or (c) Written request to Registered Office with self-attested ID proof, or (d) Call Toll-Free +91 1800-123-4567 and ask for "Data Protection Officer".

9. Cookie Policy

We use cookies and similar tracking technologies on our website www.microfinance.co.in. Categories:

• ✅ Necessary cookies (always ON): Session, CSRF, captcha. You cannot opt out as website will break without them.
• 🔒 Analytics cookies (opt-in by default OFF): Anonymized page visits, UX analytics via Matomo (self-hosted, no data shared with Google/third parties).
• 🚫 Advertising / third-party cookies: We do NOT use any advertising cookies, ad pixels or third-party ad networks. Ever.

Manage your cookie preferences anytime by clicking "Cookie Settings" link in the footer. Your browser can also delete or block individual cookies.

10. Children & Minors Privacy

We do not knowingly solicit or collect data of children below 18 years. Accounts for minors (age 10+) are opened only jointly with natural guardian and all data is treated as guardian's. If you believe we inadvertently collected data of a child, contact DPO for immediate deletion.

11. Cross-Border Data Transfers

As a matter of policy, 100% personal data is stored and processed within the territory of India. There are NO cross-border transfers of any customer data to any country outside India. All our cloud regions are in Mumbai / Hyderabad, AWS India.

12. Third Party Links

Website/App may contain links to third party websites (e.g. NPCI, UPI portals, Income Tax, RBI). We are not responsible for privacy practices of such third parties. You are advised to read their respective policies before sharing data on those portals.

13. Policy Amendments

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. Material changes will be notified via:

1. Prominent banner on website and app for 30 days
2. Email and SMS to all registered members (material changes only)
3. "Last Updated" date at the top of this page will be revised.

Continued use of services after updated policy becomes effective constitutes your acceptance.

14. Grievance & Contact Information