1. Who We Are
KrimKar Financial Services Pvt Ltd ("KrimKar", "we", "our", "us") operates the KrimKar digital lending platform accessible at krimkar.com and apply.krim.ai, and the KrimKar mobile application. We are the data controller for personal data processed in connection with loan applications and account management on our platform.
2. Data We Collect
To process your loan application and manage your account, we collect:
- Identity data: Full name, date of birth, PAN, Aadhaar number (hashed, not stored in plain text)
- Contact data: Mobile number, email address
- Financial data: Bank account details, salary / income information, bank statements (via Account Aggregator with your consent)
- KYC documents: Aadhaar-verified name and address via DigiLocker (fetched with your consent)
- Device data: Device type, OS version, IP address, app usage for fraud prevention
- Communication data: Records of conversations with Kira AI for quality and compliance
3. How We Use Your Data
- Verifying your identity (KYC) as required under RBI and PMLA regulations
- Assessing your creditworthiness and determining loan eligibility and rates
- Processing and disbursing approved loans
- Managing your loan account, repayments, and communications
- Preventing fraud and money laundering
- Complying with legal and regulatory obligations
- Improving our AI models and platform experience (anonymised and aggregated)
4. Data Sharing
We share your data only with:
- Lending NBFC partner(s): For credit assessment, loan origination, and regulatory compliance
- Credit bureaus: CIBIL, Experian, CRIF — for credit checks and bureau reporting
- Account Aggregator: RBI-licensed AA for secure, consent-based financial data sharing
- DigiLocker / UIDAI: For Aadhaar-based KYC verification
- Payment processors: For loan disbursement and EMI collection via NEFT/IMPS/NACH
- Regulatory authorities: RBI, FIU-IND, or any court/tribunal as required by law
We do not sell your personal data to third parties for marketing purposes.
5. Data Retention
Loan-related data is retained for a minimum of 8 years after loan closure, as required under Indian financial regulations (PMLA, RBI guidelines). Account data is deleted upon request after regulatory retention periods expire.
6. Your Rights
- Access: Request a copy of your personal data we hold
- Correction: Correct inaccurate or incomplete data
- Deletion: Request deletion of data not required for legal/regulatory purposes
- Portability: Receive your data in a structured, machine-readable format
- Objection: Object to processing for direct marketing
To exercise any right, email privacy@krimkar.com. We will respond within 30 days.
7. Security
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We implement access controls, audit logging, and regular security assessments. Aadhaar data is processed in compliance with UIDAI guidelines — we do not store Aadhaar numbers in plain text.
8. Cookies & Tracking
Our web platform uses essential cookies for session management and security. We use analytics cookies (with your consent) to improve the platform experience. You can manage cookie preferences in your browser settings.
9. Changes to This Policy
We may update this policy to reflect changes in law or our practices. Material changes will be notified via app notification or email. Continued use of the platform after changes constitutes acceptance.