Privacy Policy
Collocate Merchants Private Limited (the “Company”, “Collocate”, “we” or “us”) is a Non-Banking Financial Company registered with the Reserve Bank of India (“RBI”), having its registered office at 2A, Ganesh Chandra Avenue, Commerce House, 5th Floor, Room No. 4A, Kolkata, West Bengal - 700013. We respect your privacy. This Privacy Policy explains how we collect, use, store, share and protect information about you (“you”, “Customer” or “User”) when you access our loan products through our approved Digital Lending App (DLA) and Lending Service Provider (LSP), LoanDidi (the “Platform”).
This Policy is framed in compliance with:
- the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
- the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
- the Reserve Bank of India (Digital Lending) Directions, 2025;
- the Digital Personal Data Protection Act, 2023; and
- other applicable laws, regulations and guidelines, including those issued by the RBI.
1. Consent
You provide your explicit, informed and freely given consent to the collection, processing, storage, sharing and use of your data by the Company and, where applicable, by our authorised DLA/LSP acting on our behalf, solely for the purposes described in this Policy and in compliance with applicable Indian law. Consent is obtained through clear and auditable means such as SMS-based consent, OTP confirmation, electronic forms and in-app notifications, depending on the category of data. We will not collect or use any personal, financial or device-level data without your specific consent for that category. You may withdraw consent at any time by contacting our Grievance Officer or through Platform settings; withdrawal will not affect prior lawful processing but may impact your access to certain services. The identity of the Regulated Entity (the Company), the LSP and the DLA is disclosed at every stage — the Platform interface, the sanction letter, the Key Fact Statement and the loan agreement.
Specific permissions
- SMS — with your consent, we read only the headers and indicative content of recognised financial-sender SMS for verification, credit evaluation and fraud prevention. We do not read personal messages or OTPs, except OTPs sent by us for authentication.
- Installed apps — our partner apps may collect the list of installed/system applications, shared securely with our device-intelligence processor, solely to detect fraud and assess risk. This is collected only with consent, stored in India and never sold.
- Location and device information — location (with consent) supports serviceability, risk reduction, customised offers, address verification and KYC; limited device information (model, OS, available storage, network status) is collected. We do not collect permanently identifiable device numbers such as IMEI.
- Phone state — requested only to verify the active SIM and network status at onboarding and disbursement, to confirm the transaction relates to the rightful customer.
- Camera and microphone — accessed only for e-KYC or video-KYC verification.
2. Collection of Information
Information is collected solely to deliver regulated digital lending and allied services, in line with the RBI Digital Lending Directions, 2025, the DPDP Act and the IT Act and Rules. Categories include user personal information (name, email, PAN, address, mobile, banking details); device information and installed-apps data; location, camera and microphone access for verification; third-party information such as credit-bureau data, KYC/payments-provider data and bank/UPI details for repayments; and user-provided information such as form submissions, KYC documents and correspondence. Aggregated, non-personal analytics and cookies are used to improve the user experience. Data is stored only in India.
3. Purpose of Use
- verifying identity and completing KYC as per RBI rules;
- assessing creditworthiness and loan eligibility;
- processing loan applications, documentation, disbursement (performed only by the Company) and repayment;
- providing loan servicing, repayment reminders and customer support;
- detecting and preventing fraud, money laundering and unlawful activity;
- resolving disputes, ensuring safety and improving our services; and
- delivering relevant communications and offers.
4. Disclosure and Sharing
We share information strictly on a need-to-know basis and only for lawful purposes: with the Company as the lender of record; with our DLA/LSP (LoanDidi) acting as our facilitator under confidentiality and data-protection obligations, which are not permitted to store borrower data beyond what is necessary for immediate processing; with authorised service providers (technology, KYC, payment gateways, the Company’s banker IDFC First Bank Ltd, credit-bureau interfaces, fraud-prevention and analytics); with credit bureaus (with your consent); for legal compliance; and, in a corporate transaction, with a successor entity subject to confidentiality. We will not sell or rent your personal information to any third party without your explicit consent.
5. Data Retention
Personal and financial data is retained only as long as necessary for the purposes of this Policy or as required by law, whichever is longer. As mandated under the RBI Digital Lending Directions, no personal, financial or device data collected through the DLA/LSP is stored by them beyond immediate processing; all such data is stored only with the Company, on servers located in India. Indicative retention timelines are: KYC and credit-underwriting records — minimum 10 years (per PMLA); loan documentation and repayment records — minimum 8 years after closure; customer grievances and correspondence — minimum 5 years; and non-personal aggregated data — retained for research and analysis.
6. Third-Party SDKs, Cookies and Security
- The Platform may use third-party SDKs/links for e-KYC, OTP authentication, digital signatures, payment gateways, credit-bureau integrations and analytics. While we exercise due diligence over partners, we do not control their privacy practices and encourage you to review their policies.
- We use cookies and similar technologies to improve your experience and analyse traffic; you may disable cookies, though some features may not function. We do not permit third-party advertising cookies or behavioural trackers on our lending apps/websites.
- We maintain physical, electronic and procedural safeguards, including encryption in transit and at rest, India-based secure servers, role-based and logged access, and regular audits and vulnerability assessments. Card/bank/UPI data is processed directly by authorised PCI-DSS-compliant payment gateways and is not stored by us. No system can be guaranteed as completely secure, and you acknowledge this inherent risk.
7. Your Rights
Under the Digital Personal Data Protection Act, 2023 and RBI guidelines, you have the right to access, rectify, withdraw consent, seek erasure (subject to statutory retention), restrict processing, port your data and seek grievance redressal. To exercise these rights, please contact our Grievance Officer.
8. Grievance Officer
In accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 and RBI guidelines, the Grievance Officer will acknowledge a complaint within 24 hours of receipt and endeavour to resolve it within 30 days, in accordance with the applicable regulatory framework.
9. Dispute Resolution, Governing Law and Updates
Disputes will first be attempted to be resolved amicably through mediation within 30 days, failing which they will be referred to arbitration under the Arbitration and Conciliation Act, 1996 by a sole arbitrator, with the seat at Kolkata and proceedings in English; the courts at Kolkata, India will have exclusive jurisdiction over residual matters. This Policy is governed by the laws of India. We may amend this Policy at any time, with the revised version posted on the Platform with an updated date; continued use signifies acceptance. By accessing the Platform and availing our services through LoanDidi, you acknowledge that you have read, understood and agreed to this Privacy Policy.