Privacy Policy & Data Governance Notice

1. Statutory Context & Purpose

This Privacy Policy governs the collection, processing, storage, and erasure of personal data by HEUTE & MORGEN ASSETS PVT LTD ("H&M Assets", "Company", "We", "Us"), operating as a regulated Lending Service Provider (LSP) and Corporate Direct Selling Agent (DSA).

We are committed to full compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the RBI Digital Lending Directions, 2025.

2. Personal Data We Collect

We only collect data strictly necessary for digital credit evaluation, KYC, and servicing:

• Identity & KYC Data: Name, Mobile Number, PAN Number, masked Aadhaar token via DigiLocker, Gender, Date of Birth.
• Financial & Bureau Data: Income, bank statements (via Account Aggregator consent tokens), CIBIL / Experian / CRIF bureau score reports.
• Collateral Details: Gold grams and carat purity, vehicle registration number, or property tax receipts where applicable.
• Technical Logs: IP address, device identifier, session timestamps, and audit trails.

3. Purpose of Processing & Explicit Consent

Your personal data is processed solely for evaluating loan eligibility, sharing anonymized or consensual loan packs with chosen lending partners (ICICI, HDFC, Kotak, Shriram, Chola, IKF), generating statutory Key Fact Statements (KFS), executing e-NACH mandates, and complying with RBI regulatory reporting.

Zero Unauthorized Data Harvesting: We strictly do NOT access or harvest mobile contacts, call logs, media files, or device sensor data as mandated by the RBI Digital Lending framework.

4. Data Localization & Security Architecture

All customer and partner data is strictly stored within the sovereign territory of India on Amazon Web Services (AWS) Mumbai Region (ap-south-1). All data at rest is encrypted with AES-256 and data in transit is protected using TLS 1.3 cryptographic protocols.

5. Borrower Rights under DPDP Act 2023

As a Data Principal under Indian law, you have the right to:

• Right to Access & Summary: Request a summary of all personal data processed.
• Right to Correction & Erasure: Request rectification of inaccurate information or deletion of data once statutory loan records retention periods expire.
• Right to Grievance Redressal: Contact our designated Data Protection & Grievance Officer.
• Right to Nominate: Nominate an individual to exercise rights in the event of death or incapacity.

6. Contact Data Protection Officer (DPO)

For any privacy inquiries or erasure requests under the DPDP Act 2023, contact: