Last updated: 8 November 2026. This policy explains what personal data LOANZ 360 holds about you, why we hold it, who can see it, where it is kept and how you can control it. It applies to this website and to the LOANZ 360 customer, partner, employee and lender portals. The legal entity, its registered address and its contact details are shown on the contact page, and the details shown on that page are the ones this policy refers to.
In short: we collect only what we need to compare loan options for you and to follow your application. We ask for your consent in plain, item-by-item terms before we check or share anything. You can withdraw consent as easily as you gave it. Your data is stored in India. Every sign-in uses a one-time code, and personal data is masked by default on our screens. You can ask for a copy of your data, a correction, erasure, a nominee or a privacy complaint at any time on the data request page, without an account.
1. Who we are and who decides what
LOANZ 360 is a loan aggregator, not a lender. It is an online loan comparison and application platform that works for partner banks and NBFCs, as a lending service provider. For the personal data we collect through this website and the LOANZ 360 portals, LOANZ 360 is the data fiduciary under the Digital Personal Data Protection Act, 2023 (the DPDP Act): we decide why and how that data is used on our platform.
A lender you apply to is a separate data fiduciary for its own decisions. When you choose to apply to a lender, that lender receives your application and uses your data to assess it, to sanction and pay out a loan, to service it and to collect repayment. The lender's own privacy notice and its Key Fact Statement govern that use. LOANZ 360 does not decide, price, sanction or pay out any loan.
2. What we collect, by who you are
Personal data we collect, by type of user
| Who you are | What we collect | Where it comes from |
|---|---|---|
| Borrower or applicant | Name, mobile number, email address, city, date of birth, employment and income details, existing loan obligations, the loan you want, KYC documents and papers you upload, and your consent records. | You, when you fill in a form, chat with us or upload papers; a staff member entering details you gave them; the credit bureau, only after you consent to a credit check. |
| Co-applicant, guarantor or family member you add | Name, relationship, mobile number and the details needed for the application. | You, and you confirm that the other person agreed to be added. |
| Person referred by a friend | Name and mobile number. | The person who referred them, who confirms that the friend agreed. |
| Partner (DSA, connector, channel partner) | Name, contact details, business and KYC details, bank details for payouts, agreement acceptance, and activity on the partner portal. | The partner, and checks our team carries out to approve the partner. |
| Lender's staff | Name, work email, mobile number for sign-in codes, role, and activity on the lender portal. | The lender, and the staff member. |
| Job applicant | Name, contact details, CV and the consent you give on the careers form. | You. |
| Website visitor | Which pages are read and the device and browser type, only if you accept analytics cookies. Your cookie answer is always stored. | Your browser. |
| Person making a data request or complaint | Name, mobile number, email address, what you ask for and the reference we give you. | You. |
We also keep a record of each consent: what you agreed to, the version of the notice you saw, the time, and technical details of the request such as the network address and browser. We record these on our server so that they can serve as evidence. We do not read your phone's contacts, call logs, messages, files or media.
3. Why we use your data
Purposes and the basis for each
| Purpose | What we do | Basis |
|---|---|---|
| Match you with lenders | Compare your details with each partner lender's published eligibility criteria before any application is sent, so you apply only where you are likely to qualify. | Your consent |
| Prepare a credit assessment summary | Our team prepares a credit assessment summary of your income, obligations and credit history before your file reaches a lender. | Your consent |
| Check your credit report | Request a credit report from a credit bureau, only after you give a specific consent for it. | Your consent |
| Submit your application | Send your application and papers to the lender or lenders you choose, and follow the file until sanction and disbursal. | Your consent |
| Keep your account and sign you in | Create your account, send one-time codes, and keep your status and EMI reminders up to date. | Your consent and the service you asked for |
| Contact you about your file | Send service messages by SMS, email, WhatsApp or in the app about documents, status and due dates. | Your consent and the service you asked for |
| Marketing messages | Tell you about other products or offers. | A separate consent, which you can withdraw at any time |
| Answer your rights requests and complaints | Verify who you are, find your data, reply and keep the record. | Legitimate use under the DPDP Act: responding to a request you made |
| Meet legal duties | Keep records the law requires, respond to lawful orders, prevent fraud and money laundering. | Legitimate use under the DPDP Act: legal obligations |
| Keep the platform secure | Detect misuse, rate-limit sign-in and form attempts, keep an audit trail of who changed what. | Legitimate use and reasonable security safeguards |
| Improve the website | Count which pages are read. | Your consent, through the cookie choice |
4. Consent and how to withdraw it
We ask for consent in a notice that lists each item of data and each purpose, in plain language. The consent boxes are not ticked for you. Marketing consent is separate from the consent we need to process your loan enquiry. Where a member of our sales team creates an enquiry on your behalf, the consent is confirmed with a one-time code sent to your own mobile, so that it is yours and not theirs. This follows the explicit, purpose-specific consent with an audit trail that the RBI Digital Lending Directions, 2025 require (RBI Digital Lending Directions, 2025, para 12).
You can withdraw a consent from the Privacy page of your customer account, or by writing to the Nodal Grievance Redressal Officer through the details shown on the grievance page. When you withdraw, we stop using your data for that purpose and we confirm it to you in the app and by email. Withdrawal does not undo what was lawfully done before it. If a lender has already received your application, the lender's own records stay with that lender. Withdrawing a consent that a service depends on may mean we can no longer provide that service.
5. Who we share your data with
Who can receive your data
| Recipient | What they receive | Condition |
|---|---|---|
| Lenders you choose | Your application and the papers needed to assess it. | Only when you choose to apply to that lender, after your consent. |
| Credit bureaus | The details needed to find your credit report. | Only after your specific consent for a credit check. |
| The partner or sales team member who introduced you | The status of your file and the details they need to help you, as set by our access rules. | They see only what their role permits. They do not see everything we hold. |
| Our loan officers and support staff | The details needed to process your file or answer you. | Role-based access. Personal data is masked until a task needs it, and access is logged. |
| Service providers acting for us | The minimum needed to send messages, host our systems, verify codes or check documents for malware. | Under contract, to act only on our instructions, with security safeguards. |
| Courts, regulators and authorities | What the law or a lawful order requires. | Only when required by law. |
We do not sell your personal data. Partners and lenders who receive your data from us must use it only for the purpose you agreed to. Which lenders we work with is shown, from live records, on the lending partners page.
6. Where your data is stored
Your data is stored on servers located in India. This follows the RBI requirement that lending data be stored only on servers within India (RBI Digital Lending Directions, 2025, para 13). Our primary database runs in the Mumbai region. If a service provider ever needs to process data outside India, we will say so in this policy first and will follow the Directions, which require that data processed abroad is deleted there and brought back to India within a stated time.
7. How we protect your data
- Every sign-in to a LOANZ 360 portal uses a one-time code. We never ask you to share that code with anyone, including our staff.
- Personal data such as mobile numbers, PAN and Aadhaar is masked by default on screens, and shown in full only where a task needs it.
- Access is by role. Staff, partners and lenders see only what their role allows, and changes are written to an audit log that is checked for tampering.
- Forms that anyone can reach, such as enquiries, complaints and data requests, limit repeated attempts and check that a person, and not a program, is filling them in.
- Uploaded files are checked for malware before they are accepted.
- If a personal data breach occurs, our Super Admin team approves a notice and we tell each affected person, and we report to the Data Protection Board as the DPDP Rules require.
No system is perfectly secure. If you suspect that your account or a one-time code has been misused, tell us at once through the grievance page. The DPDP Rules, 2025 set out the notice, security and breach duties of a data fiduciary and the dates on which each duty takes effect (DPDP Rules, 2025, Gazette notification G.S.R. 846(E)). Some of those duties start on later dates. We follow the standard now, ahead of those dates.
8. How long we keep your data
We keep personal data only while the purpose it was collected for continues, and for as long as the law requires us to keep a record. The periods that apply to the main kinds of record are below.
Retention by kind of record
| Record | How long it is kept | Why |
|---|---|---|
| Loan files, co-applicant records, KYC and loan documents | For 5 years after the relationship ends. | RBI KYC Master Direction and the Prevention of Money-laundering rules. |
| Credit reports | With the loan file. | Credit Information Companies (Regulation) Act and RBI rules. |
| Commission, ledger, payout and tax records | For the period tax and company law require, up to 8 years for some records. | Income-tax and Companies Act record-keeping rules. |
| Consent records and data requests | As long as a claim arising from the processing could still be brought. | They are our evidence of what you agreed to and what we did. |
| Audit trail of changes | At least 8 years. It is not deleted, because deleting would break its tamper check. | Company law and IT governance rules. |
| An enquiry that never became an application | Only while the enquiry has a purpose. | Storage limitation under the DPDP Act. |
| Uploaded documents | For the period set for each document type. When that date passes, the document is moved out of use and is not deleted at once. Documents on a file still being decided are left alone. | Retention policy set by our Super Admin team. |
| Cookie choice | 180 days. | So that we do not ask you at every visit. |
When you ask for erasure, we remove what we are not required to keep and we tell you what we must keep, and on what legal ground. See section 10.
9. Cookies and analytics: your choice
Our team may switch on a visit-counting tool to see which pages people read. If one is switched on, you see a card asking whether we may count your visit. Nothing from that tool is loaded until you press Accept. If you press Decline, nothing is loaded and we only remember your answer. The only thing we record about your choice is one cookie of ours that holds the word accepted or declined, kept for 180 days. It carries no identifier. The tool is not used to decide anything about a loan.
You can change your mind at any time with the Cookie choices link in the footer. It forgets your answer, clears the analytics cookies that the tool set, and asks again. Signing in to a portal also uses cookies that are needed to keep you signed in; these are not used for analytics.
10. Your rights
The DPDP Act, 2023 gives you rights over your personal data. The legal duty to honour them starts on 13 May 2027 under the DPDP Rules, 2025; we offer them now. You can use each of them on the data request page without an account, or from the Privacy page of your customer account.
Your rights and how we handle them
| Right | What it means | What to expect from us |
|---|---|---|
| Access | A summary of the personal data we hold about you, what we use it for and who we have shared it with. | We check that it is you, then send the summary. |
| Correction and completion | Fix data that is wrong, incomplete or out of date. | We correct it and tell you. Where a lender holds a copy, tell the lender too. |
| Erasure | Delete data we no longer need for the purpose. | We erase what we are free to erase. We tell you which records we must keep by law and why. Your account is closed and your sign-ins end. |
| Grievance | Raise a concern about how we handled your data. | It goes to our Nodal Grievance Redressal Officer. See the grievance section below. |
| Nomination | Name a person who can use these rights for you if you die or cannot act yourself. | We record the nomination after the same identity check. |
| Withdraw consent | Stop a use that rests on your consent. | Done from your account or on request. We confirm it to you. |
A request made without an account is proved by a six-digit one-time code sent to the contact details we hold for that mobile number. The code works for 10 minutes. This stops anyone asking, least of all for erasure, in another person's name. When your request is filed, you get a reference that starts with DR and the date we will answer by. That date is set in our system and shown to you at that moment. You also get messages when the request arrives, moves and is answered.
11. Children's data
LOANZ 360 is meant for adults. We do not knowingly collect personal data of anyone under 18 years of age. The DPDP Act requires verifiable consent from a parent or lawful guardian before a child's data is processed, and it bars tracking and targeted advertising aimed at children. If you believe a child's data has reached us, tell us through the grievance page and we will remove it.
12. Grievances and the Data Protection Board
If you are unhappy with how we handled your data, first write to our Nodal Grievance Redressal Officer. The name and contact details are shown on the grievance page and the contact page. A privacy grievance can also be filed on the data request page. If you are not satisfied with our reply, you may approach the Data Protection Board of India, which the DPDP Act sets up to hear complaints about personal data. Check the Board's own website for when and how it takes complaints. Loan complaints against a lender follow a different path, set out on the grievance page.
13. Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows the latest version. If a change affects what you have consented to, we will ask for your consent again before using your data in the new way. Earlier versions are available on request through the Nodal Grievance Redressal Officer.
See also: Your data, in plain words, the Terms of Use, the digital lending disclosures and the borrower rights guide.
Does LOANZ 360 sell my data?
No. We do not sell personal data. We share it with lenders you choose, with bureaus only after your consent, with partners only as their role allows, and with service providers who act for us under contract.
Where is my data stored?
On servers in India. Our primary database runs in the Mumbai region, in line with the RBI rule that lending data be stored only on servers in India.
Can I use my rights without an account?
Yes. The data request page works without an account. You prove the request is yours with a six-digit code sent to your mobile number.
Will erasure delete everything?
Not always. We must keep some records, such as loan files and KYC papers, for the period the law sets. We erase the rest and tell you what we kept and why.