Privacy Policy

1. Who this policy is from

This Privacy Policy is issued by Credifin Limited (formerly PHF Leasing Limited) (“Credifin”, “we”, “us”, “the Company”), a Non-Banking Financial Company registered with the Reserve Bank of India since 1998 and lending since 1992. It explains how we handle information about you when you visit our website, apply for a loan, use our digital channels, or deal with our branches, dealer partners and representatives.

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Credifin is the Data Fiduciary in respect of the personal data described below, and you are the Data Principal.

• Entity — Credifin Limited (formerly PHF Leasing Limited)
• Regulator — Reserve Bank of India — registered NBFC
• CIN — L65110PB1992PLC012488
• RBI Certificate of Registration — B-06.00124 — issued under Section 45-IA of the Reserve Bank of India Act, 1934
• Deposits — Credifin does not accept public deposits. Our Certificate of Registration is expressly marked “Not valid for accepting Public Deposits”.
• Registered office — 87 Radio Colony, New Jawahar Nagar, Jalandhar, Punjab 144001
• General contact — Phone 079651-74500 · info@credif.in

This policy is written to be read alongside our Fair Practices Code and Grievance Redressal Policy, and does not replace the terms of any loan agreement you sign with us. Where a loan agreement and this policy differ on a data matter, the loan agreement and applicable RBI directions prevail.

2. What we collect

Identity and contact data

• Name, date of birth, gender, photograph and signature
• PAN, Aadhaar (in the manner permitted by law), Voter ID, Passport, Driving Licence and other officially valid documents
• Residential and business address, PIN code, mobile number and email address

Financial and credit data

• Income, employment or business details, bank account details and bank statements
• Income tax returns, GST details and other financial records where applicable
• Credit information, credit score and repayment history obtained from Credit Information Companies
• Details of existing borrowings, obligations and repayment conduct with us

Asset and transaction data

• Details of the vehicle, property or asset being financed, including invoice, registration and insurance particulars
• Dealer, distributor or manufacturer through whom the application originates
• Loan account activity — disbursal, EMI, repayment, foreclosure and collections history

Technical and usage data

• IP address, device and browser type, operating system and approximate location derived from IP
• Pages viewed, referring URLs, time on page and interactions with our forms and calculators
• Cookies and similar technologies — see clause 08

Sensitive personal data. Financial information, biometric-linked identifiers and similar categories are treated as sensitive under the Information Technology (Reasonable Security Practices) Rules, 2011 and are handled with correspondingly stricter controls. We do not require your account passwords, UPI PIN, card CVV or OTP for any purpose, and no Credifin employee or representative will ask you for them.

3. Where we get it from

• Directly from you — enquiry and application forms, calls, email, WhatsApp, branch visits and documents you submit
• From dealer and channel partners who originate applications on our behalf
• From Credit Information Companies (TransUnion CIBIL, Experian, Equifax, CRIF High Mark) for credit assessment and monitoring
• From verification and KYC service providers, including CKYCR, and from Aadhaar-based verification where you have consented
• From public and statutory sources — registries, government databases and records permitted by law
• Automatically, when you use our website and digital channels

4. Why we use it, and on what basis

We process personal data for the purposes below. Where the DPDP Act requires consent, we obtain it; where processing is a “legitimate use” under that Act — for example to comply with a legal obligation or to perform the loan contract you have entered into — we rely on that basis.

• Assessing your application — Verifying identity and address, checking eligibility, obtaining and analysing credit information, and taking a credit decision.
• Providing the loan — Documentation, disbursal, servicing, EMI collection, statements, foreclosure and closure.
• Regulatory compliance — KYC and AML obligations, RBI directions, reporting to Credit Information Companies and other statutory reporting.
• Fraud prevention — Detecting, investigating and preventing fraud, impersonation, misuse and financial crime.
• Recovery — Collections and recovery activity, conducted in line with our Fair Practices Code and RBI directions on outsourcing and recovery agents.
• Service communication — Transactional messages about your application and loan account.
• Marketing — Information about products and offers — only where you have not opted out. This is the one purpose you can decline without affecting your loan.
• Improving our services — Analytics on how our website and products are used, on an aggregated basis wherever practicable.

We do not sell your personal data. We do not share it with third parties for their own independent marketing.

5. Credit bureau reporting

As an RBI-registered NBFC we are required to be a member of Credit Information Companies and to report the conduct of your loan account to them. This is a statutory obligation, not an optional feature, and it applies for as long as the law requires.

• We share loan, repayment and default information with Credit Information Companies at prescribed intervals
• Late payment, default or settlement of a loan will be reflected in your credit record and may affect your ability to obtain credit elsewhere
• We obtain your credit information from these companies at application stage and periodically during the life of the loan
• Disputes about the accuracy of reported information can be raised with us using clause 12, and separately with the Credit Information Company concerned

By applying for a loan you authorise Credifin to obtain your credit information from, and furnish information about your account to, Credit Information Companies in accordance with the Credit Information Companies (Regulation) Act, 2005.

6. Who we share it with

We disclose personal data only where there is a clear reason to, and we place contractual confidentiality and security obligations on the parties we appoint.

• Regulators and authorities — The Reserve Bank of India, other regulators, statutory and law-enforcement authorities, and courts, where required or permitted by law.
• Credit Information Companies — As described in clause 05.
• Service providers — KYC and verification agencies, credit bureaus, payment and mandate processors, IT and cloud vendors, document storage, communication providers, and analytics providers.
• Recovery and collection agents — Appointed agents, bound by our Fair Practices Code and by RBI directions governing their conduct.
• Co-lenders and assignees — Banks, financial institutions or investors in connection with co-lending, assignment, securitisation or a transfer of the loan portfolio.
• Dealer and channel partners — Only to the extent needed to process the specific application they originated.
• Insurers — Where an insurance product is arranged in connection with the financed asset.
• Professional advisers — Auditors, lawyers and consultants under a duty of confidentiality.

Where a third party processes data on our behalf, it acts as a Data Processor under contract and may not use the data for its own purposes.

7. Digital lending

Where a loan is sourced or serviced through a digital channel or a Lending Service Provider (LSP), the RBI Guidelines on Digital Lending apply in addition to this policy.

• Disbursal and repayment flow directly between your bank account and Credifin — not through the account of an LSP or any third party
• We collect only data that is need-based, with your explicit consent and a clear audit trail
• We do not access your phone contacts, files, call logs or media
• You may withdraw consent for data collected through a digital channel, and may ask for the data collected through it to be deleted, subject to the retention obligations in clause 10
• A Key Fact Statement setting out the all-inclusive cost of borrowing is provided before the loan agreement is executed
• Details of the LSPs and recovery agents engaged for your loan are disclosed to you

8. Cookies and analytics

Our website uses cookies and similar technologies to keep the site working, remember your preferences and understand how the site is used.

• Strictly necessary — Required for the site to function — page delivery, security and form handling. These cannot be switched off.
• Performance and analytics — Aggregate measurement of page views and journeys, so we can see what is and is not working.
• Functional — Remembering choices such as calculator inputs, so you do not re-enter them.

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the site working. Our site honours the browser Do Not Track and reduced-motion signals where technically feasible.

9. How we protect it

• Encryption of data in transit over public networks
• Access on a least-privilege, need-to-know basis, with authentication and logging
• Physical and environmental controls at our offices and data facilities
• Contractual security and confidentiality obligations on vendors and partners
• An internal IT Policy, Risk Management Policy and periodic review of controls
• Staff training on confidentiality and on handling customer information

No system can be guaranteed completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act. If you believe your credentials or account have been compromised, contact us immediately on 079651-74500.

10. How long we keep it

We retain personal data for as long as it is needed for the purpose it was collected, and for as long as we are required to keep it by law — whichever is longer.

• KYC records are retained for the period prescribed under the Prevention of Money-Laundering Act and RBI Master Directions, generally at least five years after the end of the relationship or the transaction
• Loan account and transaction records are retained for the period required under RBI directions, the Companies Act and tax law
• Records relevant to a dispute, investigation or legal proceeding are retained until it is concluded and the limitation period has expired
• Applications that do not proceed are retained for a limited period for audit and fraud-prevention purposes, then deleted or anonymised

When data is no longer required and no legal obligation applies, it is deleted or irreversibly anonymised.

11. Your rights

Subject to the DPDP Act and applicable financial-sector law, you have the following rights. We will respond within the timelines prescribed by law.

• Access — A summary of the personal data we hold about you and how it is being processed.
• Correction — Correction of inaccurate or misleading data, and completion of incomplete data.
• Erasure — Deletion of personal data that is no longer required — except where we must retain it under clause 10.
• Withdraw consent — Withdraw consent given for a specific purpose. Withdrawal is not retrospective, and may mean we can no longer provide a product that depends on that data.
• Nomination — Nominate another individual to exercise your rights in the event of your death or incapacity.
• Grievance — Raise a grievance with us, and escalate it — see clause 12.

Opting out of marketing will never affect your application, your loan, or the service you receive. Transactional messages about your account will continue regardless, because we are obliged to send them.

12. Grievance redressal and escalation

If you have a concern about how your data has been handled, use this route. Each level has a defined response window; if you are not satisfied at one level, escalate to the next.

Level 1 — Customer service

• Phone — 079651-74500 · 0181-4639903-06
• Email — info@credif.in
• Post — Credifin Limited, 87 Radio Colony, New Jawahar Nagar, Jalandhar, Punjab 144001

Level 2 — Principal Nodal Officer

• Officer — Kuldip Bhandari, Principal Nodal Officer (Ombudsman Scheme)
• Email — kuldip@credif.in

Level 3 — Designated Director

• Officer — Vijay Kumar Sareen, Whole Time Director
• Contact — 079651-74500 · vksareen@credif.in

Level 4 — RBI Ombudsman

If your complaint is not resolved within 30 days, or you are not satisfied with the resolution, you may approach the RBI Ombudsman under the Reserve Bank – Integrated Ombudsman Scheme, 2026, at cms.rbi.org.in or the RBI contact centre on 14448.

Data Protection Board

For grievances specifically under the DPDP Act that remain unresolved, you may complain to the Data Protection Board of India once it is operational.

Grievance Officer designated under the DPDP Act: Kuldip Bhandari — kuldip@credif.in. You may write to the Grievance Officer directly for any matter concerning your personal data, without first going through Level 1.

13. Children

Our products are not offered to children. We do not knowingly collect personal data of a child (under 18) except where a minor is involved in a transaction in a manner permitted by law and with verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

14. Transfers outside India

Personal and financial data relating to your loan is stored on servers located in India, consistent with RBI directions on the storage of payment and customer data. Where a service provider processes limited data outside India, we do so only to countries not restricted by the Central Government under the DPDP Act, and under contractual safeguards.

15. Changes to this policy

We may update this policy to reflect changes in law, regulation or our practices. The revised version takes effect from the date it is published on this page, and the “last updated” date at the top will change. Where a change materially affects how we use your data, we will bring it to your attention through our usual communication channels.